e868f96d319fc86cb5a870ecf423c71077415680e5bb73e40b717934300078fb

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260706-aem2yact2k
SHA256 e868f96d319fc86cb5a870ecf423c71077415680e5bb73e40b717934300078fb
MD5 34306fb879e4254ffcbeb7c1f2dc6d47
SHA1 ece1e71a1e8604e03315160fbc4f71a2ca8a0f3b
SHA512 6b6ae822e2a13182a91565c80f80af4cd78b675dc629b78bb91735563e657003eee9bc3dde5ec013a75b6a1537c5f2c4b7bee81baa4e4cb71222d5b1b70a8f45
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3n:CebAjOKn3wRKRJ3n
TLSH
T191D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6664	msedge.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1528790137\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1528790137\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1528790137\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_238616475\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_238616475\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_650957932\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_901922687\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_650957932\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1126618216\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_901922687\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1528790137\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1997629553\test.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6664_1126618216\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1184	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277700670462450"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{73B9F013-E00F-4C72-BC76-8C97E4D5E58C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4784	wmic.exe
4784	wmic.exe
4784	wmic.exe
4784	wmic.exe
5356	msedge.exe
5356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6664	msedge.exe
6664	msedge.exe
6664	msedge.exe
6664	msedge.exe
6664	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5800	2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4784	wmic.exe
Token: SeSecurityPrivilege	4784	wmic.exe
Token: SeTakeOwnershipPrivilege	4784	wmic.exe
Token: SeLoadDriverPrivilege	4784	wmic.exe
Token: SeSystemProfilePrivilege	4784	wmic.exe
Token: SeSystemtimePrivilege	4784	wmic.exe
Token: SeProfSingleProcessPrivilege	4784	wmic.exe
Token: SeIncBasePriorityPrivilege	4784	wmic.exe
Token: SeCreatePagefilePrivilege	4784	wmic.exe
Token: SeBackupPrivilege	4784	wmic.exe
Token: SeRestorePrivilege	4784	wmic.exe
Token: SeShutdownPrivilege	4784	wmic.exe
Token: SeDebugPrivilege	4784	wmic.exe
Token: SeSystemEnvironmentPrivilege	4784	wmic.exe
Token: SeRemoteShutdownPrivilege	4784	wmic.exe
Token: SeUndockPrivilege	4784	wmic.exe
Token: SeManageVolumePrivilege	4784	wmic.exe
Token: 33	4784	wmic.exe
Token: 34	4784	wmic.exe
Token: 35	4784	wmic.exe
Token: 36	4784	wmic.exe
Token: SeIncreaseQuotaPrivilege	4784	wmic.exe
Token: SeSecurityPrivilege	4784	wmic.exe
Token: SeTakeOwnershipPrivilege	4784	wmic.exe
Token: SeLoadDriverPrivilege	4784	wmic.exe
Token: SeSystemProfilePrivilege	4784	wmic.exe
Token: SeSystemtimePrivilege	4784	wmic.exe
Token: SeProfSingleProcessPrivilege	4784	wmic.exe
Token: SeIncBasePriorityPrivilege	4784	wmic.exe
Token: SeCreatePagefilePrivilege	4784	wmic.exe
Token: SeBackupPrivilege	4784	wmic.exe
Token: SeRestorePrivilege	4784	wmic.exe
Token: SeShutdownPrivilege	4784	wmic.exe
Token: SeDebugPrivilege	4784	wmic.exe
Token: SeSystemEnvironmentPrivilege	4784	wmic.exe
Token: SeRemoteShutdownPrivilege	4784	wmic.exe
Token: SeUndockPrivilege	4784	wmic.exe
Token: SeManageVolumePrivilege	4784	wmic.exe
Token: 33	4784	wmic.exe
Token: 34	4784	wmic.exe
Token: 35	4784	wmic.exe
Token: 36	4784	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6664	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 6064	5800	2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe	90
PID 5800 wrote to memory of 6664	5800	2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe	92
PID 6664 wrote to memory of 6964	6664	msedge.exe	93
PID 6664 wrote to memory of 5060	6664	msedge.exe	94
PID 6664 wrote to memory of 1184	6664	msedge.exe	95
PID 6664 wrote to memory of 5060	6664	msedge.exe	94
PID 6664 wrote to memory of 5060	6664	msedge.exe	94
PID 6664 wrote to memory of 6960	6664	msedge.exe	96
PID 6664 wrote to memory of 6960	6664	msedge.exe	96
PID 6664 wrote to memory of 3236	6664	msedge.exe	97
PID 6664 wrote to memory of 3236	6664	msedge.exe	97
PID 6664 wrote to memory of 3236	6664	msedge.exe	97
PID 6664 wrote to memory of 3336	6664	msedge.exe	98
PID 6664 wrote to memory of 3336	6664	msedge.exe	98
PID 6664 wrote to memory of 3336	6664	msedge.exe	98
PID 6664 wrote to memory of 6920	6664	msedge.exe	100
PID 6664 wrote to memory of 6920	6664	msedge.exe	100
PID 6664 wrote to memory of 6920	6664	msedge.exe	100
PID 6664 wrote to memory of 1236	6664	msedge.exe	101
PID 6664 wrote to memory of 1236	6664	msedge.exe	101
PID 6664 wrote to memory of 1236	6664	msedge.exe	101
PID 6664 wrote to memory of 2640	6664	msedge.exe	102
PID 6664 wrote to memory of 4360	6664	msedge.exe	103
PID 6664 wrote to memory of 2640	6664	msedge.exe	102
PID 6664 wrote to memory of 4360	6664	msedge.exe	103
PID 6664 wrote to memory of 4940	6664	msedge.exe	105
PID 5800 wrote to memory of 4784	5800	2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe	108
PID 6664 wrote to memory of 1964	6664	msedge.exe	112
PID 6664 wrote to memory of 4948	6664	msedge.exe	113
PID 6664 wrote to memory of 2888	6664	msedge.exe	114
PID 5800 wrote to memory of 1496	5800	2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe	115
PID 6664 wrote to memory of 3960	6664	msedge.exe	117
PID 6664 wrote to memory of 3960	6664	msedge.exe	117
PID 6664 wrote to memory of 5288	6664	msedge.exe	119
PID 6664 wrote to memory of 5288	6664	msedge.exe	119
PID 6664 wrote to memory of 2508	6664	msedge.exe	120
PID 6664 wrote to memory of 2508	6664	msedge.exe	120
PID 6664 wrote to memory of 2928	6664	msedge.exe	121
PID 6664 wrote to memory of 2928	6664	msedge.exe	121
PID 6664 wrote to memory of 2808	6664	msedge.exe	122
PID 6664 wrote to memory of 2808	6664	msedge.exe	122
PID 5800 wrote to memory of 6304	5800	2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe	123
PID 6664 wrote to memory of 5356	6664	msedge.exe	125
PID 6664 wrote to memory of 4296	6664	msedge.exe	126
PID 6664 wrote to memory of 4296	6664	msedge.exe	126
PID 6664 wrote to memory of 5920	6664	msedge.exe	127
PID 6664 wrote to memory of 5920	6664	msedge.exe	127

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6064	attrib.exe
1496	attrib.exe
6304	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.old_1783296463
  2⤵
  - Views/modifies file attributes
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff4576c188,0x7fff4576c194,0x7fff4576c1a0
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,8061311609765369586,3999475503446220478,262144 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,14505668979408703900,5927993397548873770,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,17893777022293402091,1244051615338079599,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,1207283424236025572,7365760162363226681,2097152 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,16552604887362394038,6112082992678324934,2097152 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4984,i,10240060095773583844,7555401393256791735,2097152 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:9
    3⤵
    PID:6920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5288,i,4156043780997635352,10904983293843405425,2097152 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:15
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,2869721755369010275,3446351679540608107,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3922067318314158679,13101221354429610812,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15831856269437290686,10955805189363944192,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15831856269437290686,10955805189363944192,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,13388451160782212099,7016493732221406603,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15104576811000878209,12541623118104207251,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14725497995224156893,10511293848314954594,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16734913609471515813,4067540381546899744,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,5703461695015912898,5915659162939121696,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,17802893826608041872,1290402819960686712,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,10536943352617143078,13393538142484236783,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,4288820719812874819,6877941650070519321,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,4463914686861130065,18157818072254167854,262144 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,4356636153440369962,4493860671124062295,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4563161670833771528,14708027785928111073,524288 --field-trial-handle=2320,i,12509380113189380532,8101933824791255136,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:5920
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.old_1783296523
  2⤵
  - Views/modifies file attributes
  PID:1496
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.old_1783296583
  2⤵
  - Views/modifies file attributes
  PID:6304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

12b56715-01da-4df0-a1fd-a5795ccb2281.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12b56715-01da-4df0-a1fd-a5795ccb2281.tmp
Size 16KB
SHA256 c9b98bebe603373280419fdc63b0d6f58898cc2b370c36e93a478e6ebd7b0c74
MD5 2546a11eb2dee4892775c68d0d4ad311
SHA1 d4edaba499e7b64eb77c0592f0558eaa0e449eca
SHA512 a15477dd92f63bdcde6a3c0a260dde067ea441616317b9a4fd719a4dc80bdcae634397d9c469eea6e484c4a6c7d437b3f5ac316016b67758392201825bdb050d
SSDEEP 384:sxRzLqJc/f9sjLBaSRiMPuX/5IxOlsXIceL:s/mJc/f4LEDE2/5IQsXIr
TLSH
T10572E81A6538593B8CCBD219FA417F53D6F81573A2945E48AAFC8B0C01E76DD221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b8a51a23ac7d36ac60c9c36ba178ae2b9c6f4985c7a8b904ab60eace449011f9
MD5 5b22a46308412ff7f329802583fd35e7
SHA1 08b085ec39180e9268b770e459742387c9a625a3
SHA512 fc6e4c9d8a9824d3eec500ac38c78183b432eca2b214d7b72b6586a3db69805d1d80e92867e7a93b341cecf70c44abfdc8e7d10c7da919fdb902ae9a46e8a0ba
TLSH
T1957111129167F96AEB6B5276E6D93CC8FFF094A205D39E0D406BB23184CF7087C43115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dcbf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dcbf.TMP
Size 3KB
SHA256 d591c58e8bc91b66ea3fc7f7215e614930eb1eeae5d31cfac8cde7aec2ed3dbd
MD5 17d8854cc063e9a40204b924d44ff475
SHA1 da38450ec659726025afa56ceaa676a4a4d40167
SHA512 3664be80dbd767af2718d92dba0d215a7c2c46b78fe57b96e24e01a7df6a5991b71ec49ed5262126b9b42beb69beeb66ba95f91bead3d099d69e77b91eb1f703
TLSH
T1FC611F569067F96AE76A51B2D5EA3CD8FFF084A605D39D1D406BB23184CF7047C43115
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3f28f76b00dd750474b4a304a96c7af6d8fdf2a5ca8496b9b156610b1a116d08
MD5 9b721188c1866ccaf402d48609e3fa15
SHA1 7efbf4401abeaa823385c028b0ecb78393c11ff9
SHA512 326823496df5d3b5afcc7b781a040e24cb207ac2365ba4997f9f475754d60232ee1e2189c35aca8f62f5bbd4b8ef95a96b043dbc39eaf5e7b1199c47db7527f4
TLSH
T12B51CFF7C3E8856DDA1195F0BA186E2BCE2D0914832C3D5AC9E0AF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4b5f17b497a30cb3eb3bdf502cf677f1742386d5ad767936593e95f4554e3768
MD5 9c60a357af5bffbc878ac555c70709ac
SHA1 6e4300230b0e8ec3ba6e9300b50b2424b17adb49
SHA512 1786bd78dc95f5570463e625db80ba3b33b742d8bd4b8e651e53d8f6127fb1bfa595768b96415b8807e687485adafe25031ceb53d470b3b745169c7236ea7f52
SSDEEP 384:sxRzLCc/f9sXD0BaSRiMPuX/5ImCOlsXIcjs:s/mc/fk0EDE2/5ImRsXIZ
TLSH
T1B572E81A6938593B8CCBD219FA457F53D7F81573A2905E44AAFC8A0C05E76DC221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0d16720190286f1f2876bd33a8bb425d6deaff6a71276ea24085bf54a3c9d479
MD5 9ad1c47f697ebf0fe96244eec4f07a3f
SHA1 9d0fdeb46354bd5b61c22ef5344944760da029cf
SHA512 fdd6501718933f79795b5ab3de7809e0ea9820cb158266b8810dd2c52f04aa5198354f7da9c0220801604261cf2d6bb413ab1e44872905d41b03292c35b1bb18
SSDEEP 768:PRbg3u7pLuL75sWgtVfwp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWokUfYHroJRzBr:PRbg3uE75sWgtVfwpu1jatokoYUJRF
TLSH
T1D0E2FD7B680CCB7F4F804E9CEC2ABE9A6DD802CB56D8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e3764b5277ded1452270b91c53b9908fa90b0f597deffd2132af43262dd302ca
MD5 c7f7d476f67a5c74deea999089393fde
SHA1 8cf67228e86f6182c37f57bfa881fd9b2a9225d7
SHA512 b2efe434b3017421f50d1e6ab7aa4f1fcaa7c81ca3cbab6f72f1c7ddfc5c56e67f4f085b20278c9c8c1d33b024c469e345811ea0d3309251b4b3825b22a9b08e
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/1:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBj
TLSH
T1A0B27C5171BA2B00383D250EA3B9841F5A4630A230DEA97B7B6931E56F67F004FFD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a8e13a5b4d3231de0ec3e899effd2be73acc30fe2785ae1f311c8faad5f22b65
MD5 0dd793153b09bcd9a2ab9ff9c303135d
SHA1 3e202632f5eb0111d3bee9aaf7af67f337d859e9
SHA512 f796aeb4d20d79381ad2b603405bf749d685bf2da4a949f4a76f969907d578be8467fc0f269901617f6bfba6029ee0eddcfd89360e81551bd83553e8069842a9
SSDEEP 384:ndiF1tNn/s3n9Se8NN8TUNTUlIRW0zykEPOfoSGB4Po34TeM/LaHXnDOObjI9G6E:UF1j+93Uwg5lGWDTj/LYnD29MN
TLSH
T101D25C36E864CE67ECE64BD8B7593657EEE01263898C5EC8EAD85D4C00C71DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dbc91d27f4256b408aa706eb52cb2d19fab74220d0ce0779fd1bdf756e3e1629
MD5 09c566b688c446328a2d0375741a1d6e
SHA1 46fbfc970cb8f8254cdbbffd97abb29a55fae7f0
SHA512 e1ef4eef2a92fd6436938957307e86a530b12cc18eddb77734a8d709dd6a2fd205b90bc975bec6a8c8b78bd8fc672138a8a4960d2ee8a7f4cf22f07296c78c04
SSDEEP 384:nviF1tNn/s3n9Sv8Nh8TUNTUlIRo0zvdoPOfoFGB4Po34TeM/LapNmn15wbAjEJs:6F1j+9SEwgd8GWDTj/LyNmn12bfJKv
TLSH
T175C23A36E8A4CE6BECE68FC9B7497656EEE4126385D819D4DAD84D4C00D32DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 85b67cc1e6294b77b0c17772c02961abe76fb401708143809690fe50828cb9c4
MD5 68e491b4e2d74d0cfe0ebe496e2290c5
SHA1 fd0c0c51eb0786a282755dad944c256243e43e99
SHA512 6edc823b584e0ef2fb7975325b9c3da835b415a07a2d1a5f1c5fb2dcae029daf7b63cf06f51e52a30baa70dd5de3af2851cc8820f066552c5ff64a8e76893d17
SSDEEP 384:nSiF1tNn/s3n9SE8NN8TUNTUlIRW0zykEPOfoFGB4Po34TeM/LaHXYDOObjI9G6E:ZF1j+91Uwg5IGWDTj/LYYD29MN
TLSH
T1ACD25B36E8A4CE67ECE64BD9B7593656EEF0126389885EC8EAD85D4C00C71DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d2fd37f7fe336008e8887ba1192d62fbebddb145f1ea99f6d22ff59e4cb7b253
MD5 e8b71208194962c2baa7bd6f5d00c196
SHA1 a6ff0de3e0612be26fcb83e325fd221c3ca8f3ca
SHA512 6843527b4ec9eed295b5ad6d3a304f8844175990a0b1f892e74c234587bea052f4ef9897480b6567410d3ccd9ca7f608830f50b3ec3a5df226262f3054452500
SSDEEP 384:n+iF1tNn/s3n9S6D8NN8TUNTUlIR00zrkEPOfoFGB4Po34TeM/LaHXpDOObjI9Gu:VF1j+9DUwgsIGWDTj/LYpD29Mi
TLSH
T198D25B36E8A4CE67ECE64BD9B75A3656EEF0126389885EC8EAD85D4C00C71DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1c098d52c78246336096f3a2057688668dbb74ee9ce20050564c16c186776eb6
MD5 1602a31faf23f2d81ff3f67df5c79e4b
SHA1 1903c1002421b80fba07c22d4820d7f7e01d153a
SHA512 e0dfab66d90234b4db679636769f6fd6f3d98e160c4b247e1cdd2e73ef6b9aa5e69e6064e495fc6373f967b00104698d52f32a0caf73762cdf224f2b5a2e032f
TLSH
T1583141E19D3D1AD1D0BE0EBFB48B39FC84ECD612F49434392888EDA8862D61E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 eeff9f164b5ea9c062860e27aefff20c9449bbbdaecea0bb995e42e84e9b0ce0
MD5 bbb8797ff26dd42bba21fdd100eec19e
SHA1 82817b86b55e4fe7af681d6f6e149d778843e011
SHA512 e91bd4a0cd94af7ee904a05bec19bb7a48fc22118502ec727c9adf9fc91f82aafa75d0b32ced56d921a9cfb5c1ebe2311c0943e0be9a216097eb4c82517e152e
TLSH
T1A3410FE19C3D5AD1D0BE0E7FB49B38FC84ECD726F494343D2888E9984669A1D254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d7d43c3dc42e7b8c4aac08532320df0165e950dc90946ec7056311c944ac572b
MD5 210a68fd274eade38f68ca29cee0f78c
SHA1 6257e1bb16feb8d67b88ba62b5e2338c09f97616
SHA512 4502e59e0c20b03b54662be40fe46791eb78a1c164bf6320f3ff8341877cd248066cebdfdfd1b411fab0fbb0a7bdd0df556774e7f98aa3c51370a5ff48b13e1d
TLSH
T1A24110E19D3D1AD1D0BD0EBFB48B35FC94E8D626F49434392898ED58862DA1D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b7b7cb2bff6bcf25569a142d16b21775b99ef9f9a0a00bc869a0d778865faf29
MD5 f6dfc0616ab3bd809eb5aa890dad1760
SHA1 f1a90ac9925939734d3b4e243131159df3a85e04
SHA512 58fc5b60e3780262363ab8f4468ec144956526ba532a69569efe807f1928dc1c0797a4c4ea564a579f6b849f51e31967f1db5060ff0528d13b55b66308198782
TLSH
T1544111E19D3D1AD1D0BD0E7FB48B34FC84ECD726F49434392888E998462961D254143F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 8641362164377301be2b85ddf73c89540395f357e294c726c699e90468fa8c9d
MD5 7e8cf222b579f4e589d758524b67ec56
SHA1 5f779bc3e45900ec399d19ea4aea63886e8749f4
SHA512 10702daacc4f34bf480f60a325cef5090c2a28924d5c0442e6afda919248958740637b812283382bdce75349ffd8d24b186419794cb7f9dfb755b845cb435199
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3b:CebAjOKn3wRKRJ3b
TLSH
T14BD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.old_1783296523

Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_34306fb879e4254ffcbeb7c1f2dc6d47_akira_glassworm_rusty-stealer.old_1783296523
Size 2.7MB
SHA256 aafabf6e816bb5c04a3d395ae629784cf30ae89dfedc38996f4da108e4193734
MD5 debcdbd660b3c6ebc7f018915d449ad2
SHA1 804af5bc5404a178dc55f2fe34a22b217006d463
SHA512 cf750c26bab4e29621283eb54c142011b0deebebe89da31093e09b67bd707eb1a46cddb781fd8ec218cf1e2ab1bf120a034e81d92541c5ca44398ce1d704eae3
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3T:CebAjOKn3wRKRJ3T
TLSH
T191D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5800-204-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-243-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-269-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-292-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-230-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-309-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-229-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-318-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-197-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-340-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-373-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-187-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-165-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download

memory/5800-398-0x00007FF7F93B0000-0x00007FF7F9671000-memory.dmp

Download