fbb7ce513dd33e33509efa8f4d36286c0a843512e9c7944b7a128f02d2dfd998

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260705-mbyeqaby5t
SHA256 fbb7ce513dd33e33509efa8f4d36286c0a843512e9c7944b7a128f02d2dfd998
MD5 4b4a54e581db618cb39457514c173bfd
SHA1 4e4797d372da502d0acff41185c2deeeee650437
SHA512 2d0f738fdd48a49139ad1f3fdf0ab9faa6474d6f61cf665d433a42f3338de4a702f1272c1d95006408c03beb43373eb4ab090b3abe65735ce430bf5588776ae3
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3h:CebAjOKn3wRKRJ3h
TLSH
T108D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1006576173\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1006576173\regex_patterns.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1006576173\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_988962144\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_988962144\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1502358700\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1502358700\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1006576173\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1006576173\edge_autofill_global_block_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277202930236160"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{D1F830ED-D690-403A-8AC8-43C537D7F7C9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5592	wmic.exe
5592	wmic.exe
5592	wmic.exe
5592	wmic.exe
5192	msedge.exe
5192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6264	2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5592	wmic.exe
Token: SeSecurityPrivilege	5592	wmic.exe
Token: SeTakeOwnershipPrivilege	5592	wmic.exe
Token: SeLoadDriverPrivilege	5592	wmic.exe
Token: SeSystemProfilePrivilege	5592	wmic.exe
Token: SeSystemtimePrivilege	5592	wmic.exe
Token: SeProfSingleProcessPrivilege	5592	wmic.exe
Token: SeIncBasePriorityPrivilege	5592	wmic.exe
Token: SeCreatePagefilePrivilege	5592	wmic.exe
Token: SeBackupPrivilege	5592	wmic.exe
Token: SeRestorePrivilege	5592	wmic.exe
Token: SeShutdownPrivilege	5592	wmic.exe
Token: SeDebugPrivilege	5592	wmic.exe
Token: SeSystemEnvironmentPrivilege	5592	wmic.exe
Token: SeRemoteShutdownPrivilege	5592	wmic.exe
Token: SeUndockPrivilege	5592	wmic.exe
Token: SeManageVolumePrivilege	5592	wmic.exe
Token: 33	5592	wmic.exe
Token: 34	5592	wmic.exe
Token: 35	5592	wmic.exe
Token: 36	5592	wmic.exe
Token: SeIncreaseQuotaPrivilege	5592	wmic.exe
Token: SeSecurityPrivilege	5592	wmic.exe
Token: SeTakeOwnershipPrivilege	5592	wmic.exe
Token: SeLoadDriverPrivilege	5592	wmic.exe
Token: SeSystemProfilePrivilege	5592	wmic.exe
Token: SeSystemtimePrivilege	5592	wmic.exe
Token: SeProfSingleProcessPrivilege	5592	wmic.exe
Token: SeIncBasePriorityPrivilege	5592	wmic.exe
Token: SeCreatePagefilePrivilege	5592	wmic.exe
Token: SeBackupPrivilege	5592	wmic.exe
Token: SeRestorePrivilege	5592	wmic.exe
Token: SeShutdownPrivilege	5592	wmic.exe
Token: SeDebugPrivilege	5592	wmic.exe
Token: SeSystemEnvironmentPrivilege	5592	wmic.exe
Token: SeRemoteShutdownPrivilege	5592	wmic.exe
Token: SeUndockPrivilege	5592	wmic.exe
Token: SeManageVolumePrivilege	5592	wmic.exe
Token: 33	5592	wmic.exe
Token: 34	5592	wmic.exe
Token: 35	5592	wmic.exe
Token: 36	5592	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5884	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 6264 wrote to memory of 5752	6264	2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe	89
PID 6264 wrote to memory of 5884	6264	2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe	91
PID 5884 wrote to memory of 6436	5884	msedge.exe	92
PID 5884 wrote to memory of 936	5884	msedge.exe	93
PID 5884 wrote to memory of 4464	5884	msedge.exe	94
PID 5884 wrote to memory of 936	5884	msedge.exe	93
PID 5884 wrote to memory of 936	5884	msedge.exe	93
PID 5884 wrote to memory of 4804	5884	msedge.exe	95
PID 5884 wrote to memory of 4804	5884	msedge.exe	95
PID 5884 wrote to memory of 1184	5884	msedge.exe	97
PID 5884 wrote to memory of 1184	5884	msedge.exe	97
PID 5884 wrote to memory of 1184	5884	msedge.exe	97
PID 5884 wrote to memory of 6484	5884	msedge.exe	98
PID 5884 wrote to memory of 6484	5884	msedge.exe	98
PID 5884 wrote to memory of 6484	5884	msedge.exe	98
PID 5884 wrote to memory of 3252	5884	msedge.exe	99
PID 5884 wrote to memory of 3252	5884	msedge.exe	99
PID 5884 wrote to memory of 3252	5884	msedge.exe	99
PID 5884 wrote to memory of 2144	5884	msedge.exe	100
PID 5884 wrote to memory of 2144	5884	msedge.exe	100
PID 5884 wrote to memory of 2144	5884	msedge.exe	100
PID 5884 wrote to memory of 2160	5884	msedge.exe	101
PID 5884 wrote to memory of 1772	5884	msedge.exe	102
PID 5884 wrote to memory of 2160	5884	msedge.exe	101
PID 5884 wrote to memory of 1772	5884	msedge.exe	102
PID 5884 wrote to memory of 6648	5884	msedge.exe	104
PID 6264 wrote to memory of 5592	6264	2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe	107
PID 5884 wrote to memory of 1252	5884	msedge.exe	111
PID 5884 wrote to memory of 6228	5884	msedge.exe	112
PID 5884 wrote to memory of 6120	5884	msedge.exe	113
PID 6264 wrote to memory of 5444	6264	2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe	114
PID 5884 wrote to memory of 6896	5884	msedge.exe	116
PID 5884 wrote to memory of 6896	5884	msedge.exe	116
PID 5884 wrote to memory of 4544	5884	msedge.exe	119
PID 5884 wrote to memory of 4544	5884	msedge.exe	119
PID 5884 wrote to memory of 4704	5884	msedge.exe	120
PID 5884 wrote to memory of 4704	5884	msedge.exe	120
PID 6264 wrote to memory of 6156	6264	2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe	121
PID 5884 wrote to memory of 5192	5884	msedge.exe	123
PID 5884 wrote to memory of 5940	5884	msedge.exe	124
PID 5884 wrote to memory of 5940	5884	msedge.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5752	attrib.exe
5444	attrib.exe
6156	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6264
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.old_1783246689
  2⤵
  - Views/modifies file attributes
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x324,0x7ffc39f3c188,0x7ffc39f3c194,0x7ffc39f3c1a0
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,14212716969289574731,4545002534751256132,262144 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,12925877594645542912,17068677622341762423,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,13956972690834402156,12357559633211904092,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,220314875182955997,14962086997152099545,2097152 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,6473269819101828770,7093295146177522130,2097152 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4996,i,10283851991427233858,2724502387830155201,2097152 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:9
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5256,i,13197335942923445935,12249562847445459237,2097152 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:15
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,17185451558908467357,8886716028667653864,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9457733556681729468,6567894847991581108,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,15268484559800287181,933237592806051226,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,15268484559800287181,933237592806051226,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,13621872552906759554,7539335579058884039,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8217823906444854609,4349779380375996248,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,13920782667041808234,14437711090024297142,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11096309876489249444,2923847918683592301,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:6896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,895539000083202641,13118100579918828634,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2840,i,16695992367577221388,3333401296841908012,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5660,i,10284197419081856290,2705754427207492474,262144 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17022065609626441057,17277774255106204570,524288 --field-trial-handle=2332,i,8243327409661088484,2953703599290521132,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
    3⤵
    PID:5940
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.old_1783246749
  2⤵
  - Views/modifies file attributes
  PID:5444
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.old_1783246809
  2⤵
  - Views/modifies file attributes
  PID:6156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da3763f60ede3fa709aa0345487a9c5f026859c06ed1a1549de777571c438d2d
MD5 2ebd0330bb082497ebc47348c4ecee38
SHA1 f164cfe0a87fae91d8a0b0b31f0178ebf3aadd02
SHA512 294595e3213375937c97fffd24323394a2b90fd0b46d24771fcf9359e2edbe425b26aefe714432eaccd7516ab0d793eaa33eb35fa55b9df13c535af5d9da8f67
TLSH
T1FFD080F0B7197582D5653471B521971171B1409D391BD5D19090850C4C778D55745187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25b71a4237aea47f32aff270e23dfcea8ef3662b8e07e2834c9b4dc9904dbc24
MD5 6ebb2ab38935f96a976a811cc7bcfe98
SHA1 b23ce1c6cb0511423a2e7abed3ff4eb757919c26
SHA512 09719a3e7aa018eec7ab916fd7f1cab5ce2029d3293512a9e785bf75bd23f030aa59b8bc041de8ad40c549b7ef37e31460da9e07f122ca50afb00a6489e9f3e9
TLSH
T1F8618142141CCC21FF267179E8EA4C59FFF048E2860BAF099298DD7B184EB8623C64D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eb55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eb55.TMP
Size 3KB
SHA256 3cba3efb0e1a810c4c1ad6d9b9bb2c822369cbdac0623df335cd5ccdde7a88e4
MD5 a773485c4f405a4b884cd09c7571d023
SHA1 aeb19021e31e8c6e5020148be669c68c5b9f55e0
SHA512 3724cad43e7691616229c47624a5b4233b80ce6d9dddf0d19ac1396f64877971c5d1a13cb6a45f5f2b5045d007e5fef6fe996539ac958809abe42572254360b0
TLSH
T169615052045C8C21FF26747AE8EA4C59FFF048E2860FAF19D295CD7B185AB8613C6093
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d19b8ae33eb254f43d052317238aa1425ae7782abe3093094b78547a716fa1d7
MD5 c4f3aef961d2658cf2a64d0ff0ee353a
SHA1 e890b2ea7d0bf6d0cfdfa42f0fdb4bab9b398286
SHA512 10e7accff8f3d671825a640b2d833c3bc8306487ad872457e95bef77121b396aef4f02baaa00607c1b51c671cfbd0b839e94345e5df0e54c11034ba687929bde
TLSH
T12241B0F783F4856DDA0196F0AA187E2BCE1C0915832C3D5AC5E4AF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 46c8abb5e0b8770578ada09a0a23e347f10ef56b2387b209674e859492dde926
MD5 45ddb12d9748e9e558b0cd0951a22a9f
SHA1 ecd3a0ee01dabed1b689b175b6551b19e9a4f495
SHA512 2d635252a6506ab1c6f01033a92bce82a1426667c70598787c6c752eeeefa522ec0088fada1173a8d73321d33dd9b24248ad9bca48220de89ce1318b4dd545e3
SSDEEP 192:sxRBRDyMqZjK1Ml8UQKcQ/fasRVNKpZsGJlsJQzoA8pey/g6+WNIYmpOwGJkG2IJ:sxRBoq5Q/fasRVInsGr4Jp/5ILOJ0Op
TLSH
T10572E71A69389D3B8CD7D209F6817F53D6F81563A2900E44AAFC8A0C05EB6DD321783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 45f4643bcb3e3e200b86ab763169b76a8b03723755296bf39b004d733055af35
MD5 27a7b25cef4fc3f6a0ce04be606060fe
SHA1 f25a4927c53e1f489fdef11be443b3ae4635f787
SHA512 24925cd1b1726c8460413e33ec5c8b55977b76bf88cc5f5254c478ff690dc9f8cf364f5dbd2ea222ad4d61a2acabf5dc026a783ce16bdf6526e504a655f018bf
SSDEEP 192:sxRBRDyMqZjK1Ml8wcQ/fasIVNWpZsGJlsJQzoA8pey/g6+WNIYmYOwGJkG2IgjU:sxRBoCQ/fasIV4nsGr4Jp/5IqOJ0jU
TLSH
T18972D80A69385D3BCCC7D219FA857B53C6F81563A2904E44AAFC8A0C05EB6DD321783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 437049c95cb3e4910a27ac5406d3f944284b0d9f330d63da12fcd945ddb0c841
MD5 fe226b77718deefe93e8c6020d842afb
SHA1 8e3c7e301f124b6594c9c06e49a5793475f2a34b
SHA512 57ff4250403eedc630b4501a162546d06b413e262408c1d87b327d56e59521aa2ef30ba5a7ae64a6875d38c59d6fee193a74143858a9303abbd706f88455827e
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGu7z9wQroPwjl:RGqO3VE7yrWgzvfiXu1ja9u7pw7Pwjl
TLSH
T158E2FD3B680CCB7E4F804A9CEC29BE9A6DA802CF56D8895447EE844C03C76FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c877f8c832a70989479ff0a3a40d2b18ba7e818effdd615848512e4a04c3b515
MD5 c94addadaf6dfb8c453c3420a8877df7
SHA1 4f9fb2c9420ce0eff8e1a3fd44e03b8c57ffbe7c
SHA512 f8c2a5e55d04d7940db714346115b12f1954ab8e78c67bd44fdd5ac3a77db1ae4bc164beee2ff7cbcaf55ae509972d38b32e1953737109c48f97b87c15ae35c2
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83MtL:aR55IlHnOLRXxxinTbz
TLSH
T13BB29C5170BA2B00387D29099379D42F1A4630A230DEA87B7B6835E56F67F005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 37a4f88b52147f0d9086be75357f098c42a2c7576b07bcfd2f863866b89cd445
MD5 1f82f20b25ef93cbe34433610306ad57
SHA1 ab9b3bdc224e77132ceb51d78c4b9bfd3684048c
SHA512 62235352daad90588c956b711344814a35a5ec0f29a7f1665291a953e1f678790de96fde284a32cb96739ca901be718c0826756e564699fd0bfe5cca8821170f
SSDEEP 384:nWiF1tNn/s3n9ST8N/8TUNTUlIRTznNwiUKX+foD/+1mjNOObjI9G6w70Uz8L+1N:9F1j+9auwghU4mMjN29Mp
TLSH
T175C25A32EC95CEB7ECE68B99B74A7A47DEE011A384885DC4EAD95E0C01C71ED074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fb233202913d6d1037bc4dcdf04769639107cd03936acf8db4b50c806fbd5ce4
MD5 3792c66f5508efd706aebba0852e648e
SHA1 22f4b437068c8e421d905372910db0860aabd428
SHA512 8c6f6bb3f88fb190c072a04c5ad03bbba1d6cee415fe02c2ff32137699e2f737f3f55b01d9918854373c4724edce9e805a5488051b381783e50baae5dc27edd5
SSDEEP 384:nqiF1tNn/s3n9SsD8No8TUNTUlIRYlznNVaHX+foD/+12/mn15wbAjEJj8L+1IzE:hF1j+9RdwgbLm8/mn12bfJr
TLSH
T18BC23936D8A4CA77EDF68FC9770ABA4AAFE011A385D859D8DAD80D4D01D32DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3bf59c249e63edd8f1ad0403b0307e5d7a308a5b3b74ae4412869b68171e23aa
MD5 028d88249b97d95a50f6b6bbf2169e5c
SHA1 1718f0fcf893cd6609268b581d7cdbb11bac133f
SHA512 ccc0de7503c502ead90585dd7c334cdc7cdc12d2a07f912ffda953284e1aca63a5141953c4d0909617c8ac81ae73afa5eb7e4e639e59a64c4fcfb109612f226a
SSDEEP 384:nUiF1tNn/s3n9Sm8N/8TUNTUlIRTznNwiUKX+foD/+1mwNOObjI9G6w70Uz8L+1N:vF1j+9HuwghU4mMwN29Mp
TLSH
T1B1C24A32EC95CEB7ECE68B99B74A7A47DEE011A384885DC4EAD95E0C01C71ED074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aff55933885cc933e68a5fc4e21978b1cae826ee61c696b30bcbe1235baaa0a6
MD5 cd6db61afc5fafefe7381e7b38d89af1
SHA1 e6fd772cd5e39d355a4b0e767c6ffec2c2e20af3
SHA512 af8183a028f02ec1153b6332f91e211fa948e342aba93682e5aa57e552282108f9dac48eac90683c892236df0b808a2959e6dec9c8e3e441e60780319a303561
SSDEEP 384:nPiF1tNn/s3n9S48N/8TUNTUlIRTznNliUKX+foD/+1mvNOObjI9G6w70Uz8L+1N:aF1j+9Ruwg8U4mMvN29Mp
TLSH
T1B7C24A32EC95CEB7ECE68B99B74A7A47DEE011A384885DC4EAD95E0C01C71ED074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 c8076491333ed821a37e2c86322b092b545a28678154eaa0850ef4320a678958
MD5 c44a5c72f2ed98d0100e7d1bcedb8596
SHA1 bb4837717fd1afa98533bcdd9b00d9c7506f4146
SHA512 918659fc076735f91cc7683eaa57fedb9835c228ca56b98e6896749db73ea260e7729b47d82606041bbce7dc1f4e716f0b2424c89a87dead15a94131b4efdfec
TLSH
T1151144E15C2A29C3D47E0EAFA0432AED90D8D31AF4D430781888ED54923D11E12418BF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 c0be9b5918aedc4899030ca3360539091e3408b6dc7af77e5a325d6c79bd334f
MD5 595ef450a69b6bade743ba7cc06f5590
SHA1 0045d00ef8941139f5b1926f1a7b8eac499fa3ff
SHA512 ac67c75a5274a15b6b62fec3fd2c69e49e1e8ddcf5808633a30642c6eab4db3c8d088508db1350ca67603e7abf382d4e91264174560bccf6402e4f524993aa71
TLSH
T14F0141E25C2A28C3C4BF0E6F60433AFD90D8D31AF1E470781888DE54527961E12418BF
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 5de8cddea107e39e4397aecf932ac4278ed0912bdbf9fda47f0e71250ed57075
MD5 b23f9932d78c799ad25c9a78eb04e206
SHA1 03bfeb86590feeeefb5e475a0bf0eb5022aab829
SHA512 0183d4affa5f0b6cf9044e671eea949943c21de94d2905e82faf89ac9be686964a26789aa179d71f29b4616cc8e3195fe6079812fe7281a6f04a707f77fc36d1
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3D:CebAjOKn3wRKRJ3D
TLSH
T1FCD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.old_1783246749

Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_4b4a54e581db618cb39457514c173bfd_akira_glassworm_rusty-stealer.old_1783246749
Size 2.7MB
SHA256 2b9dee7f8cebfa50f2c743b2f6b03dc307873ad6f4c4b0751be58cafbdf8a62b
MD5 6eafe03e525d355265a45b39474672bf
SHA1 af147aa80842c139cf377712aebef1828b9c7607
SHA512 796b834c3952f99a1219c5d591efd19d8d34646b5011a04498d8e7e7902c651d0711b964997b5735cb2f23f9ed80811d76a03f35649cd77b0a6d91a3dec7033d
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ32:CebAjOKn3wRKRJ32
TLSH
T117D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6264-236-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-243-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-237-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-211-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-264-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-204-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-278-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-287-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-194-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-304-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-310-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-312-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-172-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download

memory/6264-321-0x00007FF7BC310000-0x00007FF7BC5D1000-memory.dmp

Download