a8934a423ff64f986c65d009868895146946eba1627c3a08371a5ef2bdff8fa9

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260702-ghfwcsav7l
SHA256 a8934a423ff64f986c65d009868895146946eba1627c3a08371a5ef2bdff8fa9
MD5 e434916ed4e4b53819296fb3b3e18db9
SHA1 14e6314d0d850a7aae8a2a08c4e2406e97c56771
SHA512 66f1bbc05b0f3d1af3a9a505ad041375f3726e937873db1176d532fdd3536db03499781dd1063b63f67b488191f7a6ff9973e53df44555260f2269d427b9365d
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3+:CebAjOKn3wRKRJ3+
TLSH
T1C0D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2432	msedge.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_344557060\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_344557060\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_1638786097\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_1638786097\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_581403196\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_581403196\well_known_domains.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2536	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274448940589687"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{B910853E-1245-4BBC-AE95-99E486357063}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
900	wmic.exe
900	wmic.exe
900	wmic.exe
900	wmic.exe
3688	msedge.exe
3688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
716	2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	900	wmic.exe
Token: SeSecurityPrivilege	900	wmic.exe
Token: SeTakeOwnershipPrivilege	900	wmic.exe
Token: SeLoadDriverPrivilege	900	wmic.exe
Token: SeSystemProfilePrivilege	900	wmic.exe
Token: SeSystemtimePrivilege	900	wmic.exe
Token: SeProfSingleProcessPrivilege	900	wmic.exe
Token: SeIncBasePriorityPrivilege	900	wmic.exe
Token: SeCreatePagefilePrivilege	900	wmic.exe
Token: SeBackupPrivilege	900	wmic.exe
Token: SeRestorePrivilege	900	wmic.exe
Token: SeShutdownPrivilege	900	wmic.exe
Token: SeDebugPrivilege	900	wmic.exe
Token: SeSystemEnvironmentPrivilege	900	wmic.exe
Token: SeRemoteShutdownPrivilege	900	wmic.exe
Token: SeUndockPrivilege	900	wmic.exe
Token: SeManageVolumePrivilege	900	wmic.exe
Token: 33	900	wmic.exe
Token: 34	900	wmic.exe
Token: 35	900	wmic.exe
Token: 36	900	wmic.exe
Token: SeIncreaseQuotaPrivilege	900	wmic.exe
Token: SeSecurityPrivilege	900	wmic.exe
Token: SeTakeOwnershipPrivilege	900	wmic.exe
Token: SeLoadDriverPrivilege	900	wmic.exe
Token: SeSystemProfilePrivilege	900	wmic.exe
Token: SeSystemtimePrivilege	900	wmic.exe
Token: SeProfSingleProcessPrivilege	900	wmic.exe
Token: SeIncBasePriorityPrivilege	900	wmic.exe
Token: SeCreatePagefilePrivilege	900	wmic.exe
Token: SeBackupPrivilege	900	wmic.exe
Token: SeRestorePrivilege	900	wmic.exe
Token: SeShutdownPrivilege	900	wmic.exe
Token: SeDebugPrivilege	900	wmic.exe
Token: SeSystemEnvironmentPrivilege	900	wmic.exe
Token: SeRemoteShutdownPrivilege	900	wmic.exe
Token: SeUndockPrivilege	900	wmic.exe
Token: SeManageVolumePrivilege	900	wmic.exe
Token: 33	900	wmic.exe
Token: 34	900	wmic.exe
Token: 35	900	wmic.exe
Token: 36	900	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 5896	716	2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe	89
PID 716 wrote to memory of 2432	716	2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe	91
PID 2432 wrote to memory of 6960	2432	msedge.exe	92
PID 2432 wrote to memory of 3436	2432	msedge.exe	93
PID 2432 wrote to memory of 2536	2432	msedge.exe	94
PID 2432 wrote to memory of 3436	2432	msedge.exe	93
PID 2432 wrote to memory of 3436	2432	msedge.exe	93
PID 2432 wrote to memory of 1720	2432	msedge.exe	95
PID 2432 wrote to memory of 1720	2432	msedge.exe	95
PID 2432 wrote to memory of 6452	2432	msedge.exe	96
PID 2432 wrote to memory of 6452	2432	msedge.exe	96
PID 2432 wrote to memory of 6452	2432	msedge.exe	96
PID 2432 wrote to memory of 5196	2432	msedge.exe	97
PID 2432 wrote to memory of 5196	2432	msedge.exe	97
PID 2432 wrote to memory of 5196	2432	msedge.exe	97
PID 2432 wrote to memory of 3180	2432	msedge.exe	99
PID 2432 wrote to memory of 3180	2432	msedge.exe	99
PID 2432 wrote to memory of 3180	2432	msedge.exe	99
PID 2432 wrote to memory of 460	2432	msedge.exe	100
PID 2432 wrote to memory of 460	2432	msedge.exe	100
PID 2432 wrote to memory of 460	2432	msedge.exe	100
PID 2432 wrote to memory of 6096	2432	msedge.exe	101
PID 2432 wrote to memory of 6444	2432	msedge.exe	102
PID 2432 wrote to memory of 6096	2432	msedge.exe	101
PID 2432 wrote to memory of 6444	2432	msedge.exe	102
PID 2432 wrote to memory of 5388	2432	msedge.exe	104
PID 716 wrote to memory of 900	716	2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe	107
PID 2432 wrote to memory of 5160	2432	msedge.exe	111
PID 2432 wrote to memory of 4584	2432	msedge.exe	112
PID 2432 wrote to memory of 5628	2432	msedge.exe	113
PID 716 wrote to memory of 5800	716	2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe	114
PID 2432 wrote to memory of 5796	2432	msedge.exe	116
PID 2432 wrote to memory of 5796	2432	msedge.exe	116
PID 2432 wrote to memory of 4848	2432	msedge.exe	119
PID 2432 wrote to memory of 4848	2432	msedge.exe	119
PID 2432 wrote to memory of 824	2432	msedge.exe	120
PID 2432 wrote to memory of 824	2432	msedge.exe	120
PID 716 wrote to memory of 3044	716	2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe	121
PID 2432 wrote to memory of 3688	2432	msedge.exe	123
PID 2432 wrote to memory of 6624	2432	msedge.exe	124
PID 2432 wrote to memory of 6624	2432	msedge.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3044	attrib.exe
5896	attrib.exe
5800	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.old_1782971290
  2⤵
  - Views/modifies file attributes
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc9437c188,0x7ffc9437c194,0x7ffc9437c1a0
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10602608834566273315,2818004435164774316,262144 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,7336626324900349023,7805450683863385821,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,11467138738997531423,12909314291845149522,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,3024720774938209873,10856330858671850893,2097152 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,809595783110036363,2941809752460666834,2097152 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,7848765804141182382,1218999800470695240,2097152 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:9
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5260,i,3983133093379829927,181598063210460540,2097152 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:15
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,8670364449832863207,7482420568938995946,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,1247778816307528098,8010213018349086464,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,8686574626390077335,8259977701696043014,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,8686574626390077335,8259977701696043014,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,12413897869441617595,17809734301044119688,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,11834703391721972675,9360654839013268833,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,17478818182714474861,16074726059752013076,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,10096419220323397910,6200215142429899931,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,2625186730421621916,428938257503767331,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,16155185192065660957,13881080474310777358,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6404,i,10772012497018850052,1588714985264596513,262144 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,8348610825098597984,3269278303839279254,524288 --field-trial-handle=2324,i,4998736177104407086,5482311660171350882,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:6624
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.old_1782971350
  2⤵
  - Views/modifies file attributes
  PID:5800
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.old_1782971410
  2⤵
  - Views/modifies file attributes
  PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55b968461c3cac4c7effa8a6c28244f55447bc6d9425abffdc980dbcf8f66a56
MD5 0f2dd8d756f52925ee56edb716c271af
SHA1 5baaa4f814deacaf47060c8d09015a8db39ce0b5
SHA512 9f360c7252debebc7f5372dc3ef1b650a635a7874dcf1f582432193203c260b088889ed1445047bad1f96fda147db83e0ec8ddfccd1d60be7a75e2fa03873bb0
TLSH
T1A1D0C0E073697941C32134F278218700F35004B1682BCA41B0C4400C8D7504A53C620B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
MD5 4df2b013f915bbf768a35e9c1e788fe1
SHA1 5f99dfa4310596930be8e393c0de83bb374a10f7
SHA512 5285653806cab96614917acfa4a3f6992cd581c9ad8eb14808de784b888ecfebb44f82a0a32c756a63c062605216d2535eed0d53eb14c4498ab3ae12d2d005b5
TLSH
T148D080E077697941C32534F274158740F7555471646BCA41B0D4D10C8D7555AA7C6257
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 92a9b3958370f262ea81db0085030edeef04dbeaa1aa08b2533263455c774104
MD5 b039c34a37730303e741f238e8b8c649
SHA1 b6fcb903273b6ff5a80b46069fc9373d6179b6d2
SHA512 fa58a161f8576e9f86748fb29ca020882209d4c2f823d0133eeef350c74e365bb43cbd5b150bdfd08c9d0ccfb76818c662002c57d82e7af0f3477852fc6c21fb
TLSH
T1BC71E80B73211AC2EFA9127285D6EDC8327CD0E68EC76EC97B45513AB80930767C1C30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cc63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cc63.TMP
Size 3KB
SHA256 e958c0b01744b645b650a755af8ff450a581c3439dbfa4b1a489b97272f50306
MD5 8816278056d0a12cf4fe495b8c49740f
SHA1 85d1563cc6e00b54d6c69c881c665512fe8d265c
SHA512 bee51020bf1c4d873825dcf97e5befd4ea7025f04ace1c31a0e615062fb186d533d6bd69206fddb3d168b6a254a4195145c7027fab834b7d0fefc0396a244faa
TLSH
T16961E81B77255BD2EFA9057295D2EDD8367CC0E68ECB6EC87A41913AB809707A7C1C30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fc0e216b1e72b8e4ebe7d77de88c3f6e3b66aa2e100eab571ac71002c4dd4867
MD5 f91122c5331edec9ed9343b196b1d926
SHA1 acae9dcafc722efc7e1a5b6adb5f6c0c4fed383a
SHA512 dfb7926834a52a28e89853caba393a808e6fbd5c7e5233baef988ce7bc33bb3b4e3c94b38b678229672e5ab4b5583326149975b8090a744382e9de4606fc8794
TLSH
T11041BDF7C3E4856E8A1196F0AA186E2FCE1C0915832C7D5AC9E0AF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cd40e6e9967ee2fb986e852194c987c04ca9b5c5386ba712ea6c56cc15c3bed1
MD5 8947740399fc4d560f865907a970763b
SHA1 1aadc337b480de6c4dd9b3cfc9c6b2e70114e081
SHA512 ec22af282039308921126d7e141ef838f10d166740ce8ae26d6edb4447060f42bebf1611ddf280f7220241abf79bc519f08cbcc47643675b354803b4bf20a4d6
SSDEEP 192:sxRsgRsyMqZjK1Ml8wcT/fBsKkFtZKOOZl99zoA8pe1/g6+WNIYAPOwjDTfzwGVA:sxRlRCT/fBsKEDeZ8u/5IjOofJjs
TLSH
T10572FB156938993B8CDBD20CFA567F53D6F8117392945E44AAFC8A0C05E76EC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6214f7025a8c44888be6ef7382373450992e32c06b299ef77ca31c7319132046
MD5 bede47dd3d106c98060d0a8c83cc9cb3
SHA1 a758c214133f112a2f1981d7e349db4ba1682522
SHA512 30f730e43326609b4be7797c4407d090ab090f02ba7e213138c4e30249f6fcf7ed7e46915b3a25efead5c2ff5464525cad3a17f7ddab28ab612796643220d6bd
SSDEEP 192:sxRsgRsyMqZjK1Ml8UQicT/fBsJk3tZKOOZl99zoA8pe1/g6+WNIYAjOwjDTfzw3:sxRlRqRT/fBsJaDeZ8u/5I/OofJFC
TLSH
T1B372FA1A693899778CDBD20CFA527F53D6F8117392945E44AAFC8B0C01E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5190eff4ea17334d58abc99f3c96d337fb0f8a593f47e56a98093e20cc4c577d
MD5 7eb7b61b0538215f70dc6d04643b4008
SHA1 5a1aa2f3774b9177d1660ec40a1ba7d2d4094862
SHA512 a37e197e62c3abde1c0d418a05a34a48f7d3d632ec70c59149ff8b51aa26a8da160338853ab112b7b296067e06312c5b4c26c96e4e1ad945ca2131068e19cda6
SSDEEP 768:DckYJT7pLuL7glWg1NfgB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGSVhHgurop/8N:DckYJFE7glWg1NfgBu1jaRSVdglpA
TLSH
T156E2DB7B680CCB7F4F804ADCEC297D9A6DA801CF96D8C95447EA840C03C67EB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b40b7963b8ff84d0578319b6aaf67b2921837c1d02bcf833d77251de7be212b7
MD5 df413f32dbc4ba91c3da3f9e0d1d1a55
SHA1 e5d19ce54a216d0c0da262f4920f6f1bd8c5f9ec
SHA512 e0a529f4d470a45d16c8c67a05367db87a8dbb33fc987ced8bb1ef488a28314b5e251d3fa323fc0b5e7759bb041aa65dca4ccae66f4fbc6abc8e1f6a8e37b030
SSDEEP 192:E61PhSGGXWL8MMLOi70MjSEJB3BPorbu/drtBZnZLJ5dyX+Skd:E+PKFT3JoPuVr/ZZLLn
TLSH
T1B7B21810763A33C2397D39088194982F52C23563325AA46B7BBC64EA4F67E41DFFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb8fd1ae-a4dc-4095-8fd8-57e58c477fc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb8fd1ae-a4dc-4095-8fd8-57e58c477fc6.tmp
Size 414B
SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
MD5 e038104cb30f853d4fb4c17d93d811bd
SHA1 fd60f18b9de22295125c43e8f69d0bb409d9e4e0
SHA512 80a02ea233087329d60395883bcea2f3da0ceeeb470966e0ea39af14d3eb10d17a1e1de9cb90f04c3b5a5aab52eae358823b9066867a21e71295bab997049157
TLSH
T1D6E02BAAC921AC2708FC6B6C70954641E650132627508D4F3A3D810CCFB2B7B426682C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0bb1d107dca0fdd12fc832a158d9e9a2ec456e11c636f136db3325efa0b1e61b
MD5 974accb51310ab5a3e792b6f3e62dc71
SHA1 ba1fd18a3ba72da8d0457e7a9531f7978fc8e6fa
SHA512 c8a5de11f2958a2cbd289260b9c601b5959facefa9a147a9283c199a5f25c26f5bace9c2a50b2f9c3b997da74b3a1a61454b9a2ad47b8d75b6f4801f727626fa
SSDEEP 384:ndiF1tNn/s3n9Sy8NY8TUNTUlIRTB1iiEGZsttfUGV7Z9zcPS3amn15wbAjE18Lm:UF1j+9XVwgcE5GV7ncK3amn12bfh
TLSH
T182C25932E894DA7BACE78FC9B70A7646EEE001A785D859D4D9D94E4C01C72DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3172cd8fe9c57c6eed72f60c5fdfb8f3daa98c125736c7f1f7e805fd73a19894
MD5 767a572ba0adfb53168c751324c28f63
SHA1 883e054b1fc533cdb1acab5928cf816de1e47c74
SHA512 f51d961a300ca66a342e69d0da05170d9206f582393f6e464bd5ef94be29047834952d042f50addcc524c22f9177b557fd3a9d53cf61bc931b63af05aa3e6f20
SSDEEP 768:yF1j+9W4wgA/naGV7ncKIzSKl8BvTPajwL:H9Wj/NLcCKl0WjwL
TLSH
T14ED24A32EC95CE7BACE68FC8B75A7686DEE001A3998C5DD4D5D95E0C00C729D134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 852876b95dd9a98546400c71b2b723287474dcdc67035c0bbf56a9ee3b70e770
MD5 a9f18ebd366db1f41fb9225b41f0f701
SHA1 6f35386f65710b6620a1824264155545ec4c3109
SHA512 2e8cb0d727f769ee75c343e892f62c966ad3a664e00f36b24f14c0590bcc3c3bfabeecd35e61d149e3ecbe1d24ca015e4fa46119e72806b2069dea86f784ffc3
SSDEEP 768:KF1j+9q4wgQ/saGV7ncKIrSKl8BvTPajwC:P9ql/kLcKKl0WjwC
TLSH
T102D24A32EC95CE7BADE68FC8B74A76869EE001A3958C5DD4D9D95E0C00C72DD134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0a6fafd-613f-427a-a7e2-377855f79da6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f0a6fafd-613f-427a-a7e2-377855f79da6.tmp
Size 1KB
SHA256 a01d8f97672146e2d572fec7c7b8afca8f304860a1558df2ba7fe9bb7bc375fd
MD5 6b1b3eec808f6e6a5fb61054951611b1
SHA1 14accfd5928be18e9efecb167022d22cf1fa3007
SHA512 823a9cbead195bb66873557adb031917166ebfce6f0ddb617d8e0ff1903db8c6bc3fd2624aee2bf4a456262adc1ee46ed9082d40a3296cd194e7f2f6c5dbd496
TLSH
T1713142D059382ED5C4FE49BFF48B35FC94E9D622F498343D3898E855922E64D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e9f8de0b48ddb1f7d812bee374a453280eedda0b4527c7c40736b5227240afc0
MD5 85f58619824ade121d0b85d07e5bb298
SHA1 ab6b0ae502debc01a814d3f41a5c4f07cf1aa2f7
SHA512 464cb68f98c49033e6a2e1be613c1d365858f22452acfe74e8b8c80a31c07cb7454ac70281558b330d460732fd9dce6d0325fc4787c2485cef9fa2ba43df45af
TLSH
T1623144E0593C5AD1D0BE49BEB45B35EC85EDD626F4A5303D3888ED98863E64D618043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b02e1686ea84a9d4a9821674b4808e08d77c0171a3e66b98a10a4496db9af286
MD5 6f32b20ed9a0b17cf4dc9cf341845eb3
SHA1 3d1349ac777ded6a2f76ea58ffb04a77a4d3b51b
SHA512 09fa8bb97649eeddd0e20d7f77fbf55ecf6be5aa563d40594aaef35c836043b414f19e645560560087926bdb21227a063ea9c196a55fade17252e40978bcc6a5
TLSH
T1713120E099381AD1C4BE49BFF48B35FC94E9D622F49530392898EC58922D65D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 3d8392a2ead45e9662357688afe6d134bdf2479a8625d867ea1c6cf3ba2f95d3
MD5 5b9307d2b61662757daa543a7e26426f
SHA1 c0f39d9f7cfae8bfeb2f32a47ae0b0bb0625e73c
SHA512 f2064bf8a01c71bc601383793f0123ee8262650b32712e70c2c0eb51d4dd6ee0771e8c30d891d333b7a5c5134dfa5b0ac1c50eab2ca8e4519436eb56b7d520b0
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3W:CebAjOKn3wRKRJ3W
TLSH
T1A4D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.old_1782971350

Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_e434916ed4e4b53819296fb3b3e18db9_akira_glassworm_rusty-stealer.old_1782971350
Size 2.7MB
SHA256 395af6bf5689998eadd43794a5540086c3b82ae63b5de3761f745edc5ef94b38
MD5 9d022bf69db5a7cd15f0b2e2f896633d
SHA1 abe31f7bae35531c3771727ae948cb45936ce3f5
SHA512 c0a2ba0674b80cb77a2cbd9e6f7945d7499601ca914255da3ee317fa0b7bdec64e5f229724cf5a79309f7706859ea0e9e212e4830f56a7dd1370eb9c81511cc9
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3c:CebAjOKn3wRKRJ3c
TLSH
T18CD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-209-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-241-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-262-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-235-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-277-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-285-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-234-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-302-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-308-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-201-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-318-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-192-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-170-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download

memory/716-343-0x00007FF695980000-0x00007FF695C41000-memory.dmp

Download