72043c81cd15532623648fcfe771cb965e3346a32f142a388871227f803b5ea8

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260705-la2v3sbt31
SHA256 72043c81cd15532623648fcfe771cb965e3346a32f142a388871227f803b5ea8
MD5 e7e219497eaf90e32abbc6a5a5f08419
SHA1 b851ab22976355d215ddc364b4c5109c2cd9ecfc
SHA512 822c8d30dde78bbac4818f77c3cdd19bd6508d99432945d433c9601f9f9ec5cce44f430595397b1b914c4f8ca36ab6696b7ce5e754ee84d4e5d96423a2a39573
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ33:CebAjOKn3wRKRJ33
TLSH
T1C5D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1700680999\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_2113286382\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1386835227\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1386835227\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1386835227\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1339520518\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1700680999\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_2113286382\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_2113286382\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_2113286382\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1386835227\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_514697477\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1339520518\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277168444540744"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{86A5AC46-CA0F-4A2A-BE69-EEAF979DE95C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
252	wmic.exe
252	wmic.exe
252	wmic.exe
252	wmic.exe
3352	msedge.exe
3352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2332	2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	252	wmic.exe
Token: SeSecurityPrivilege	252	wmic.exe
Token: SeTakeOwnershipPrivilege	252	wmic.exe
Token: SeLoadDriverPrivilege	252	wmic.exe
Token: SeSystemProfilePrivilege	252	wmic.exe
Token: SeSystemtimePrivilege	252	wmic.exe
Token: SeProfSingleProcessPrivilege	252	wmic.exe
Token: SeIncBasePriorityPrivilege	252	wmic.exe
Token: SeCreatePagefilePrivilege	252	wmic.exe
Token: SeBackupPrivilege	252	wmic.exe
Token: SeRestorePrivilege	252	wmic.exe
Token: SeShutdownPrivilege	252	wmic.exe
Token: SeDebugPrivilege	252	wmic.exe
Token: SeSystemEnvironmentPrivilege	252	wmic.exe
Token: SeRemoteShutdownPrivilege	252	wmic.exe
Token: SeUndockPrivilege	252	wmic.exe
Token: SeManageVolumePrivilege	252	wmic.exe
Token: 33	252	wmic.exe
Token: 34	252	wmic.exe
Token: 35	252	wmic.exe
Token: 36	252	wmic.exe
Token: SeIncreaseQuotaPrivilege	252	wmic.exe
Token: SeSecurityPrivilege	252	wmic.exe
Token: SeTakeOwnershipPrivilege	252	wmic.exe
Token: SeLoadDriverPrivilege	252	wmic.exe
Token: SeSystemProfilePrivilege	252	wmic.exe
Token: SeSystemtimePrivilege	252	wmic.exe
Token: SeProfSingleProcessPrivilege	252	wmic.exe
Token: SeIncBasePriorityPrivilege	252	wmic.exe
Token: SeCreatePagefilePrivilege	252	wmic.exe
Token: SeBackupPrivilege	252	wmic.exe
Token: SeRestorePrivilege	252	wmic.exe
Token: SeShutdownPrivilege	252	wmic.exe
Token: SeDebugPrivilege	252	wmic.exe
Token: SeSystemEnvironmentPrivilege	252	wmic.exe
Token: SeRemoteShutdownPrivilege	252	wmic.exe
Token: SeUndockPrivilege	252	wmic.exe
Token: SeManageVolumePrivilege	252	wmic.exe
Token: 33	252	wmic.exe
Token: 34	252	wmic.exe
Token: 35	252	wmic.exe
Token: 36	252	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3988	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 416	2332	2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe	88
PID 2332 wrote to memory of 3988	2332	2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe	90
PID 3988 wrote to memory of 4564	3988	msedge.exe	91
PID 3988 wrote to memory of 1304	3988	msedge.exe	93
PID 3988 wrote to memory of 3440	3988	msedge.exe	94
PID 3988 wrote to memory of 1304	3988	msedge.exe	93
PID 3988 wrote to memory of 1304	3988	msedge.exe	93
PID 3988 wrote to memory of 5048	3988	msedge.exe	95
PID 3988 wrote to memory of 5048	3988	msedge.exe	95
PID 3988 wrote to memory of 2716	3988	msedge.exe	96
PID 3988 wrote to memory of 2716	3988	msedge.exe	96
PID 3988 wrote to memory of 2716	3988	msedge.exe	96
PID 3988 wrote to memory of 760	3988	msedge.exe	97
PID 3988 wrote to memory of 760	3988	msedge.exe	97
PID 3988 wrote to memory of 760	3988	msedge.exe	97
PID 3988 wrote to memory of 5792	3988	msedge.exe	98
PID 3988 wrote to memory of 5792	3988	msedge.exe	98
PID 3988 wrote to memory of 5792	3988	msedge.exe	98
PID 3988 wrote to memory of 5264	3988	msedge.exe	99
PID 3988 wrote to memory of 5264	3988	msedge.exe	99
PID 3988 wrote to memory of 5264	3988	msedge.exe	99
PID 3988 wrote to memory of 5980	3988	msedge.exe	100
PID 3988 wrote to memory of 5980	3988	msedge.exe	100
PID 3988 wrote to memory of 5980	3988	msedge.exe	100
PID 3988 wrote to memory of 5992	3988	msedge.exe	101
PID 3988 wrote to memory of 5992	3988	msedge.exe	101
PID 3988 wrote to memory of 1916	3988	msedge.exe	102
PID 3988 wrote to memory of 1916	3988	msedge.exe	102
PID 3988 wrote to memory of 1916	3988	msedge.exe	102
PID 3988 wrote to memory of 1092	3988	msedge.exe	104
PID 3988 wrote to memory of 5888	3988	msedge.exe	105
PID 3988 wrote to memory of 1092	3988	msedge.exe	104
PID 3988 wrote to memory of 5888	3988	msedge.exe	105
PID 3988 wrote to memory of 1540	3988	msedge.exe	107
PID 3988 wrote to memory of 2268	3988	msedge.exe	108
PID 3988 wrote to memory of 2268	3988	msedge.exe	108
PID 3988 wrote to memory of 1628	3988	msedge.exe	111
PID 3988 wrote to memory of 1628	3988	msedge.exe	111
PID 2332 wrote to memory of 252	2332	2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe	112
PID 3988 wrote to memory of 5780	3988	msedge.exe	116
PID 3988 wrote to memory of 1660	3988	msedge.exe	117
PID 3988 wrote to memory of 6052	3988	msedge.exe	118
PID 2332 wrote to memory of 4776	2332	2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe	119
PID 3988 wrote to memory of 5820	3988	msedge.exe	121
PID 3988 wrote to memory of 5820	3988	msedge.exe	121
PID 3988 wrote to memory of 5504	3988	msedge.exe	125
PID 3988 wrote to memory of 5504	3988	msedge.exe	125
PID 3988 wrote to memory of 4660	3988	msedge.exe	126
PID 3988 wrote to memory of 4660	3988	msedge.exe	126
PID 3988 wrote to memory of 5180	3988	msedge.exe	127
PID 3988 wrote to memory of 5180	3988	msedge.exe	127
PID 2332 wrote to memory of 4436	2332	2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe	128
PID 3988 wrote to memory of 3352	3988	msedge.exe	130
PID 3988 wrote to memory of 1136	3988	msedge.exe	131
PID 3988 wrote to memory of 1136	3988	msedge.exe	131
PID 3988 wrote to memory of 4828	3988	msedge.exe	132
PID 3988 wrote to memory of 4828	3988	msedge.exe	132

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
416	attrib.exe
4776	attrib.exe
4436	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.old_1783243240
  2⤵
  - Views/modifies file attributes
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffb0b3bc188,0x7ffb0b3bc194,0x7ffb0b3bc1a0
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,5008289867601801862,2499516062846838192,262144 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,9110162128090211917,7846664532872406886,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,6629357335104408675,16103328098205260209,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,11565302769629425573,14838786354317150588,2097152 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,3214303963493042088,16373000208792472894,2097152 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3388,i,3530877056291185874,5001871802077889209,2097152 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,2405873282373432080,1548393214456402158,2097152 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:9
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5344,i,6305399047949949871,14708800820322752081,2097152 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:9
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,18062290337723590196,18418721070207657589,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5608,i,14453391392213435312,15156524925540764841,2097152 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:15
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9537821924703404235,16318097219806521233,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,15307697075832846385,17486539029379738366,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,16712430434444395138,11674475496609392464,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,16712430434444395138,11674475496609392464,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,8788369747336770955,17718183577212632997,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,16221095342729746514,18181100785473373804,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,12697831752262304973,6970730532345658449,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,2702384440206268770,14939511606766536060,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,9910131445995058324,5257410660912712824,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,4210454585686700954,5889490250035766755,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,6927307407522072556,17133729755544785840,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,5180133836185980854,16650824611046129743,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=908,i,3963565097967624452,11989328065681379375,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3396,i,6244733178675088849,4164997445784495885,262144 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,14726638302613093931,4122481529882570273,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:14
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,3441655597567926279,8028005715252112882,524288 --field-trial-handle=2660,i,11562716818851860073,12398441640063743603,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:4828
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:252
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.old_1783243300
  2⤵
  - Views/modifies file attributes
  PID:4776
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.old_1783243360
  2⤵
  - Views/modifies file attributes
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89194de105ad5bec847e6883a4ecee855062b31b48fcbcd4945b6b47dc4c041e
MD5 46c10f65b3d5074f704f52e63a6526a6
SHA1 6e1aeb080effdc2935b4de78fd144dc4b46b74cc
SHA512 eb78a62b9bdc06e1621b73762ce87d5f4eac783a6239050f7d302d80545362b289181bd345440fb069b1adfaf44eae3c49e4bc6b2bcc87a48dc247c422ed3abf
TLSH
T177714E3A137F2999D72701BA9ADBDC893F72B0937517AE28437490784F8BB04F062160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594b86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594b86.TMP
Size 3KB
SHA256 3fe1a10183643d3577136fe07f81efa40c4033db6fa4b5a60ed91fd8f7393b45
MD5 8a82b6ba42d2fff4b1c634d6aafba0cd
SHA1 4477618c9204bbfade4f4f940e0d89c27a3039e1
SHA512 baee64de2fca4062cc592540358e6bf857c92635a014fda6d8f6cf25bca1b7048660003b440a8e1461244a2590e04cf5822f67e92d2400125f5ad79b02af5a02
TLSH
T117712A3A237F599AC72701BA56DBDC893F72B0937507BA28437590785F9FB00F062060
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d306aa6ab1f4d238a93c052e30369ccef2c008529d9db7d324d650a4005b22da
MD5 e56f421edc10f2c77e35196186cefebe
SHA1 6f616e5e29470bc8558e60aa5959ba9c72eb2aa6
SHA512 506897fc07b46323fb44ff071668b87868caaeabf2ae29e054d13d85b5f0a0e0111e6e5edfc0e4912428cbe255a26082c718b00719aea14d7fb83fcab8c674d0
TLSH
T1D151BEF7C3E8867E890156F0BB146E2BCE2D0914832C7D5AC9E4AF1B93E2471D24199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6050840a3425650de158057dfa7d1c66fc2a0bf5d612a345c83cd10a38ea16e2
MD5 3c17341cf62e2eee4cf80460f67fe999
SHA1 7f31eafffd0ac5a1f8b670e402098f33bfd70574
SHA512 894515cd35496cb0be2e37ecae489dd00bc9584795c625f74d2eaf045aa7314a4a598129f43de57f1b07d32b11728c96c2a23b72405d748ec05e2e6b78cdabb6
SSDEEP 192:sxRhROyM/jK1Ml8wcW/fGsR1byTZtUJzoA8p4M/g6+WNIYyaOwhJnGjIgtJ:sxRhECW/fGsRIdmUp/5IYOiS3
TLSH
T14A62D9156A38597B8CDBD20CFA517F53D6F91573E2901E44AAFC8A1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8aa3f5666f08bbe5487f5f10216ffde38c84acdbd479923e2dbe24bbfb724a17
MD5 f28ee100879af35b0a507ca2d11c6c96
SHA1 e412fb08a9db15ff08f43ea02d5b0586cf1bee2d
SHA512 c9053302bca4b6e6eb6bc64d42fa256cb6920ece424320d9212f927a4f43047bd2f580f66f1923f0e8f16f59c283a0e1162dc09aa8ce01b245fd0ba90a967794
SSDEEP 192:sxROROyM/jK1Ml8UQGcW/fGsX16yTZtUJzoA8peM/g6+WNIYy2OwhJnGjIgDTJ:sxROEqlW/fGsXVdmUz/5IwOiSR
TLSH
T12162D816AA2859778CDBD208FA517F53D6F81473E2901E44AAFC8B1C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4103d11314f7b1091be62bf45d12919776347e81a53c2888b65be086c106b595
MD5 f37c5a30c98f39d4a641e473ebf080a2
SHA1 9a488f4de10acb57eddc528df517520560a27d59
SHA512 6038937d0c350f14df986c979dce015f84c4902f75ee5b92ed3ec4a95b2e54aba946694664da5ba63d2836cf651b97b959167be1d0db2839683733c7d08e5366
SSDEEP 192:sxROROyM/jK1Ml8wcW/fGsX1byTZtUJzoA8p4M/g6+WNIYyaOwhJnGjIgDhJ:sxROECW/fGsXIdmUp/5IYOiS3
TLSH
T19F62E915AA38597B8CDBD20CFA517F53D6F81473E2901E44AAFC8A1C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f74e3d1115962b9a662c982e9ad698a005b2c914bcd43bce2063214ed4b41519
MD5 dc71844f592193848f50fe1db32211b4
SHA1 450773a60d227319e08c6db76a14110574fd092f
SHA512 fd2783d8bb1f6494bfc5489ee5768eab1f3e6e9916791c3546e96aaccb5f3216b353daa31484c7d349deb84f93f55259a3aee9212d965c83f6b708c7d5758f0e
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4BfcciYro50lOG:AIox/OE7p0WguMfnAu1javBfXij50l
TLSH
T140E2DB3B680CCB7F4F804A9CEC29BE9A6DE801CF96D8CD5447FA841C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 70d58a051a05415caac9120025c2e57bc05c23b9a186eb3482b774bb332c9cf9
MD5 a21a39f183ae4d1e5d65a6a46f17e019
SHA1 70dd2900f6df6caeb844bddff60c8b0664d3211e
SHA512 8b5b2021e08b039b6f35377098718a11f7612cc02b19e8c98535613bc824a120275252bd245738e2a58ffe83c67685ba512e6173a1ab53baab41e9f20caa1fdd
SSDEEP 48:KonIpKUgETyNNIxKG0szydtIJK+ksj5w5B5U5A5y5e53:KonyKUgquNuKG0y+t2K+k2eTieYgx
TLSH
T13591C051B37A2700387E3A1D8778941F4283707274D9792E7B6821E62B26F055EFDBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e83b5d9e-927f-462b-99e8-4bf2ae6e309b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e83b5d9e-927f-462b-99e8-4bf2ae6e309b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

842b64eb-c88d-44f5-be4f-745986a01125.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\842b64eb-c88d-44f5-be4f-745986a01125.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 700599d3e764bba8c458022cabbc39bd1e72c52d830b39d4d7ecf9e1c9300427
MD5 e0d537dd1066dc3820ad297343f60cef
SHA1 eb921f17032e4cbde244fc120d05e83a86cb58d0
SHA512 995758aa6a0006efc1e15e19575861188488119672732f9e7e8beb7892d82c42424ff214791062a9ace9bb08420315514a0e01dde751a7216dfc12e41bd1155a
SSDEEP 768:Bj+9H30OtRDQOJIt6k5/hUAFjQIMyOV3N5E9Eib9MT:c9H3R+hNFUIpONNmDb+T
TLSH
T112F2AD31B8A6CFA38CE7E38577163293AFE0027785851E44D9EEAF0C468729D0757C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 41fc271a528b749ecc1bcdc2c9ed0f7a4c2a4cbc91325e69fd8e990c5ba801ac
MD5 5e6d737275de457e87d07b13042c869e
SHA1 5f7631c8cf1e9ad3e38f09070cb91818c40ac5a1
SHA512 4a78f3601f879d81b7d1f0678c8bac25a2072882e870c9f7db1d6fdb25687e51aa708d8ed0baad8e08afc74d8c5bd99928065a786c34b33855e8c88640c16384
SSDEEP 768:hj+9H3LOtRDQOJIt6k5/hUAFjQIMyOV3N5E9Eib9MT:89H3y+hNFUIpONNmDb+T
TLSH
T15EF2AD31B8A6DFA34CE7E38577163283AFE002B784851E44D9EEAF0C468729D0757C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 99a081b8ba3d487f332f7abcad28a9e4c50bbe2bbe5e8b3dd180d1c414adedb5
MD5 3a88cf3ff0485974528eccf983f73f46
SHA1 d1c00eb5640ba2f12cade3994df2ad3684b791dd
SHA512 87881b270ea6a873a51dfbf6c420fedb2ea4de42c58d1e34e0e44121d9289062ed68c0118f74e5e56277756e4ac69ebe4b6aa4f36ad9e796edd1e756561fb99d
SSDEEP 768:9rv+4UNbdF3S/vQOJIt6K/hUAFjQIMyOV3N5E9Mxu+8r0mL:9bsbf3aehNFUIpONNm1Drv
TLSH
T1EF03BF31E8A8DAB39CE7E7C5760A72437FF441A795C10A84C9DE2B0D824B5DD231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1b1212b5c8595271158db1ba6324e4cee55043acd8ec73b8c4a0114b444cc137
MD5 31787c2ba7f29e0f25f41d9a6b75d73d
SHA1 a66a710606ae1ac8e888d0d43e0d75f7bce81292
SHA512 6851b2041aaa27af3aa70e6256389d1493af1335e80d18846c036c11afb4353f40c5cef772360d75b922fd4b3cf50bd90bf3f967bc35f4cc7df920807f11fc26
SSDEEP 768:zF1j+9u3kwghOtRjrOJIt6kd/hUAFjQIMyOV3N5E9Eib9MT:i9u3SYhNFUIpONNmDb+T
TLSH
T143038D36E895CFABACE397C5B7153287AEE002A785C95DC4DADD5E0801872DE074BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a9e3b9d49728c7577d53d6e115d4026823b4f0ff0257aea29b5d138111a46ba0
MD5 3f3a3b7eca75322012a34028555f26f5
SHA1 83963b79ddcdf19cabb3cbd1c866c2fbbc0698e2
SHA512 70b968b4e45badb47f5b7c4c70069ae0732259d2962cf8494e112156bb8c8ca8843e9f802686b90b1efb8f9ba8d59a72a17966722399d30444bf419e8f35c81b
SSDEEP 768:Yrv+4UNbdt3LOtjDQOJIt6k1/hUAFjQIMyOV3N5E9Eib9Mv:YbsbH3CQhNFUIpONNmDb+v
TLSH
T11C13BE31F868DBB39CA7E285761A32837FF411A789C50A44D9DEAB0C464B1DE170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

b6179deb-6691-41f7-89c2-e694df2adef5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b6179deb-6691-41f7-89c2-e694df2adef5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 50f661b2205fe82ce73952810dfe3ed3a5552056c2b24e6aeeda9296a6b79d89
MD5 b6f90ed15d53893d40f46b1fb045409a
SHA1 0b02a50e910db168531b5f151533b071f8339226
SHA512 1ab89e0b5ac600f0a43693b39492e7e4d2653bd28354ba5db09c1da600551f520b2e4641733f176ec98b6662723d9d918892a9b60ccac566ba1bc4f57ea7b292
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3L:CebAjOKn3wRKRJ3L
TLSH
T16BD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.old_1783243300

Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_e7e219497eaf90e32abbc6a5a5f08419_akira_glassworm_rusty-stealer.old_1783243300
Size 2.7MB
SHA256 e4c8adf01ec4bf9e0dde55b9f3dc8d13bb5d356db629468a13ab44d7d6346fc0
MD5 87462732d1ba7a8fbaac6939d8dfbdf9
SHA1 a09da528bf8e9dc0383e08390974a53e889f0d36
SHA512 a0fd547134cfbcb2222409a212230f38d1bec84fd2baf2173cf4fc45012eb25d54613ffe5fca93de72e2e072271c72ca5d12bbaaeaff1d7bbffdb6f7b3947071
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3r:CebAjOKn3wRKRJ3r
TLSH
T129D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_480986731\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2332-337-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-277-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-299-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-203-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-345-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-283-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-363-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-256-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-379-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-388-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-408-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-260-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-239-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download

memory/2332-433-0x00007FF7CA880000-0x00007FF7CAB41000-memory.dmp

Download