247c66ffb8e49dac2a91536353b6e3132ee921d7b1e65d21dc0da173216401d5

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260702-ad64esf16q
SHA256 247c66ffb8e49dac2a91536353b6e3132ee921d7b1e65d21dc0da173216401d5
MD5 78ac34a37193c706bf88c280c53b01ee
SHA1 ec26c1955ac94248255e38e4027abaa98b032778
SHA512 2b9111dd2d5792fc69525735713ecb9e5ef8336bd6716ad7e25c1af7ec4683820d0c8ec5da359c65041081db6082416c4d709bf4405c8857f044e0326a91a943
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3f:CebAjOKn3wRKRJ3f
TLSH
T1EBD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_947628271\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_1505826597\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_947628271\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_1505826597\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Analytics	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6752	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274244179651826"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{82AE117D-EE28-4C8A-B22A-50A400AB0D6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
400	wmic.exe
400	wmic.exe
400	wmic.exe
400	wmic.exe
7048	msedge.exe
7048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6128	2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	400	wmic.exe
Token: SeSecurityPrivilege	400	wmic.exe
Token: SeTakeOwnershipPrivilege	400	wmic.exe
Token: SeLoadDriverPrivilege	400	wmic.exe
Token: SeSystemProfilePrivilege	400	wmic.exe
Token: SeSystemtimePrivilege	400	wmic.exe
Token: SeProfSingleProcessPrivilege	400	wmic.exe
Token: SeIncBasePriorityPrivilege	400	wmic.exe
Token: SeCreatePagefilePrivilege	400	wmic.exe
Token: SeBackupPrivilege	400	wmic.exe
Token: SeRestorePrivilege	400	wmic.exe
Token: SeShutdownPrivilege	400	wmic.exe
Token: SeDebugPrivilege	400	wmic.exe
Token: SeSystemEnvironmentPrivilege	400	wmic.exe
Token: SeRemoteShutdownPrivilege	400	wmic.exe
Token: SeUndockPrivilege	400	wmic.exe
Token: SeManageVolumePrivilege	400	wmic.exe
Token: 33	400	wmic.exe
Token: 34	400	wmic.exe
Token: 35	400	wmic.exe
Token: 36	400	wmic.exe
Token: SeIncreaseQuotaPrivilege	400	wmic.exe
Token: SeSecurityPrivilege	400	wmic.exe
Token: SeTakeOwnershipPrivilege	400	wmic.exe
Token: SeLoadDriverPrivilege	400	wmic.exe
Token: SeSystemProfilePrivilege	400	wmic.exe
Token: SeSystemtimePrivilege	400	wmic.exe
Token: SeProfSingleProcessPrivilege	400	wmic.exe
Token: SeIncBasePriorityPrivilege	400	wmic.exe
Token: SeCreatePagefilePrivilege	400	wmic.exe
Token: SeBackupPrivilege	400	wmic.exe
Token: SeRestorePrivilege	400	wmic.exe
Token: SeShutdownPrivilege	400	wmic.exe
Token: SeDebugPrivilege	400	wmic.exe
Token: SeSystemEnvironmentPrivilege	400	wmic.exe
Token: SeRemoteShutdownPrivilege	400	wmic.exe
Token: SeUndockPrivilege	400	wmic.exe
Token: SeManageVolumePrivilege	400	wmic.exe
Token: 33	400	wmic.exe
Token: 34	400	wmic.exe
Token: 35	400	wmic.exe
Token: 36	400	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4184	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 5856	6128	2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe	89
PID 6128 wrote to memory of 4184	6128	2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe	91
PID 4184 wrote to memory of 3272	4184	msedge.exe	92
PID 4184 wrote to memory of 6752	4184	msedge.exe	93
PID 4184 wrote to memory of 3572	4184	msedge.exe	94
PID 4184 wrote to memory of 3572	4184	msedge.exe	94
PID 4184 wrote to memory of 3572	4184	msedge.exe	94
PID 4184 wrote to memory of 6096	4184	msedge.exe	95
PID 4184 wrote to memory of 6096	4184	msedge.exe	95
PID 4184 wrote to memory of 1020	4184	msedge.exe	97
PID 4184 wrote to memory of 1020	4184	msedge.exe	97
PID 4184 wrote to memory of 1020	4184	msedge.exe	97
PID 4184 wrote to memory of 4600	4184	msedge.exe	98
PID 4184 wrote to memory of 4600	4184	msedge.exe	98
PID 4184 wrote to memory of 4600	4184	msedge.exe	98
PID 4184 wrote to memory of 3992	4184	msedge.exe	99
PID 4184 wrote to memory of 3992	4184	msedge.exe	99
PID 4184 wrote to memory of 3992	4184	msedge.exe	99
PID 4184 wrote to memory of 1472	4184	msedge.exe	100
PID 4184 wrote to memory of 1472	4184	msedge.exe	100
PID 4184 wrote to memory of 1472	4184	msedge.exe	100
PID 4184 wrote to memory of 3396	4184	msedge.exe	101
PID 4184 wrote to memory of 4088	4184	msedge.exe	102
PID 4184 wrote to memory of 3396	4184	msedge.exe	101
PID 4184 wrote to memory of 4088	4184	msedge.exe	102
PID 4184 wrote to memory of 1924	4184	msedge.exe	104
PID 6128 wrote to memory of 400	6128	2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe	107
PID 4184 wrote to memory of 2508	4184	msedge.exe	111
PID 4184 wrote to memory of 7016	4184	msedge.exe	112
PID 4184 wrote to memory of 4492	4184	msedge.exe	113
PID 6128 wrote to memory of 2152	6128	2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe	114
PID 4184 wrote to memory of 1100	4184	msedge.exe	116
PID 4184 wrote to memory of 1100	4184	msedge.exe	116
PID 4184 wrote to memory of 2436	4184	msedge.exe	119
PID 4184 wrote to memory of 2436	4184	msedge.exe	119
PID 4184 wrote to memory of 4780	4184	msedge.exe	120
PID 4184 wrote to memory of 4780	4184	msedge.exe	120
PID 6128 wrote to memory of 4488	6128	2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe	121
PID 4184 wrote to memory of 7048	4184	msedge.exe	123
PID 4184 wrote to memory of 6984	4184	msedge.exe	124
PID 4184 wrote to memory of 6984	4184	msedge.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5856	attrib.exe
2152	attrib.exe
4488	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.old_1782950814
  2⤵
  - Views/modifies file attributes
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff8a6e0c188,0x7ff8a6e0c194,0x7ff8a6e0c1a0
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,639852521488759766,1016184042050131325,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,2779528180320080181,4803941802710038490,262144 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,14275088288995488354,6941672474965618567,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,8857163010085216969,1308339343439204923,2097152 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,12670058954783162683,15983600419511248274,2097152 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4964,i,5629846317286273493,1447609932806338605,2097152 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5292,i,7363556773155676804,16989760381481195959,2097152 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:15
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11432690382079858961,17450065938599763380,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,2910220699804322878,2811527294453435895,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,13721272717804645548,4811337140177894760,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,13721272717804645548,4811337140177894760,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,18357089956571299121,7735307036917640369,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,12331207776301543864,3855004543238492045,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13322796525549966080,15544957655101419277,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,11773279185791657373,5060086020512606820,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,8431898508384874651,13533327859001441153,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,7883760555455440411,12768575721896060197,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6388,i,13673339133904990478,6951536820035050845,262144 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,4531330994000322501,6852165060282431858,524288 --field-trial-handle=2652,i,17439289287806249516,9144738268172078854,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
    3⤵
    PID:6984
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.old_1782950874
  2⤵
  - Views/modifies file attributes
  PID:2152
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.old_1782950934
  2⤵
  - Views/modifies file attributes
  PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 820976577134a3172f1c12e6f1923319a2cfa342820877538a7fe9d6ca2886ab
MD5 e98d29d55547aef936f08120d6d97d8c
SHA1 0b36c5c83a5ca89e9291f58e3c70aed334566a67
SHA512 6b77071a888c2c8580ddcfd24df511f5e09f3739106371ea302a8ba3de77ae592fc01289ca72111cb9ec64bbca63f4d100143a20704f9ad932a0dbc232447007
TLSH
T19D414E770E740E5DCB367D7418E12688FFF4E8A2483BAF1D2428C174CE5A3681EA2043
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f5d84fabe67883389eddb89a3e609c3049795d29a435fb6f1999854813f97818
MD5 2aa8ae05ba51dbe796633d34d5caa216
SHA1 5bcefeb6b84c39dd9131baa689314ef2907e4cec
SHA512 b672d749fc10025956d6256bd67f726949fe5b57134ebd9a4cc69fdacb1b00b9a35cbd97a7358242a00cfa8d33f76b2e04c013e427f1e45bb61bf33b7b691355
TLSH
T12341CEF783F4856E8A0195F0AA18AE2FCE1C0955832C3D5AC9E4EF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3b74f108e8ea7fb2514407bc06276054ec33e5c6c93e99bac87484a1cbd18623
MD5 6f3c37070b22665bf4986752c532de41
SHA1 16715df8915d20baa415ecd66387a2d3ba6dec35
SHA512 2d1f7f92ac1480c0631937bb69bc08165f94affd3d3048db5ec1f5ccc28bd1774e637a4c738aae1e366236376b7f13afbed6483c7a8383b29c8f633e11e676f7
SSDEEP 192:sxRSRuyMqZjK1Ml8UQPcT/f4sWPAqpZsGJlsJpzoA8peZ/g6+WNIYmEOw/GGYIgl:sxRSfqET/f4sW5nsGr402/5I6OxBr
TLSH
T1CE72D71A6928997B8CCBD21DF6457F53D6F81133A2944E44AAFCCA0C05EB6DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8b5786079d209cd4351cd75e60ac38dfb1db32ae229221a52a196402104b84e9
MD5 d316ee8a68ff2701878e4466052b23c5
SHA1 ca7d0c6d27d86008e6127f2a44e7b42a4537381d
SHA512 e50311b86e9bd3b515c77ba2e2ae0e2a68a5c4738e9044c5b104cc4278a8cf5c1e8d3f897d8460b7ed84a1f889521ec490ff02ef8b8f4e5549b9e7b840915e41
SSDEEP 192:sxRSRuyMqZjK1Ml8wcT/f4szPAXpZsGJlsJpzoA8peZ/g6+WNIYmYOw/GGYIgjlJ:sxRSfCT/f4szInsGr402/5IqOxjP
TLSH
T19772D81A6938597BCCCBD21DFA457F53C6F8112392945E44AAFC8A1C05EB6DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 29f8c9fa0b0372049d31fd94d8df9a6e32cddc3be789cfa7bdbafee2dee370e1
MD5 c16bfec60d24f87b69b161c314da8604
SHA1 a83cef50aae87ff2b7f7471bf0d79524f5a3f9b9
SHA512 fb5c90f7ce4b438f6939f651539f675a1056e2447e26a847c89a4304ecbf9bc9506b3f039ca31cde6de274532ab62b9512940ea4a24a003ac990be60245a92a8
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6u7z9wQroPwxr:RGqO3VE7yrWgzvfiXu1jalu7pw7Pwxr
TLSH
T1D4E2EC3B680CC77E4F804A9CEC29BE9B6DA802CF56D8895447EE844C03C7AFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ea1a9db0099c9e0602ae05bd9f857ad8a6ad79d168546576ed5a47afd743669e
MD5 8ff9ac540a2acf6eacf1f15cca490314
SHA1 657b356f627ede8ed1177f64357eecdf810c3510
SHA512 7c802967d963857c96f115392b7569a003345242a171f7d135f3892aad7f0e7554f6b81c2a52ecf02d3017aae6ad7ae04603d95fac6d9925fdb41f9f7f896eab
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mtc:aR55IlHnOLRXxxindd4
TLSH
T17EB29B5171BA2B00387D29099379D42F1A4630A230DEA86B3B6C35E56F67F005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9bd7f93f93e857ac813fa81e4c37eb3fe1d87e71a0bb010c7b4b6f1743639970
MD5 7e1c8f1fca5fb4e42d075ca7bfdda078
SHA1 9a50a2a136f57457d595efa6e87fa56bf2831ecb
SHA512 21baf457d40d407dce10568fa7e61b09442f4479bea421ccb1f17f8f8a51f870aee96f850c7d110488484c557618d9c0b987ca9d8eee29e8e90ef8f974fa3240
SSDEEP 384:n8iF1tNn/s3n9SsD8Nl8TUNTUlIRY7znNVXHX+fo1GAbzTwd820DyQGvF4mn15wi:nF1j+9RcwgotGcY820Dyhvumn12bfJE
TLSH
T191C23836D864CA77EDF78FC9B70A765AEEE01263859859D8DAD84D4C01C329D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cae505e7a9f13721247f1d42476e3d953cdad04bedc252a32658cfe0af6c44ad
MD5 102b21b93d0bd5a08157c2c30f6b89a9
SHA1 702ea64ba7b8154a7373ab62211c0b731cb30c66
SHA512 eb2b93fa128bd47a7f0dfd21da3fc4c03bbedf405a9c0c02fbe87ba9c0d42bda7cf4c1613a2c711591a5d03bce809c351cf7cd10c713b7764cb919e718f4373f
SSDEEP 384:npiF1tNn/s3n9S+8NN8TUNTUlIR+znNJtPX+fo1GAbzTwd820DyQGzgUhKl8BhBV:AF1j+93wwgslGcY820DyhxhKl8BvTPaG
TLSH
T1DDD24B32DC55CE77ADE68BD8B70A7647DEE01263898C5DD8EAD85E0C01C72AD530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3972ad91478b2a7e8ebe804decfa85ad9de4c918455ca41d028946e5ed946f94
MD5 217545fac1fd3a59482513079b74a7a2
SHA1 14311e62175a6c24c329e856c8c88378a05e0a56
SHA512 b51fef4bbad3e863961108991d1285530fce869c469f244063106ac137aacd28b553404f5b9bd640d95a9d1817c6031bcff42c0ce5e29d9ecf17673329b1a0b2
SSDEEP 384:nJiF1tNn/s3n9Sy8NN8TUNTUlIRDznNStPX+fo1GAbzTwd820DyQGzgAhKl8BhB5:gF1j+9bwwgylGcY820Dyh7hKl8BvTPaG
TLSH
T1FAD24B32DC55CE77ADE68BD8B70A7647DEE01263858C5ED4EAD85E0C01C72AD530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0b29518fe55dbe06ae36014b7d1e1141b0da083b350d1dde891931df7927e3aa
MD5 183acbd0026e7ab97576c8212af4ef0d
SHA1 c9d6852044904a027e6f8e2fcf484ffa8c7bda43
SHA512 7168f9e83a61417080abde10d12e827d6e19a6a470a2f34e0fe00372f1f4afb6b1815c4d15e8979adb55ab666328a6fb90925a54537a943ca88afd5df7e77ba6
SSDEEP 768:mF1j+9vwwgslGcY820DyhG1hKl8BvTPaG:T9vFNDyhGTKl0WG
TLSH
T154D25B32DC54CE77ADE68BD8B70A7647DEE41163898C5DD8EAD85E0C01C72AD530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f832303d9928f7fcc872154d2dad84802f312c137cfcf8fa37b422e91e670c44
MD5 fea1c07ad82a73b3cbef48efa6584f1c
SHA1 17b198e0dc49b31ea32f0ee7be16cf1aa293daed
SHA512 1aad5e49a31a7bb9794f38ccd34c5cae6a5df806ebae6af239b0e21ded21111e2aa3c53ce64e91c24c7915498ca77d63b086327c7d8a70629b03c79062a6a419
TLSH
T1993141E19C3929D1C4BE0DBF744B39FC94E8D327F4A530386444DD58563A25E224043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fce23ea2a7ea1f2813cf1e8165b8f09831c013f2234006d58063fc698f2fdc6f
MD5 7d22d822a19b10c49b50f3c7d280bf1c
SHA1 151586289e866e4cb7cf71ee38107bf98e679d8c
SHA512 3628b8a03047d23f259e5267d0a1d5f68b6b1dac2343fe89eea0d64f3b52d23d6d30ec9d53ead54ab7848c6b1d2570738f4cf65ae12da30735e47a0e02f5f595
TLSH
T1C03142E05C3829D1C4BE0DBFB44B39FC94E8D326F8A4703C6844EE58567A25E224047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1edb301c73064d13c15c9b58cb5da13876589b93217a8e19095b600839b1144b
MD5 c7e677e9279489252b0c9637852fe066
SHA1 1d8a7d4e215ec032a80103feb2a1ca785351654b
SHA512 30f82f3c0b3ed74ee9f4ad20ab072d85678492d0862bf3d650e607bc80c5ec4383692d35840dca5fba7cfb4e5bec3ea22bb830c6a8d99ea6cf9691093d0567b5
TLSH
T15C3141E19C3929C2C4BE0DAF744B39FC94E8D326F59470386888EE58523A65E224087F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 1eeac12ceb28adf390516a934835b9404abc0efd9d1986265151efc9e4fa93fd
MD5 dd0324e34e76fd6e71689c79922f1530
SHA1 157efc136d723524814fcdf53fcbb10be4ca28e8
SHA512 a013e8ee85307b7670541ecf069e1ede6ed8091e8fc18aa46354e7eac7ccce1c2f40b009e152f28aa03553082a17905e9b687b999e2318adfd532e6367c6e326
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3q:CebAjOKn3wRKRJ3q
TLSH
T1BCD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.old_1782950874

Path C:\Users\Admin\AppData\Local\Temp\2026-07-01_78ac34a37193c706bf88c280c53b01ee_akira_glassworm_rusty-stealer.old_1782950874
Size 2.7MB
SHA256 2cb4c33750e5c37d80b9560de3033dea6b7e4a456d94b5908886ed113f599e1b
MD5 4d6ccf90844332615840deea5124ab38
SHA1 a7cbdd30473f06e83678f4bc472a3ec1b295166c
SHA512 fc33f29449edde3641dcfc39d30f9d85a158fb615f11c28dfaee54bf2f3227fdcad2ac3191d07f58fed5b9476fc959a75e566b230783b490c601d6cf80f392a2
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ30:CebAjOKn3wRKRJ30
TLSH
T130D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_186690404\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/6128-223-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-213-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-183-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-313-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-222-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-327-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-336-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-229-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-353-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-359-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-368-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-151-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-190-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download

memory/6128-393-0x00007FF6C4740000-0x00007FF6C4A01000-memory.dmp

Download