be532467bc0a15d982d66b763931381b1f1b7ae8ce64524a94ede3da237743ec

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260704-mac3dshz8l
SHA256 be532467bc0a15d982d66b763931381b1f1b7ae8ce64524a94ede3da237743ec
MD5 b2a78df0f12b029c4e2cf6177b2e0014
SHA1 51753627193fbd40a29086bc90311552f18d49be
SHA512 0bedd7202860ae8345a8b183d1a60f6ba19c781d5d6ace589d6aff9483d36a85f6f6721134e7b4e06ef029ea0a95c16b4ddd73a6f9c2261486a1de190ffb0249
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ39:CebAjOKn3wRKRJ39
TLSH
T1F7D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_1791370149\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_1791370149\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_100469956\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_1354477344\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_100469956\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_1354477344\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_1354477344\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7100_1354477344\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1856	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276337281744466"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{EF1873EC-EFE8-4831-BC30-5AA0E31FFB09}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3236	wmic.exe
3236	wmic.exe
3236	wmic.exe
3236	wmic.exe
1132	msedge.exe
1132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
7100	msedge.exe
7100	msedge.exe
7100	msedge.exe
7100	msedge.exe
7100	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
472	2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3236	wmic.exe
Token: SeSecurityPrivilege	3236	wmic.exe
Token: SeTakeOwnershipPrivilege	3236	wmic.exe
Token: SeLoadDriverPrivilege	3236	wmic.exe
Token: SeSystemProfilePrivilege	3236	wmic.exe
Token: SeSystemtimePrivilege	3236	wmic.exe
Token: SeProfSingleProcessPrivilege	3236	wmic.exe
Token: SeIncBasePriorityPrivilege	3236	wmic.exe
Token: SeCreatePagefilePrivilege	3236	wmic.exe
Token: SeBackupPrivilege	3236	wmic.exe
Token: SeRestorePrivilege	3236	wmic.exe
Token: SeShutdownPrivilege	3236	wmic.exe
Token: SeDebugPrivilege	3236	wmic.exe
Token: SeSystemEnvironmentPrivilege	3236	wmic.exe
Token: SeRemoteShutdownPrivilege	3236	wmic.exe
Token: SeUndockPrivilege	3236	wmic.exe
Token: SeManageVolumePrivilege	3236	wmic.exe
Token: 33	3236	wmic.exe
Token: 34	3236	wmic.exe
Token: 35	3236	wmic.exe
Token: 36	3236	wmic.exe
Token: SeIncreaseQuotaPrivilege	3236	wmic.exe
Token: SeSecurityPrivilege	3236	wmic.exe
Token: SeTakeOwnershipPrivilege	3236	wmic.exe
Token: SeLoadDriverPrivilege	3236	wmic.exe
Token: SeSystemProfilePrivilege	3236	wmic.exe
Token: SeSystemtimePrivilege	3236	wmic.exe
Token: SeProfSingleProcessPrivilege	3236	wmic.exe
Token: SeIncBasePriorityPrivilege	3236	wmic.exe
Token: SeCreatePagefilePrivilege	3236	wmic.exe
Token: SeBackupPrivilege	3236	wmic.exe
Token: SeRestorePrivilege	3236	wmic.exe
Token: SeShutdownPrivilege	3236	wmic.exe
Token: SeDebugPrivilege	3236	wmic.exe
Token: SeSystemEnvironmentPrivilege	3236	wmic.exe
Token: SeRemoteShutdownPrivilege	3236	wmic.exe
Token: SeUndockPrivilege	3236	wmic.exe
Token: SeManageVolumePrivilege	3236	wmic.exe
Token: 33	3236	wmic.exe
Token: 34	3236	wmic.exe
Token: 35	3236	wmic.exe
Token: 36	3236	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
7100	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 5944	472	2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe	89
PID 472 wrote to memory of 7100	472	2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe	91
PID 7100 wrote to memory of 5724	7100	msedge.exe	92
PID 7100 wrote to memory of 6868	7100	msedge.exe	93
PID 7100 wrote to memory of 1856	7100	msedge.exe	95
PID 7100 wrote to memory of 6868	7100	msedge.exe	93
PID 7100 wrote to memory of 6868	7100	msedge.exe	93
PID 7100 wrote to memory of 6116	7100	msedge.exe	96
PID 7100 wrote to memory of 6116	7100	msedge.exe	96
PID 7100 wrote to memory of 3720	7100	msedge.exe	97
PID 7100 wrote to memory of 3720	7100	msedge.exe	97
PID 7100 wrote to memory of 3720	7100	msedge.exe	97
PID 7100 wrote to memory of 3472	7100	msedge.exe	98
PID 7100 wrote to memory of 3472	7100	msedge.exe	98
PID 7100 wrote to memory of 3472	7100	msedge.exe	98
PID 7100 wrote to memory of 2708	7100	msedge.exe	99
PID 7100 wrote to memory of 2708	7100	msedge.exe	99
PID 7100 wrote to memory of 2708	7100	msedge.exe	99
PID 7100 wrote to memory of 2784	7100	msedge.exe	100
PID 7100 wrote to memory of 2784	7100	msedge.exe	100
PID 7100 wrote to memory of 2784	7100	msedge.exe	100
PID 7100 wrote to memory of 1696	7100	msedge.exe	101
PID 7100 wrote to memory of 2132	7100	msedge.exe	102
PID 7100 wrote to memory of 1696	7100	msedge.exe	101
PID 7100 wrote to memory of 2132	7100	msedge.exe	102
PID 7100 wrote to memory of 3108	7100	msedge.exe	104
PID 472 wrote to memory of 3236	472	2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe	107
PID 7100 wrote to memory of 4528	7100	msedge.exe	111
PID 7100 wrote to memory of 2076	7100	msedge.exe	112
PID 7100 wrote to memory of 2772	7100	msedge.exe	113
PID 472 wrote to memory of 620	472	2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe	114
PID 7100 wrote to memory of 3400	7100	msedge.exe	116
PID 7100 wrote to memory of 3400	7100	msedge.exe	116
PID 7100 wrote to memory of 6160	7100	msedge.exe	119
PID 7100 wrote to memory of 6160	7100	msedge.exe	119
PID 7100 wrote to memory of 2100	7100	msedge.exe	120
PID 7100 wrote to memory of 2100	7100	msedge.exe	120
PID 472 wrote to memory of 2248	472	2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe	121
PID 7100 wrote to memory of 1132	7100	msedge.exe	123
PID 7100 wrote to memory of 2816	7100	msedge.exe	124
PID 7100 wrote to memory of 2816	7100	msedge.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5944	attrib.exe
620	attrib.exe
2248	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.old_1783160124
  2⤵
  - Views/modifies file attributes
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffe98bc188,0x7fffe98bc194,0x7fffe98bc1a0
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,4567974854226345074,16893513619799308864,262144 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,9319187760891214322,6340934993174700122,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,10812533930575632013,18107925418190628887,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,10803980773638021627,5492852369207138772,2097152 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,6288063771332942485,17946062456635542161,2097152 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5040,i,773405322175885307,912214742253345609,2097152 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:9
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5272,i,5659166172326399824,9897952354881343970,2097152 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:15
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,4306652574346776227,2446424123488494272,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7138792128496002544,757051513379613383,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10338168721420524862,920514898846621438,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10338168721420524862,920514898846621438,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,101815836740596072,15531191855281323274,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12313871877861385077,17311488139705099332,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,1483077539434276502,17151663124882747058,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16577416424952715250,1934447726788730588,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,16305203265325186696,16640433396901646494,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:6160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4681585687853309240,16248138457474901964,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6788,i,1987369167642980019,8450879410272752205,262144 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,1655077116198663402,15382217182564774230,524288 --field-trial-handle=2204,i,12662188856224805353,12557487010040082827,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
    3⤵
    PID:2816
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.old_1783160184
  2⤵
  - Views/modifies file attributes
  PID:620
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.old_1783160244
  2⤵
  - Views/modifies file attributes
  PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c4b769c1e7c5f26039ea4be106634cc912eb02aad1b0f2d75b356b0294a628c
MD5 a4f289a957aab40ba7039a912912fcf2
SHA1 02b7edea627ec0efa57ad2abab0f9ed649a6bddf
SHA512 39e208ce589363d4f9856d117971515078d4be279b9351733bcec0cf950bbf8957b0b1edd9ec10a79ba7b87f727a797cfa30d996106a7f581850433668c94f1c
TLSH
T1A5E022A6C861EC2F08F91B192170569FEB54131A2B40594BBB3C820C8FB163F098692C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5336021b120f525017ce3f14c959df96f2ba91bd2b2302c908f357f9ba431fb3
MD5 fcb2686439859fbf97716f410a7a217f
SHA1 da95a48f0786dba7c499dd6e30e9f0cda11beef8
SHA512 147a85df616d3466578096db2981561c870e4714a0c5fea0e9833765566f88b784c42bdf7fefaba91cadde7e4a57f0035500fc19a11d56727ee4af22f2ce9346
TLSH
T14771503E10291A21C7EA177D42C21585FF7994BE000BAF2008B8E0FFE84E71B2077179
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c2fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c2fd.TMP
Size 3KB
SHA256 663c80f1d84871c8324747888487642aeac08545e05c36a97d750179e81ca16b
MD5 bf334386db60cb4b4f049a93bff48fc3
SHA1 136bff304c28e09d1ab85027e3a5ed70a8754304
SHA512 2152883dae6d7bc3dcd1c7bad33c885bcab97b09039ad8fc7b003d65acdc85cd2f0912c38c9682cdc38319ef59448aff47c0a41a38922ba5e3997ef85966c83e
TLSH
T19A613E3E14680A25C7E9177D46C66585FF7998BE000B6F2008B8E0FFD88EB6B1077079
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a55d16ec-ec53-422e-8ee8-3b1e8ebba100.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a55d16ec-ec53-422e-8ee8-3b1e8ebba100.tmp
Size 2KB
SHA256 171e98a0319045e53888eb5e0dafa6725c2d8d7135d3363712c55f0da0b48c89
MD5 ce61336ad73d10d9e9d2fd3df6f501f8
SHA1 3f365e0b3fbefb5f8a49783791f672fd7435cf46
SHA512 cf76e8e8c6319aa3be01d253cd7a090c776e4e707f5ee87e1aaf35b7a473eeaf23ab81b512b7b0301051ae93686248233be8cd59ff7208bab0fa30f3fba93de6
TLSH
T19E51CFF7C3E8866DD90195F0AA187E1BCE1D0915432C3C5AC5E0DF1B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7122db7a46161a8555e8c01ad26cb4d982f8b89d0ed90492a224d13877012d90
MD5 a3a4773c73b8afe28f5ce1cf2cf70bc6
SHA1 fb56bc670630e3a13cf404648c2a5b57b5af8ca6
SHA512 43dae7e23fb106d9437bd2aa28f4f7555b604ffdecc4b4bf3f0f0cce059a124eb8a2f26efdaad2667540911307e1f130f16d166f50814ca9c8c85d898551c055
SSDEEP 192:sxRnRSYyMqZjK1Ml8wco/fHs6SSAZUBM5zoA8pef/g6+WNIYUnOwyZGfIgjEEJ:sxRnMCo/fHs6teUBLo/5ILOsjz
TLSH
T15C72FA1A6924593BCCDBD219FA857B53D7FC1533A2905E04AAFC8A0C15E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1e02ec677c7784f4da5dbf90a832a20aa20ed989c0a77d05252592559f029eca
MD5 6fdfd9fc36ed75e65979383e770efa82
SHA1 ce24edce55fe7478c0941d54b735281d8e13a45a
SHA512 fee8f385ca65cd46097aa101fadec2a731d5a093abbca0578ba3a329786c27de84cd79122783d64240f9fe679f2ccca2a90e79cb6e4215db5b673f92a2186938
SSDEEP 192:sxRnRSYyMqZjK1Ml8UQLco/fHsGSbAZUBM5zoA8pef/g6+WNIYUUOwyZGfIgD8cJ:sxRnMqQo/fHsGkeUBLo/5IgOs4A
TLSH
T1A872FA1669245937CCD7D219FA85BB53D7F81533A2905E04AAFC8B0C15E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7daab24b3c7d169eda2811f160bfbaf8075033348b98711162087dd46226876b
MD5 ac3e5e8e9b5090b83059a18cb12b6f94
SHA1 f2c0f60ed0514dafc9f2466f13550fe4b4f9cc8f
SHA512 8ce44b1f5a1534f2fcd51c9abc7ceb0481f0647bb8d6aa968fbadeec44560cf721b7ac71ce2b21475360ad0b9cdffe4b6447afefa1a47e370d23c9d963c845e0
SSDEEP 768:4eOlrA7pLuL7P6WgSYf9S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgFpuOGiroclu:4eOlrME7P6WgSYf9Su1jaXFpTG5v
TLSH
T12BE2FD3B680CCB7E4F80499CED29BD8A6DE802CF5AD8C95447EA440C03C67EF561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 75c2dea27a0d54a30b477e432017ef404ad37e1369cdff7f3edb9d98b1225a8d
MD5 d19583a6b45ad447481f53170e13ab3f
SHA1 bb8f90d52187d3727ea5d2ea7af7de518152c658
SHA512 88e3c4878ffd56e8d38995afd560aa447e11c171a822003594b75989414fb8416bdfe86d9e44f0ab69e64b736d8f259b10aaa167d04c46f2f5106d16d3613863
SSDEEP 384:9WhIEeUI94LU82K3iXGuTQIVlgBFTzTyLuFVdv3n+FNmP13ObHd59wh8r/j931I5:UVI1zrZi+JK9ALXEQhG
TLSH
T163B26C5171BA1741383D280E93B9942F1A4630A230DEA97B7B6931E56F67F000FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0e8b6650656d68f0e6c0cf3b393d373a5c15fc4e0a4c8c15efbd854fc0f9946c
MD5 47eef1535855a32e19b65258306857b5
SHA1 816ea172d6c4fd58a9b09c7a8807f7ec0b15f4eb
SHA512 5e0e3f9480e05d689cae7e2bf9e7597e9495b6cf7b57cd1f37503c2165f73c4e70253912c7c74c14f6a4a42c744e2fec82c3c0736e762185aa5d3a4b41c7da1c
SSDEEP 384:nxiF1tNn/s3n9Sz8Nw8TUNTUlIRVPlcA54ukW2n9cfcGWoNuLc5xYBymn15wbAjn:YF1j+9KNwgZXevn9FGWA5xzmn12bfJq
TLSH
T1CBC23A36D898CA77ADE78FC9B70A764AEEE002A7C5C859E8D9D81D4D01D32DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f9b2e17084d4eba0c670078d2ff6e2b22edff06e77c0cca26bab103c129afd9e
MD5 f15a4911e080eb433fe7b9247114ffd0
SHA1 d83465c481ffe8a68ed455302aafabb39ae8ceef
SHA512 2d6b90b9845e1d26cc6bf5c08d791a1b64976c664720224331a9a0483e3e47c2fe7274e955fbe12dcd505acdcb4cbebfb8cffaaf3c51bda564cccadc1d5f47b4
SSDEEP 384:nriF1tNn/s3n9S88NJ8TUNTUlIRiPlctsekW2n9cfcGWoNuLcPfyjG5cOObjI9Gx:GF1j+9Zwwg+5tvn9FGWAPfWGK29MF
TLSH
T12BD24B36D894CE77ACE78BD5B74A3A8ADEE0026785C899D8E9D85D0C01C72AD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 edd43ef30b7c47a140919fa57a12d37fd340468cbf245036b4ff559ca30fa1ba
MD5 9a1e0d395cec81f173353d7644fa1709
SHA1 272097fc9903834c9c6920378be94a8ca3373e86
SHA512 c19d8b1126d55559220f87fc64c8c6663cc85b5a337408296ba53c29ddcb02cc2c99672072fcd11ab4396f923f3dc8d42aef7965d9fd58051b37c222389dd90c
SSDEEP 384:nZuiF1tNn/s3n9SX8NJ8TUNTUlIRiPlctsekW2n9cfcGWoNuLcPfys6O5cOObjII:PF1j+9Swwg+5tvn9FGWAPfGOK29MF
TLSH
T1A4D24A36D894CE77ACE78BD5B74A3A8ADEE0027785C899D8E9D85E0C01C71AD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 00b19791589fe8123e187816a24d1cb561bae44bcd069199899c6acdee1ec4d8
MD5 fd27e62ce9fc231ef50aeb403ff6f008
SHA1 17690efb12e8f7bc77f7ed3f681adee795536138
SHA512 a2bd75529c6c488b6acf96044d83516111179e26c6baabcaaccc9241cc4f9fb5fc0e240a04093237eff472dd0b5a660a2a6322b66df1bf393a21c2716fc96e27
SSDEEP 384:naKiF1tNn/s3n9Sd8NJ8TUNTUlIRiPlcVsekW2n9cfcGWoNuLcPfytG5cOObjI9S:mF1j+9Ywwg+Btvn9FGWAPfmGK29MF
TLSH
T186D25B36D894CE77ACE78BD5B74A3A8ADEE002A785CC99D4E9D85D0C01C72ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bf68e938527b44f24ff29cbc568b0725f9c70c6968eff7123bd820a1ebb5695e
MD5 68a9a58a4c0cb41c7a5b811bcd56cb55
SHA1 09caddf9420d4379551224d0112002fcdba0e281
SHA512 83f53b4f65a5d0db35d96c7bcf8ef23b81fb69ac0c67d0cf369545159d10b93ca9f04fb5dc22e71b2725dd81d3f8ceda10e5003822ddc4bf2f00063c18f5f9db
TLSH
T12E3166E059383DC1C4BE09BFB45739FC98E9C216F954357D6444EC95913E14E618083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e7019763f2dcc7d1223fd2cd44154fd3b4891b16977a5ed49be9cf9db33c6676
MD5 429b1bfb2c71e943eff735408d381794
SHA1 f19b3e3044a5a8c9a24845e93a9997917e7fde6e
SHA512 edb40a1d447ebce852274c9b2f33c56a5d8eada15711598cf5434842c6767b4f49ffd9d167ebc8d8b53e0587d5ea473defe89c23c7f39cea220226d6041c9271
TLSH
T1713142E0983829C1C4BE49BEB44B39FC98E9C626F49530796858ED55923D65D228043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 72bf30e44e0cdee81c17a631d8f1ea03507a4b837ad1bb2bc0b4e9abb4491a69
MD5 1379134ac9e25a9917e8d4e89a682f5b
SHA1 a0db7a53137352150488c91e76974407427607e1
SHA512 1d646def482f547d9720e13dd1eb46eada8c0cf5d570065235b5995fb78f2e2d135074e2ca8fdf968f095e8c06164c185b8eeb657b1ef7d7b9f56ee10bd14d66
TLSH
T12E3163E1993C29C1C4BE0DBFB45B39FC98E9C216F8A531396444ED58913E28E328083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 260ca30503764077f698303173fcf5c9697bb27d046ae27532ebe451766734d7
MD5 490721bdaea76271b4b484cb0281b7e9
SHA1 e637c7c4860a976be1b9c1cb0558f1fe57efbcc0
SHA512 001202abe3cf74ca81ba6b39cc7a46d9b272467bf3a7a123baaeced865124f37c848c00dd11a92f69ec30950e9d9f949557272fc4e71836c0fd6f6b3b3df77a5
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3Y:CebAjOKn3wRKRJ3Y
TLSH
T111D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.old_1783160184

Path C:\Users\Admin\AppData\Local\Temp\2026-07-04_b2a78df0f12b029c4e2cf6177b2e0014_akira_glassworm_rusty-stealer.old_1783160184
Size 2.7MB
SHA256 c0ee029740482a4dafe321fd5a561122f152e3a0923b8171e97a9ef9a5012e00
MD5 02b5fedbf054e77c808e74a0b0385328
SHA1 5c9246ededb72bc89274f63cc921eb07c6a7f27e
SHA512 e9572e24353218b9984983a19dd10c573d29046b89164d5e25cf67b1b2e3893e5121d430e192d708b2d9384410d82eb6571e398d419b34948c1a5399dc73acbf
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3L:CebAjOKn3wRKRJ3L
TLSH
T1E2D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-274-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-232-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-171-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-260-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-207-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-233-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-283-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-193-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-300-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-306-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-321-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-239-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-203-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download

memory/472-346-0x00007FF68D8A0000-0x00007FF68DB61000-memory.dmp

Download