3b33039c2ad5b605724627b2e2fff2a5c16b3bfcb05b184bcc3d45149f07319b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260703-beg2cses8k
SHA256 3b33039c2ad5b605724627b2e2fff2a5c16b3bfcb05b184bcc3d45149f07319b
MD5 da80e4ce8c449a418357a57f26115b69
SHA1 8ba4c4f189f3d73b94da74f8b4a306c22e97fec3
SHA512 f4b7e197552a73ee02e03bc97a1faca60426740b88ee0dff9e3a2c4309caba830a6dfc78a9c93dbfd97380e9a20fe81ec3f1ce4a61232a2b4fb88fe6c6a8b73d
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3R:CebAjOKn3wRKRJ3R
TLSH
T16FD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_727894894\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_2070237269\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_2070237269\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1707607029\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1707607029\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1707607029\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1707607029\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_727894894\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2176	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275142061066361"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{1B3F91BD-1B75-4F7B-B102-2A29732E30D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5764	wmic.exe
5764	wmic.exe
5764	wmic.exe
5764	wmic.exe
3656	msedge.exe
3656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1800	2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5764	wmic.exe
Token: SeSecurityPrivilege	5764	wmic.exe
Token: SeTakeOwnershipPrivilege	5764	wmic.exe
Token: SeLoadDriverPrivilege	5764	wmic.exe
Token: SeSystemProfilePrivilege	5764	wmic.exe
Token: SeSystemtimePrivilege	5764	wmic.exe
Token: SeProfSingleProcessPrivilege	5764	wmic.exe
Token: SeIncBasePriorityPrivilege	5764	wmic.exe
Token: SeCreatePagefilePrivilege	5764	wmic.exe
Token: SeBackupPrivilege	5764	wmic.exe
Token: SeRestorePrivilege	5764	wmic.exe
Token: SeShutdownPrivilege	5764	wmic.exe
Token: SeDebugPrivilege	5764	wmic.exe
Token: SeSystemEnvironmentPrivilege	5764	wmic.exe
Token: SeRemoteShutdownPrivilege	5764	wmic.exe
Token: SeUndockPrivilege	5764	wmic.exe
Token: SeManageVolumePrivilege	5764	wmic.exe
Token: 33	5764	wmic.exe
Token: 34	5764	wmic.exe
Token: 35	5764	wmic.exe
Token: 36	5764	wmic.exe
Token: SeIncreaseQuotaPrivilege	5764	wmic.exe
Token: SeSecurityPrivilege	5764	wmic.exe
Token: SeTakeOwnershipPrivilege	5764	wmic.exe
Token: SeLoadDriverPrivilege	5764	wmic.exe
Token: SeSystemProfilePrivilege	5764	wmic.exe
Token: SeSystemtimePrivilege	5764	wmic.exe
Token: SeProfSingleProcessPrivilege	5764	wmic.exe
Token: SeIncBasePriorityPrivilege	5764	wmic.exe
Token: SeCreatePagefilePrivilege	5764	wmic.exe
Token: SeBackupPrivilege	5764	wmic.exe
Token: SeRestorePrivilege	5764	wmic.exe
Token: SeShutdownPrivilege	5764	wmic.exe
Token: SeDebugPrivilege	5764	wmic.exe
Token: SeSystemEnvironmentPrivilege	5764	wmic.exe
Token: SeRemoteShutdownPrivilege	5764	wmic.exe
Token: SeUndockPrivilege	5764	wmic.exe
Token: SeManageVolumePrivilege	5764	wmic.exe
Token: 33	5764	wmic.exe
Token: 34	5764	wmic.exe
Token: 35	5764	wmic.exe
Token: 36	5764	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3196	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2860	1800	2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe	90
PID 1800 wrote to memory of 3196	1800	2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe	92
PID 3196 wrote to memory of 5776	3196	msedge.exe	93
PID 3196 wrote to memory of 6832	3196	msedge.exe	94
PID 3196 wrote to memory of 2176	3196	msedge.exe	95
PID 3196 wrote to memory of 6832	3196	msedge.exe	94
PID 3196 wrote to memory of 6832	3196	msedge.exe	94
PID 3196 wrote to memory of 6568	3196	msedge.exe	96
PID 3196 wrote to memory of 6568	3196	msedge.exe	96
PID 3196 wrote to memory of 6584	3196	msedge.exe	98
PID 3196 wrote to memory of 6840	3196	msedge.exe	99
PID 3196 wrote to memory of 6584	3196	msedge.exe	98
PID 3196 wrote to memory of 6584	3196	msedge.exe	98
PID 3196 wrote to memory of 6840	3196	msedge.exe	99
PID 3196 wrote to memory of 6840	3196	msedge.exe	99
PID 3196 wrote to memory of 4372	3196	msedge.exe	100
PID 3196 wrote to memory of 4372	3196	msedge.exe	100
PID 3196 wrote to memory of 4372	3196	msedge.exe	100
PID 3196 wrote to memory of 4516	3196	msedge.exe	101
PID 3196 wrote to memory of 4516	3196	msedge.exe	101
PID 3196 wrote to memory of 4516	3196	msedge.exe	101
PID 3196 wrote to memory of 5720	3196	msedge.exe	102
PID 3196 wrote to memory of 5740	3196	msedge.exe	103
PID 3196 wrote to memory of 5720	3196	msedge.exe	102
PID 3196 wrote to memory of 5740	3196	msedge.exe	103
PID 3196 wrote to memory of 6124	3196	msedge.exe	105
PID 1800 wrote to memory of 5764	1800	2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe	108
PID 3196 wrote to memory of 6016	3196	msedge.exe	112
PID 3196 wrote to memory of 1804	3196	msedge.exe	113
PID 3196 wrote to memory of 6020	3196	msedge.exe	114
PID 1800 wrote to memory of 1028	1800	2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe	115
PID 3196 wrote to memory of 892	3196	msedge.exe	117
PID 3196 wrote to memory of 892	3196	msedge.exe	117
PID 3196 wrote to memory of 6348	3196	msedge.exe	120
PID 3196 wrote to memory of 6348	3196	msedge.exe	120
PID 3196 wrote to memory of 468	3196	msedge.exe	121
PID 3196 wrote to memory of 468	3196	msedge.exe	121
PID 1800 wrote to memory of 4452	1800	2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe	122
PID 3196 wrote to memory of 3656	3196	msedge.exe	124
PID 3196 wrote to memory of 6876	3196	msedge.exe	125
PID 3196 wrote to memory of 6876	3196	msedge.exe	125

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2860	attrib.exe
1028	attrib.exe
4452	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.old_1783040602
  2⤵
  - Views/modifies file attributes
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd57dbc188,0x7ffd57dbc194,0x7ffd57dbc1a0
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,3273853302805833261,8143659921054242829,262144 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,17425811228826105596,191497283290454463,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,16798794570501572970,15849337128984803495,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,8355269137706259988,13327178845305073875,2097152 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:6584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,2527647481466830768,6559278012658193322,2097152 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5084,i,6972272387654663825,11151576021108112966,2097152 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:9
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5344,i,5874218205172943765,17241890927678843223,2097152 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:15
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11284481161813483414,6495861665486061449,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,6753958327576369392,18129264385644907995,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,15907244494567390353,5224438574123679893,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:7160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,15907244494567390353,5224438574123679893,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,1874960423061485326,18276321403756680353,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,7668752298290364377,12220682563192340693,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,5366371027209851742,5141360940143071199,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,4577210468887118963,13967179152259290940,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,11989110202774060375,16994596120139171294,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,16065358869467722071,14721928934759547783,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,6636549966015680903,8858631943202027390,262144 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,12241021546021761509,2793368537737595910,524288 --field-trial-handle=2324,i,2751086756372447835,7900017116046385014,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:6876
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5764
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.old_1783040662
  2⤵
  - Views/modifies file attributes
  PID:1028
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.old_1783040722
  2⤵
  - Views/modifies file attributes
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55b968461c3cac4c7effa8a6c28244f55447bc6d9425abffdc980dbcf8f66a56
MD5 0f2dd8d756f52925ee56edb716c271af
SHA1 5baaa4f814deacaf47060c8d09015a8db39ce0b5
SHA512 9f360c7252debebc7f5372dc3ef1b650a635a7874dcf1f582432193203c260b088889ed1445047bad1f96fda147db83e0ec8ddfccd1d60be7a75e2fa03873bb0
TLSH
T1A1D0C0E073697941C32134F278218700F35004B1682BCA41B0C4400C8D7504A53C620B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
MD5 4df2b013f915bbf768a35e9c1e788fe1
SHA1 5f99dfa4310596930be8e393c0de83bb374a10f7
SHA512 5285653806cab96614917acfa4a3f6992cd581c9ad8eb14808de784b888ecfebb44f82a0a32c756a63c062605216d2535eed0d53eb14c4498ab3ae12d2d005b5
TLSH
T148D080E077697941C32534F274158740F7555471646BCA41B0D4D10C8D7555AA7C6257
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
MD5 e038104cb30f853d4fb4c17d93d811bd
SHA1 fd60f18b9de22295125c43e8f69d0bb409d9e4e0
SHA512 80a02ea233087329d60395883bcea2f3da0ceeeb470966e0ea39af14d3eb10d17a1e1de9cb90f04c3b5a5aab52eae358823b9066867a21e71295bab997049157
TLSH
T1D6E02BAAC921AC2708FC6B6C70954641E650132627508D4F3A3D810CCFB2B7B426682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 04398270ebd53b4492d2abad6f286f829b8856062a0785851e0dd4ae1392bce5
MD5 0193e7b59830e60a50c751076913a306
SHA1 02b355b4fc25f6d3d269fdfc9abaf795064f4b71
SHA512 c0bf6d4c5bca76963a3cf0172695c7f59692c6cd70144ae1ed11cd3d3577e121717239394092ba959ead178f18aa400e4027187862fc04f457656f843593dfc6
TLSH
T1C6614F11376ACED2CB6B39B55AF35C89B6F4E49EE14B5EC4C28C71744877740A845833
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f9dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f9dc.TMP
Size 3KB
SHA256 ea6b68c2c75c7fde296e0ddceb529a8a0a46546ff4475d8b437b93251b11d877
MD5 96c3e690f3198a45120304200c999b27
SHA1 a7b2ce4d6fe75e9a1749ad94ea463e2aeb1f3b95
SHA512 24282b6fcf6a6dea9b32bd38f4f07e051f6a91b47a80e5cd3836e2ee9a6cd63cb046413103443cee1c061dbe976c7b5581db6549c8f5113341bc665836736346
TLSH
T151613D1173AACED2C76B39B65AF35C8976F4E49EE14B6EC4C28D70740437B40A446433
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 86ae2680a4a2aaa54f4be9759f11ebbdd5e69f6a8556bd037d9b44f5b5a4c5cd
MD5 d5d76b2edae76461fb8e9522bde0382e
SHA1 973e7ae5888f10961a2273668b1c83940c1c5a7f
SHA512 9fa811f8f7e9589c16fe399178d43a4bd2cf66ee05c50d4e849c1fa65864170904a4819bb00f5be4c97e5b2b238a8acd39b63514a6036dc6457f7c2dc65283c1
TLSH
T10641DFF783F4856EC91186F0AB186E2BCE1D0911832C3D5AC9E0AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7c2cea6e4be7f4deab758690214dd5f91590729b6619b85e395bd5858a6260b6
MD5 413b8e376a02ac551d47cd0e2325a34b
SHA1 c9e03ccf1d86953c8ea08a49c1cc873417fd6f90
SHA512 e21f3cdfff8ceb541dca3026cf85fa27c0659809ca221c5952aff06b0b875488cb8b2a9c8c52df0fd451ebf3e34ff08e07598d21d970d7a33301b92fd0792ce6
SSDEEP 192:sxRrRhyMqZjK1Ml8wcz/fxsNxStZKOOZPbzoA8pe0/g6+WNIYAPOwqDTfr+G8IgV:sxRr+Cz/fxsNwDeZS//5IjOjfr2jcV+
TLSH
T19172E8166934997BCCDBD209FA417F53D6FC1133A2905E44AAFC9A1C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f4788f15660cf713665ada0c4dcacffec3fdc738185e0cc0fc660eac3172fd7f
MD5 eaa93fe7b8713207d09b075c92d7f401
SHA1 fa3759adad901f659457cf70aa0783d470df4a69
SHA512 8a68960d311807e35ec01159b367c8cb6be6b021a64eb0f3d213c0cbe2308fc32d93cbd2146c51c574bc92f9602793971b257bbb9faf1bd8cdc0301e7c72c1bf
SSDEEP 192:sxRrRhyMqZjK1Ml8UQocz/fxsdxwtZKOOZPbzoA8pe0/g6+WNIYA1OwqDTfr+G8Z:sxRr+qnz/fxsdWDeZS//5IhOjfr29D
TLSH
T1EC72E9166934997B8CDBD209FA817F53D6FD1173A2905E44AAFC8B1C05E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9ede867e033aa7df868c521fccf24a84a7be5602ef23c7b7d60e09174edb6fce
MD5 2bc11c0af638c1105b5a9e78979c68a5
SHA1 4eec180bec63fc2d6fd4b181b74ca9c52fbea232
SHA512 2f7f623843c309bc976303e91dad84e0c3f0909010b3bd0f44a2acdab974b8b64bb19a34ffee9d8db0cdd32ea1417d433076649da03aa9d2d2581bb3d4d671a3
SSDEEP 768:DckYJT7pLuL7glWg1NfgB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeSVhHgurop/4h:DckYJFE7glWg1NfgBu1jaNSVdglpI
TLSH
T152E2DB7B680CCB7F4F804A9CEC297D9A6DA801CF96D8CD5447EA840C03C67EB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2b1901b113be8b22201d7a37c84f570801b233ca656a9858f756586c166a2bfa
MD5 721aa47f9634f3fe1fd6eac28f7c1028
SHA1 15e758c2709f09855214b4baedba75826c642884
SHA512 7f5712c4fe73bfcf4f1ac81133337b76b42df64a4a6683e68bbf2d4737b191e529898529c1a8dc2b881850cb32aac14e640eec3720c263e5073f723872b50a63
SSDEEP 192:E61PhSGGXWL8MMLOi70MjSEJB3BPorbu/drtBZnZj5vcdqjXNn8:E+PKFT3JoPuVr/ZZjhw
TLSH
T181B21711723B33C2387E39088194942F52C27563321AA96B7BBC54EA4F67E41DEFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8e2d34680e3ca1f2f34514ffad0ce1a5d3687ae0d6151493033e63fd2c8ac977
MD5 dede85dc6aac933b7df897a5ee322272
SHA1 d1779d26123801704981d661b937fea363985523
SHA512 a52cfeac16fee4d6355d9a87bfce0e92e2afed7bf229fb4ba6df8a10f30f11525c43dcc50375c518c49366a2b07548012636951df7844f66283815c627148817
SSDEEP 384:n/iF1tNn/s3n9Sy8N78TUNTUlIRvB1iiERZstsfUGVou6Dmn15wbAjE+8L+1Iz3:KF1j+9XuwgYLwGV0Dmn12bfb
TLSH
T1FEC24936DC64CA67ADE68FC9B70A7B06EEE001A385D859E8DAD94D4D01D32DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8686eca2f0deeb07bae9549abc7104c2470262af9bf67952eea52c015cce04d1
MD5 049cb737aaa12407a00faaee772cc452
SHA1 1a0ccd4eb4fc417f69b05d6ffea6a103db38bc5c
SHA512 118ff1c8a5a2d1f2def918b87f814689f5d3d496abce4e44632bd438cfefe3379f330f79fae72e407e9b9d955eb4b7bd481b87d50a67090cb77855af90555012
SSDEEP 384:nFiF1tNn/s3n9ST8NF8TUNTUlIRjB1jKnpstsfUGVou47l+FoYOObjI9G6w7O08n:MF1j+96AwgF+AGV67leoY29MG
TLSH
T11DD25B32DC55CE77ACE68BD9B34A7A5ADEE001A3C58C9AD8D9C95E0C01C71ED170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 53828d18940a1809591f84ed67c453e94931273d242a26ee24b4d013747fb81b
MD5 69554b60ef6395afd8a935f34304f4ca
SHA1 4ab998fe3632d8d7f4cb6c721a110e45cf6b234c
SHA512 df472e9894f2b20bc69d656dca4df29beadb24b001cd4bcd13c2f95b6c4125fe40a234dbb1018683b31c7074d4a0d7908885ec04343369347424687e371c0320
SSDEEP 384:nYiF1tNn/s3n9Sq8NF8TUNTUlIRjB1jKnpstsfUGVou47l+FhYOObjI9G6w7O08n:jF1j+9zAwgF+AGV67lehY29MG
TLSH
T15AD25B32DC55CE779CE68BD9B34A7A4ADEE001A3C98C9ED8D9C95E0D01C71AD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 973cdc1fd657b67739dc49ed58f2fdf38ccfd47b55a21fc034ef040ce146e3e3
MD5 46fc2ddcb2d692a34d2ecbfd5f7e4d2e
SHA1 6484318c90484b2788c2f210c44f143d6afe60ad
SHA512 9e368d41b3e44c8b1f6277c6d0752b02360d7e8e370b753d431b17b032dc41ebeaf7d5ddbc022e709fb3005a5cbf79d9e88ea717ee0612c8e1d5c26e0090873c
SSDEEP 384:nxiF1tNn/s3n9SL8NF8TUNTUlIRHB1j0npstsfUGVou47l+FJYOObjI9G6w7O08g:YF1j+96AwgpAAGV67leJY29Ml
TLSH
T1D0D25B32DC54CE77ACE68BD9B34A7A5ADEE001A3C58C9AD8D9C95E0C01C71ED170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b02e1686ea84a9d4a9821674b4808e08d77c0171a3e66b98a10a4496db9af286
MD5 6f32b20ed9a0b17cf4dc9cf341845eb3
SHA1 3d1349ac777ded6a2f76ea58ffb04a77a4d3b51b
SHA512 09fa8bb97649eeddd0e20d7f77fbf55ecf6be5aa563d40594aaef35c836043b414f19e645560560087926bdb21227a063ea9c196a55fade17252e40978bcc6a5
TLSH
T1713120E099381AD1C4BE49BFF48B35FC94E9D622F49530392898EC58922D65D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4add50b911c832c238af18a216cd81908cfe170b749dc762f5d386c832c3e7a9
MD5 56a3e8d37363cb08e673b6294ffce615
SHA1 80f4fc584aa1119a1482888dc0cf3e2eb0d008cf
SHA512 078a255c417c414ed7e1f0ef009e790731deb87b44229deeb6608fcfe495b3fb02573329e98f7d38916d157a2ac4b497ef914826e1fff91441c32164a7eb573f
TLSH
T1853122D059382AD1C4BE09AFF49B39FC94E9D221F858743D7884E898952E54A658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b3efa74c3a4e6ee7530015696ca405b2b6cf84d429e0cd2c0bb8e21d45d563e3
MD5 00817e6218bad742e0bb1bfc3d59fcd2
SHA1 7399ad4efba5da235c39fcd4f164b9bd3356a1cc
SHA512 43aae0cd0937105d64f66b85493843c83c4281ada4d04962455c27780e6b94d0c0c53998f4b279bdf7a102b20f8b477dd3a7751d3b2c7cfac2e60195c41a66ea
TLSH
T1853122E0993C1AD1C4BE49BFF45B39FC94E9D612F46870393888EC58952E64D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 e4c225ff53dd68259c6d3c3edf518922c7f2b05f74295eddc220b89c5da03563
MD5 86850a54158ea10d8ac796552eaeb5df
SHA1 8e4bd0569abec6ba2fb6240b9a8fc1e22f6fdd4f
SHA512 bad328c2f365ba139c4d75c4efdf8a67e7afcab67902dfbd199febeaef08f9e8c9f7cecdad2c78f1a1d1208bec96664ec7907975a3f7d3783dc8bf423fdeb7b4
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3d:CebAjOKn3wRKRJ3d
TLSH
T1DED57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.old_1783040662

Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_da80e4ce8c449a418357a57f26115b69_akira_glassworm_rusty-stealer.old_1783040662
Size 2.7MB
SHA256 6b3b429f59bf675c56b6294d705103412e4e0961f097e7d829c1a10741ef4465
MD5 9ffd361c3fc93c123db17afbdd70ff47
SHA1 1eb5919caa415e19acaefc9ff095a386b5672f11
SHA512 9411fe25414f9986ae8f4121a03922528b15ce777f67296f34e60cd0613f43255267663ad07fa5b539c6ade95e23c8a31a2eac2d1a2ff78a34c8e2bb98b40f0a
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3V:CebAjOKn3wRKRJ3V
TLSH
T181D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-231-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-222-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-232-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-259-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-192-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-274-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-282-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-238-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-299-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-305-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-320-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-202-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-170-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download

memory/1800-345-0x00007FF6154F0000-0x00007FF6157B1000-memory.dmp

Download