877c63510ebf601dd2afcf8c88a435d1b11fb90aedac3562f80ad40f56bdcc60

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260701-dzlldsdw2j
SHA256 877c63510ebf601dd2afcf8c88a435d1b11fb90aedac3562f80ad40f56bdcc60
MD5 a8d288d3929270330ee3994d7b994cff
SHA1 06ce5cc797cf6aee1363ceed5d451c5611bd07e0
SHA512 da0b67655506385e19fa2b20d61dae563403a0296d001ce3ad10d2a37b04300db993f6408a74a53c8b49d4f2fb85f2da90b76b426708cb730b859b2ff706c854
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3N:CebAjOKn3wRKRJ3N
TLSH
T115D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6180	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_152542647\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_152542647\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-sk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1821584747\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_152542647\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_286623293\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_738155182\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_286623293\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1821584747\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_738155182\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_152542647\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1163175404\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-hr.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4304	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273500159390075"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{47AD5BC9-C9C2-4441-8836-04A3B5DA713E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4404	wmic.exe
4404	wmic.exe
4404	wmic.exe
4404	wmic.exe
5472	msedge.exe
5472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6180	msedge.exe
6180	msedge.exe
6180	msedge.exe
6180	msedge.exe
6180	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6280	2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6180	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 6280 wrote to memory of 5996	6280	2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe	90
PID 6280 wrote to memory of 6180	6280	2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe	92
PID 6180 wrote to memory of 6620	6180	msedge.exe	93
PID 6180 wrote to memory of 2572	6180	msedge.exe	95
PID 6180 wrote to memory of 4304	6180	msedge.exe	96
PID 6180 wrote to memory of 2572	6180	msedge.exe	95
PID 6180 wrote to memory of 2572	6180	msedge.exe	95
PID 6180 wrote to memory of 3012	6180	msedge.exe	97
PID 6180 wrote to memory of 3012	6180	msedge.exe	97
PID 6180 wrote to memory of 4664	6180	msedge.exe	99
PID 6180 wrote to memory of 1912	6180	msedge.exe	98
PID 6180 wrote to memory of 4664	6180	msedge.exe	99
PID 6180 wrote to memory of 4664	6180	msedge.exe	99
PID 6180 wrote to memory of 1912	6180	msedge.exe	98
PID 6180 wrote to memory of 1912	6180	msedge.exe	98
PID 6180 wrote to memory of 4936	6180	msedge.exe	100
PID 6180 wrote to memory of 4936	6180	msedge.exe	100
PID 6180 wrote to memory of 4936	6180	msedge.exe	100
PID 6180 wrote to memory of 4024	6180	msedge.exe	101
PID 6180 wrote to memory of 4024	6180	msedge.exe	101
PID 6180 wrote to memory of 4024	6180	msedge.exe	101
PID 6180 wrote to memory of 6984	6180	msedge.exe	102
PID 6180 wrote to memory of 6984	6180	msedge.exe	102
PID 6180 wrote to memory of 6972	6180	msedge.exe	103
PID 6180 wrote to memory of 6972	6180	msedge.exe	103
PID 6180 wrote to memory of 5740	6180	msedge.exe	105
PID 6280 wrote to memory of 4404	6280	2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe	108
PID 6180 wrote to memory of 2456	6180	msedge.exe	112
PID 6180 wrote to memory of 2512	6180	msedge.exe	113
PID 6180 wrote to memory of 4864	6180	msedge.exe	114
PID 6280 wrote to memory of 5412	6280	2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe	115
PID 6180 wrote to memory of 5940	6180	msedge.exe	117
PID 6180 wrote to memory of 5940	6180	msedge.exe	117
PID 6180 wrote to memory of 5860	6180	msedge.exe	119
PID 6180 wrote to memory of 5860	6180	msedge.exe	119
PID 6180 wrote to memory of 2044	6180	msedge.exe	120
PID 6180 wrote to memory of 2044	6180	msedge.exe	120
PID 6180 wrote to memory of 6748	6180	msedge.exe	121
PID 6180 wrote to memory of 6748	6180	msedge.exe	121
PID 6180 wrote to memory of 1772	6180	msedge.exe	122
PID 6180 wrote to memory of 1772	6180	msedge.exe	122
PID 6280 wrote to memory of 4848	6280	2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe	123
PID 6180 wrote to memory of 5472	6180	msedge.exe	125
PID 6180 wrote to memory of 3064	6180	msedge.exe	126
PID 6180 wrote to memory of 3064	6180	msedge.exe	126
PID 6180 wrote to memory of 3780	6180	msedge.exe	127
PID 6180 wrote to memory of 3780	6180	msedge.exe	127

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5996	attrib.exe
5412	attrib.exe
4848	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6280
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.old_1782876412
  2⤵
  - Views/modifies file attributes
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbc7b1c188,0x7ffbc7b1c194,0x7ffbc7b1c1a0
    3⤵
    PID:6620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1992,i,18258963746426509093,5092933512953144417,262144 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,362353092087335339,17833471265767195919,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2696,i,17814026211899164616,543485056972483335,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,1177570480861568036,9156435506164496558,2097152 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,14993061079623654579,10565831091095475325,2097152 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5044,i,18219690132832876581,5175861448684710551,2097152 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:9
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5300,i,11590052769907113173,458817540551843446,2097152 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:15
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,7375538912143681500,5859511055128630462,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2744444836624763799,4565010989992300512,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,17573607025610137965,12514724291135424347,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,17573607025610137965,12514724291135424347,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,2260988441838166502,12904534825938966382,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11899223355485625969,17281563550258327918,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,6326289086871061442,12857532854724028285,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6141488256947186772,6872444220939217926,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,13389104149231878457,17946910560037168203,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4323667649535222627,4427089958756700712,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,6023493651084208549,11905049220115251658,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,11290295210232251175,6668943784539645128,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6720,i,18413859606283030284,726129065600254435,262144 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,8644001518242452323,1809142913348651126,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,3196732668471813695,16069621166394091665,524288 --field-trial-handle=2512,i,18294566456533030802,17303905028884535171,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:3780
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.old_1782876472
  2⤵
  - Views/modifies file attributes
  PID:5412
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.old_1782876532
  2⤵
  - Views/modifies file attributes
  PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d5218179af7a578f36a2c75ddefb6eda3cace31dfd914a0570749e6153172f5f
MD5 b77d76875fc6f73892399e3c498c842f
SHA1 fd65d1537bee800c63bf800e405ba4b4c31afb6b
SHA512 7a2d3ddb81279d37ae56e5bf5783f68b810c1d4bb7de957c8d81c93c7e52ab30b852fa52480e480a29f92766448fb9cbd6e151644fae43b72669157a286310aa
TLSH
T13C61702109371931C7AA6C727CE3EC85FF788489C5076E15608A9BF46F0A78AE4C25DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dc71.TMP
Size 3KB
SHA256 076beced3633bc14529d6fa0cf92378647a3d0efbd8e12a6fe60ff75d9c78674
MD5 2f1f6bb0ab80c16a346978a321581b59
SHA1 2d73e48f6adb05bae14c05f9aad1e6b48fb33054
SHA512 c5e886dd1b94e613c93b7a5cef0fed83d3d34cd3d2feb065e2ae821cd8ba28a3ee6b8e31fe853efda769e751cf3fde4f2a144397be5ac8cdf91c62e7f9160496
TLSH
T182616F1115370931C3A92C727CE3EC85FF788886C4076E14A09A9BF86F0A799E4C259F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cc44c96489126650c1ef8b347041892b10d08f02d4c85fd21fce249acff2376e
MD5 1244aac1e39db1c14886d60dc2726193
SHA1 b69bf60ef99c611badd7675f9efca15018fa59d1
SHA512 86c71213f49194cd5070e7cd390cc2f79c75cc9ed85b72139127a3f5eb837d1e833030fb3062263dd065a24b35c1f666832e3b34b428356820aa9b2155f8aefa
TLSH
T1F951C0F7C3E4866DDA1196F0BA186E2BCE2D0914432C3D5AC9E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9e3956fe63f0c0dba7698d34c2c633b0e77cdfdfd644f672275d66d342265f17
MD5 1889bd05a2b44e01e7ccf67b30e413d7
SHA1 cb8c912feb43997097e55cf13c1858e5df1731a8
SHA512 9dd4838d03a6f44ee1e3bcddde5d68949c2e0ab788c97f853f9482261787f14687881ee681d41a80e597319299f097c6428809b547efb20bbf4a4a5eb3acaf8f
SSDEEP 384:sxRY6CO/fgsXsmBaSRiMwM5/5ImCOwsXFjaE:s0fO/fgmED7y/5ImMsX8E
TLSH
T1AE72E9166938993BCCDBD219FA517B53D6F91173A2905E44AAFC8B1C01E76ED210383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 40bb0dca7aa745ee2d09c5def26788c05852450c2167ca2f942dee173aec8c36
MD5 14e03ee80d3f4ea46a16f0a89ccd8e63
SHA1 1ebcedee58cdc5e67fa02500e8ff54be9436428b
SHA512 eac1a53b31c1a5f7c9a61375a07676dbc350e0fa8966bb32f2dad7c2dc980a8ab4df4911d17564aa0661866762a4fed782bb990b6e315f4a26072b1a02a35e2f
SSDEEP 384:sxRY6qrO/fgsw3BaSRiMwM5/5IwVOwsXFdb:s0FrO/f03ED7y/5IwpsXL
TLSH
T1B672D8166938993BCCDBD219FA81BB53D6F91173A1905E44AAFC8B1C01E76ED211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4c4defeafdbb3c5b6898fe1a4180a2a049003a29bc2fde0e1a77fc6a9f9c5c6e
MD5 9f64a64961fbeb6aa8c828347b3af0ad
SHA1 a7dd04555b5db9899d6614916ba35c9e1ef4d016
SHA512 4179c0a5f20e63ef43ab652c15de49a8ef970a08ce0f0c7d0ddfb497f050cc3d8857eb702e99a87e25170115adc8c86141ccbf84df5d92831632d55b4f47c962
SSDEEP 768:PRbg3u7pLuL75sWgtVfwp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPokUfYHro7zBj:PRbg3uE75sWgtVfwpu1jakokoYU7t
TLSH
T109E2FD7B680CC77F4F844EDCEC2ABE9A6DD802CB5AD8C95447EA840C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bbc1a33ff62b31070c6efcd5c0dae1aea3b2241374dbd7ea8be5f2e35577175a
MD5 d4bf83de7210bede805967572076e3d8
SHA1 3aa82f99d71782f7d0a07326f3274fa2a0ac6789
SHA512 f3cd3ce81610fec5f74e9c2c1eab03a322f646e477b86cd8774eea2675fedff0702859711bb2972e470b854e504824fdc91b5c65559e77c23d4331e1fffd794b
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/Z:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBz
TLSH
T1A1B28D5171BA2700383E280EA3B9841F5A46306230DEA96B7B6935E56F67F001FFD6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a6455c0fc1f7fc144214f86d37b383cde3bf31e25c737db470aafdb2cd3b2389
MD5 155789289847f03746cd5eacd44afc22
SHA1 c7bffacd53e6810f340f85cbe1eea7485f67a8d1
SHA512 8f230c72ceac6e8d785507a774315e203d172084df24433e1412541973c051727362858bd14d4a1931e8278dd90c752dba971c750225ad5a05abee854bf47cf3
SSDEEP 384:nOiF1tNn/s3n9Sv8Nq8TUNTUlIR90zvmoPOfosGnmvTDizyQKogmn15wbAjEJ/8/:lF1j+9SHwgtvGmvTDieQKogmn12bfJu
TLSH
T18DC23A36E894CE77EDE78FC9B7497616EEE412A785D85AD4D9D80D4C01C329D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c964ade63fe789e44b8697b49fb09513fb74da35faf36ee462f087b55681b1ce
MD5 7ef088e2d6950a9cb3cb2170dc48c9c0
SHA1 91a0f5aa9db898f285e0aa44b9cfc2e74f97114e
SHA512 f4cd037b94dc7e67b2e7cc85baa03b1d514ececd1ee5c332bde34b10e7fd1aad1d08568673c46ad0d38b92876ecef21aba7fb05603428f2bebbd640c50081ddd
SSDEEP 384:n1iF1tNn/s3n9S38NK8TUNTUlIR30zrLmPOfnsGnmvTDizyQKQXvpX0IidKzvD6P:8F1j+9qDwgi0GmvTDieQKgvp78Kz2Jx
TLSH
T16ED25A32E891CEB7DCE68BD9B74A3756EEE412A3C5889ED4DAC81D4C00C729D130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 468e3275b1a1287d4afefcac669beead824337a09708402c21cf0cb81f9908d5
MD5 b3285077847e99941b323fa6e6f19d70
SHA1 308c3e65fc474b365e3cc7cc402620259bc81001
SHA512 7639b57626d3a4415c6e0dcaf89e9e17110c441cb93c756a5906c9f854f70c03f9d0f79727a5b264cf61a5d0e9eff5d634094e3c1487259688fcd9bd5c187c23
SSDEEP 384:nYiF1tNn/s3n9So8NK8TUNTUlIR30zjLmPOfosGnmvTDizyQKQXbpX0IidKzvD6P:jF1j+9tDwgmJGmvTDieQKgbp78Kz2Jx
TLSH
T16BD25B36E855CEB7DCE68BD9B74A3756EEE412A3C5889ED4DAC81D4C00C729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c07c54b-5e84-4dbb-aa98-5f5572c0ee61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2c07c54b-5e84-4dbb-aa98-5f5572c0ee61.tmp
Size 1KB
SHA256 06399c5cfe2c1083edb783a75caf9def90d2930c04aca65802c3b1c7db30740c
MD5 10d4ec6f5cfa10f9decb9bab58e35a8c
SHA1 8a2ae7e84181fdd96214c699cec8c7ca106227af
SHA512 ac291398f18c4a8dcd5ff17e26d43c665ebe921ffdd10433bd5028f8fdb8090b5b2fa62a1edc54992ac13efb272e06c29f378c901abebd4c9dfa3156cf0bc779
TLSH
T131411EE19D3D2ED1C0FD0DBFB48B39FC94D8D622F59434396898E998862D91E698043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1ad6136e097ce09424c14d4203b2b1cf6ca91c42675833d8b1689e13ad59bbd7
MD5 b8090a7456a135f65da2e359282f2713
SHA1 97c25a6345a2601786d999c7d76e6e0feec5909e
SHA512 ed5488034a1c78ce13dfaa0d51f901af59bb48b1e6bc082611f88b23cbbccf44c6bb147c0155537d800be97e2c3d826abeb10f8652289f283571623ce84e47d8
TLSH
T184412DE05C3D2AD1D0BD0E6FB49B38FC84E8D726F494343D2898E998466DA1D658143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ee197e04a188445f21e16f506c6b97ec17963e1504de1910fd566179597ccbda
MD5 f31be493fd96f305e6b8c9778b1367ad
SHA1 819f8f1715542fe68f9f4d6526aa59bacd19c130
SHA512 2153bfb13681def48207a3aa3a2d930b83947a74bb17e9a4e86103410acd693184f04fbcbfd4444770b432a0d66186e05c41e2b131be09a8fe05d12652e0e5b1
TLSH
T1E34130E04C3D2AD1D0BD0E7FB48B38FC80D8D722F494343D2898EA88462E61D648043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aa652a57ac8d49cc1a3d607eca4f8f7ce28c8d1563a4181dbc84bf1ec73eef9e
MD5 b94aba7e774817b2b4076fb872cac55f
SHA1 bf774c83a9f293fafcfb45ab0d4337d032d9d5c8
SHA512 0bf399a194b912c15dee676fa97affc99899ae1ac7ad55e97a636f3b37710a3d5c4bd7549f19831bd3fb2adc9b0c2e3460b2648ae730863776ff7600df869723
TLSH
T1ED412EE05C3D2AD1D0BD0E7FB48B38FC84E8D726F494343D2898E998462EA1D658143F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 199fa27aebf66e6f3d652e85781711daf61073acd33abcdf0e867edd21957b7a
MD5 b5c3493e1257259c3cded96bd1f20dae
SHA1 5e1e04176b6778d29cea5092a67ba433b29e24d0
SHA512 5e33a80794d650b77b77bb92783155ffd27bd738cd4cafdf6ccf94927638fe04be76ee536a792ee585aed4aeee42c55a861fcead2b6b8cf9c131eab98335ef92
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3J:CebAjOKn3wRKRJ3J
TLSH
T15ED57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.old_1782876472

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_a8d288d3929270330ee3994d7b994cff_akira_glassworm_rusty-stealer.old_1782876472
Size 2.7MB
SHA256 fb74385751a27e48dc6b544a9ae9d2ab286a00b754e31a4e0855537bb1872572
MD5 16d208e506ec23d89c0536812f26b94d
SHA1 560c0e02d7c41b6d47ac48d182bf25735ebdbe9d
SHA512 fbe3c71f671fe09289fc3371a95a4d4001e58a21e9b813a137471ea07fddef9920ef783938e415ff95236bf771f62c08e8c52eadfdb73d989f4890f17e0c2446
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3D:CebAjOKn3wRKRJ3D
TLSH
T18CD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6180_1572512702\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6280-237-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-299-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-282-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-317-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-349-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-250-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-371-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-380-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-236-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-211-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-405-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-204-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-194-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download

memory/6280-172-0x00007FF6DE190000-0x00007FF6DE451000-memory.dmp

Download