4a16ab369f368a0e664b591184170cb2c2be8fb875d36b119860d4686c7c2ea0

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260707-e1vfcsey5j
SHA256 4a16ab369f368a0e664b591184170cb2c2be8fb875d36b119860d4686c7c2ea0
MD5 373d633785fc871e9a166eb5137ff6d1
SHA1 1af51ca607eed52eea70764fc779b63055c89ae4
SHA512 bd2fd458817648fbbc10c4a5fda823c4b0ff7fa064fa86a759a8109993e03e196bf2d68584766362f9629623e25fd3e031c1072213f97e14c23ef26212105f5e
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3G:CebAjOKn3wRKRJ3G
TLSH
T1E4D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1355057846\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1355057846\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1249609490\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1249609490\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_756649524\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_756649524\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1917401532\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_756649524\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_756649524\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3156	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1590476978-4004838454-3790292847-1000\{657C8902-C53E-4EBA-8AD9-869AD10733F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3884	wmic.exe
3884	wmic.exe
3884	wmic.exe
3884	wmic.exe
5288	msedge.exe
5288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5268	2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3884	wmic.exe
Token: SeSecurityPrivilege	3884	wmic.exe
Token: SeTakeOwnershipPrivilege	3884	wmic.exe
Token: SeLoadDriverPrivilege	3884	wmic.exe
Token: SeSystemProfilePrivilege	3884	wmic.exe
Token: SeSystemtimePrivilege	3884	wmic.exe
Token: SeProfSingleProcessPrivilege	3884	wmic.exe
Token: SeIncBasePriorityPrivilege	3884	wmic.exe
Token: SeCreatePagefilePrivilege	3884	wmic.exe
Token: SeBackupPrivilege	3884	wmic.exe
Token: SeRestorePrivilege	3884	wmic.exe
Token: SeShutdownPrivilege	3884	wmic.exe
Token: SeDebugPrivilege	3884	wmic.exe
Token: SeSystemEnvironmentPrivilege	3884	wmic.exe
Token: SeRemoteShutdownPrivilege	3884	wmic.exe
Token: SeUndockPrivilege	3884	wmic.exe
Token: SeManageVolumePrivilege	3884	wmic.exe
Token: 33	3884	wmic.exe
Token: 34	3884	wmic.exe
Token: 35	3884	wmic.exe
Token: 36	3884	wmic.exe
Token: SeIncreaseQuotaPrivilege	3884	wmic.exe
Token: SeSecurityPrivilege	3884	wmic.exe
Token: SeTakeOwnershipPrivilege	3884	wmic.exe
Token: SeLoadDriverPrivilege	3884	wmic.exe
Token: SeSystemProfilePrivilege	3884	wmic.exe
Token: SeSystemtimePrivilege	3884	wmic.exe
Token: SeProfSingleProcessPrivilege	3884	wmic.exe
Token: SeIncBasePriorityPrivilege	3884	wmic.exe
Token: SeCreatePagefilePrivilege	3884	wmic.exe
Token: SeBackupPrivilege	3884	wmic.exe
Token: SeRestorePrivilege	3884	wmic.exe
Token: SeShutdownPrivilege	3884	wmic.exe
Token: SeDebugPrivilege	3884	wmic.exe
Token: SeSystemEnvironmentPrivilege	3884	wmic.exe
Token: SeRemoteShutdownPrivilege	3884	wmic.exe
Token: SeUndockPrivilege	3884	wmic.exe
Token: SeManageVolumePrivilege	3884	wmic.exe
Token: 33	3884	wmic.exe
Token: 34	3884	wmic.exe
Token: 35	3884	wmic.exe
Token: 36	3884	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 4940	5268	2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe	87
PID 5268 wrote to memory of 1948	5268	2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe	89
PID 1948 wrote to memory of 2312	1948	msedge.exe	90
PID 1948 wrote to memory of 1996	1948	msedge.exe	91
PID 1948 wrote to memory of 3156	1948	msedge.exe	92
PID 1948 wrote to memory of 1996	1948	msedge.exe	91
PID 1948 wrote to memory of 1996	1948	msedge.exe	91
PID 1948 wrote to memory of 2472	1948	msedge.exe	93
PID 1948 wrote to memory of 2472	1948	msedge.exe	93
PID 1948 wrote to memory of 5036	1948	msedge.exe	95
PID 1948 wrote to memory of 1588	1948	msedge.exe	96
PID 1948 wrote to memory of 5036	1948	msedge.exe	95
PID 1948 wrote to memory of 5036	1948	msedge.exe	95
PID 1948 wrote to memory of 1588	1948	msedge.exe	96
PID 1948 wrote to memory of 1588	1948	msedge.exe	96
PID 1948 wrote to memory of 792	1948	msedge.exe	97
PID 1948 wrote to memory of 792	1948	msedge.exe	97
PID 1948 wrote to memory of 792	1948	msedge.exe	97
PID 1948 wrote to memory of 4072	1948	msedge.exe	98
PID 1948 wrote to memory of 4072	1948	msedge.exe	98
PID 1948 wrote to memory of 4072	1948	msedge.exe	98
PID 1948 wrote to memory of 3124	1948	msedge.exe	99
PID 1948 wrote to memory of 3124	1948	msedge.exe	99
PID 1948 wrote to memory of 3124	1948	msedge.exe	99
PID 1948 wrote to memory of 5800	1948	msedge.exe	100
PID 1948 wrote to memory of 5800	1948	msedge.exe	100
PID 1948 wrote to memory of 5800	1948	msedge.exe	100
PID 1948 wrote to memory of 5524	1948	msedge.exe	101
PID 1948 wrote to memory of 5524	1948	msedge.exe	101
PID 1948 wrote to memory of 1472	1948	msedge.exe	103
PID 1948 wrote to memory of 1056	1948	msedge.exe	104
PID 1948 wrote to memory of 1472	1948	msedge.exe	103
PID 1948 wrote to memory of 1056	1948	msedge.exe	104
PID 1948 wrote to memory of 1896	1948	msedge.exe	106
PID 1948 wrote to memory of 5832	1948	msedge.exe	107
PID 1948 wrote to memory of 5832	1948	msedge.exe	107
PID 1948 wrote to memory of 1340	1948	msedge.exe	108
PID 1948 wrote to memory of 1340	1948	msedge.exe	108
PID 5268 wrote to memory of 3884	5268	2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe	111
PID 1948 wrote to memory of 5832	1948	msedge.exe	114
PID 1948 wrote to memory of 3556	1948	msedge.exe	115
PID 1948 wrote to memory of 4780	1948	msedge.exe	116
PID 5268 wrote to memory of 3888	5268	2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe	117
PID 1948 wrote to memory of 1760	1948	msedge.exe	119
PID 1948 wrote to memory of 1760	1948	msedge.exe	119
PID 1948 wrote to memory of 5916	1948	msedge.exe	123
PID 1948 wrote to memory of 5916	1948	msedge.exe	123
PID 1948 wrote to memory of 5960	1948	msedge.exe	124
PID 1948 wrote to memory of 5960	1948	msedge.exe	124
PID 1948 wrote to memory of 1112	1948	msedge.exe	125
PID 1948 wrote to memory of 1112	1948	msedge.exe	125
PID 5268 wrote to memory of 6080	5268	2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe	126
PID 1948 wrote to memory of 5288	1948	msedge.exe	128
PID 1948 wrote to memory of 4844	1948	msedge.exe	129
PID 1948 wrote to memory of 4844	1948	msedge.exe	129

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3888	attrib.exe
6080	attrib.exe
4940	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.old_1783398298
  2⤵
  - Views/modifies file attributes
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x304,0x7ffd9059c188,0x7ffd9059c194,0x7ffd9059c1a0
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16090931910581292483,4227834683991244130,262144 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,3150391297617407170,14728921656344835664,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,11865556605900870900,5758299908781276904,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,5536582567241159013,976326645331405580,2097152 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3708,i,18061838292364054820,13622416509532274544,2097152 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,18385998280286592388,10772785398026482321,2097152 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4392,i,18335261667424714612,16224040842670854154,2097152 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5352,i,4965538625531388328,5098180078542926422,2097152 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:9
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3832,i,6702634044118663731,17360753638085374246,2097152 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:15
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9624304040668241755,16340094999195263915,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,1825012311398591004,7990453288077105001,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14234189912800556978,3899293225450533341,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8483359688108490259,4872103201427876723,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8483359688108490259,4872103201427876723,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,3994746127651595635,15655651435178087955,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,5410158608539870050,13128935465883446398,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,5893381408104209231,12701206067496377552,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,17393010595382685718,11455303373711292636,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,12310938178856835537,11623162186086875800,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3076,i,2014824473450966115,13496938205015772114,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11898257104161241888,1213858491522912945,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,15019020808122163002,17421867005366662356,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,3142640246556076633,961859714870641557,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5228,i,7679314369095194142,6138705264800949186,262144 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,11057691043619193450,3944405389911968113,524288 --field-trial-handle=2296,i,14911573671358882121,3529017521643744758,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    PID:4844
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.old_1783398358
  2⤵
  - Views/modifies file attributes
  PID:3888
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.old_1783398419
  2⤵
  - Views/modifies file attributes
  PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72e3c96821e1675fe949371f7dde093aa987ba73e13ac2053add5929be3baca6
MD5 785d9c5f85abbfdfbe09037d227db1e7
SHA1 0096e95c62308b282ed47d2f60a384f36687fa31
SHA512 07cf1d30000bf8cf9e0ee474ff4d5515875ec99388cd206cbc4071d2bc97a23a79f2ba8ba2622e0924d8f4e6f66c366c744539041db9061c9cca43f498638a4b
TLSH
T1ADD09BF162744956DC80703534F1536572545E31445556544590F0B89867381121B49D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f520caf991803ff7a4b9b24a234e8d45e2d7ebcd034bd29be158a277c90d557
MD5 953849921ea6bc8b5ea99349afa1d1a1
SHA1 8a4859d6b2c80f8b9293d2e3e3e747b2c856e54d
SHA512 77b8de5cd35c575619cc81161c080816dfe4ee2b2f370917274f423b17812abac9d16b25797cb03e038779495870aae086ebf6eff2ca53f64fe59585826e8ba1
TLSH
T1EBD09BF562744956DC80703534F1536572545E31985556544490F0A89867381121B4AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c9f8f96849f99a59f79e13fcfbf4f7555f0b446eeb03ef866a601558cc0d5eb0
MD5 b3e5e35f194d60816900f27bd77e0d58
SHA1 52ee5b2ce631a6485ce78bf57716104616e70c79
SHA512 ce44318e64f787b4a2c1dd7dcf48116f727a3d2a0c294229f97954631d1c90b32de6264135b2a53e659a190229043aff01ccd6185a62c957730763164ac4d8e3
TLSH
T1C161A94003314EC6DF634B32A7E145883AB0667A03EF7D0BEED0A2B8C977B4A545553D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a752.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a752.TMP
Size 3KB
SHA256 00f36d3fb5ce203a197e299ca3f6d73e1a0d49abd3c1ad91e2ad33a768a222c5
MD5 e9823067295e8c0a1f24dda1582d103a
SHA1 119f4af32be9c5f26590e61e6dd051f2fb63aa23
SHA512 59edf8ea45fb68cc94143a7ee96902018bde8c28e68d173c82047379580402e71e24b15fb4ea2a2685eb94dfa6a3729b0e5c5c9c7cd8b76ef34207dbf3f57ac0
TLSH
T16461988003314EC6CF635B32A7E145843AB0667613EB7D1BEEC0A2BCCA7BB0A904553D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0818f807-d3b6-4eda-9938-1bab0f1073f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0818f807-d3b6-4eda-9938-1bab0f1073f2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dfc1db3100a3205505526efed1d8cee474aa2db3d06957249348a16837a0a0f6
MD5 8af25c2beb806a90126753d188cc13b5
SHA1 1c1256419a35b506ac73983d7197770a622642a8
SHA512 d7fb5fe1a6c491fbf8691658de43dd6cef910605ad30403454233c9f88d5a5893a25df19b41bd8292e513d3aaf250b759ef64443528191ed8a89c5889170295d
TLSH
T178519DF3C3E8856D991156F0AB186E1BCE1D0A14432C3D6A89E4AF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b17845e1fc51ea43cd64cdacf55b3e97f6eb2956c32f8f8c8bd842a39b0c6648
MD5 c399a2d015113d0ee9c7529e8b1721c4
SHA1 f7ed2e9dcab554a11a8ad9e271ae0bef45236d36
SHA512 e4b4572cb667eea84d6f7b40e59f63515791faf0bb60aba723c0c87efba3d4db004288f15e188131cda81db14663e89198eed9a390f3d71f34d1dcccea86d4ad
SSDEEP 192:sxRB7RHyM/jK1Ml8wC6/fOs2hPsZ4FMmqzoA8p4P/g6+WNIYPuOwVGNUbGKIgtJ:sxRB7P86/fOs29SwnO/5IzOPNM3
TLSH
T1AC62DA06AA249977CCCBD20DFA557F53D6F81573A2901E44AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ab9de2197625a148cf84c7d1615815f9eb0f6b3b373429058b43ad09533844aa
MD5 58d378297643e2f932fd8b93a504afea
SHA1 5b1ca230d1383d3b644dce892a8f556ceac8fb77
SHA512 23381b18dcf0273fc023f2cd6d900021d8d8c7d9578dcf0762f1ef5edd055e2e0e64c03d7dc01bd89fb4cc9f51f1683fb03fd2573daeb1c38358ab59e38a1ccf
SSDEEP 192:sxRM7RHyM/jK1Ml8wC6/fOs7PhPsZ4FMmqzoA8p4P/g6+WNIYPuOwVGNUbGKIgDi:sxRM7P86/fOs7P9SwnO/5IzOPNMu
TLSH
T12D62DA16A63499778CCBD20DFA557F53D6F81573A2901E44AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6ad75e5d9215a0a6bbd315032810227c4a5d66ebb0a37c2b49e92b24583a47da
MD5 5645439a5f3efc7207940adead8dee7a
SHA1 4697598205810949a0b4631c992e067c504406a2
SHA512 47a59e9f7fdef93b8f753289a235454210621cb5e35bc819864bbdb7a1f12ad107dce833e39a992adafb473db7a9d2a038f87bbf9628997350925a4d7e5dc66f
SSDEEP 192:sxRM7RHyM/jK1Ml8UQRC6/fOs7PhPsZ4FMmqzoA8peP/g6+WNIYPuOwVGNUbGKIl:sxRM7PqI6/fOs7P9Swn4/5IxOPNMu
TLSH
T1B562D916A6249977CCCBD20DFA55BF53D6F81573A2901E44AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d8ccb4e642d001d308e7bf3c903d5bc7b517d6add9d8d58d2b1567a53eb2eb6a
MD5 7b1830cac010cc22663faa03a899e4b3
SHA1 517c148915b4ff6acf84200bb9c52751080b1e98
SHA512 6fa7596fb7dcfd3238f7816112e9535e5439b28dcd0a47e7c268347a93bcd18ef65ea3426d21d75d6f075d50005266487bfee371af3113aecc3bc59cc39facfa
SSDEEP 768:VroBVL6d7pLuL7vOWgy8fcl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqUX3zEOurocK:VroBpME7vOWgy8fclu1jaJUX3YOlcV2n
TLSH
T12BE2FD3B684CCB7A4F844DDCEC297D8EADA902CB96D8895447FA880C03C67EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2f20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2f20.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fd3a2ad87bc0a6dd5556b0acb4fdfc311c37ba02cac6e822250b9a2daecb0e23
MD5 e28bae32e210c3c72069d828ed8d4e0f
SHA1 58409fa1fb17d286fe81abc81c19ea7da221b602
SHA512 6e4c68f425ce449ea4e353b5940c18a1ecaf54619745a8f1f7e85ff55557c45d450e8714a610947256080614f17d30a2cdeb2c56a83f048449eefeabca076ff7
SSDEEP 768:erv+4UNbdk3gRLa1TUZ+VCrh0yAJDQfQ7b9Mt:ebsb+3gOSSWh0Sfeb+t
TLSH
T1D013C030B894CD7349E7D684B18736577EB811778ACD4A44E8ED9F8D0A436AD231B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bc06327458781ed425b13f8bbc785cf0281fccaee4a1f64f7ea22effd755f2a6
MD5 871a1ed3fe2045f147fc3feeeae0a91b
SHA1 964d553f17f9c7df9f6f9ca7fe38a7f29841ff03
SHA512 64fbe8369807dca31b5989308fa167c32b26eb04e2625f344de756cba35f9cd7743f088f9f9f07da491e46ac875c60117a4857f1f9dc23a83fe5e3e1e4122b66
SSDEEP 768:VF1j+993iwgoqV3a1mUZ+VCrh0yAJDQfQ7b9M7:8993CONSWh0Sfeb+7
TLSH
T147039D75E891CE7789E28BC5B74637569EF011B78ACC98C8E9D99E8C01836ED034B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2405c284e4e88583f33d85d6cba48aefcd12c30a4fc9e4dfb3f5f58b233604dc
MD5 c6d72ac2ecee37c08602b6b7fadcff17
SHA1 6b723da65dbb9e856c50e32203472b2273d2d59a
SHA512 47c7c238f4c68917bfc2d337e47af659c8fc13ff0fae464b533bf803637cb28ac79a66fb36718ad8f8c8a546d56b5986785da75f387b23afd5cc9f3f7de0b105
SSDEEP 768:+rv+4UNbdt34xahUZ+VCrh0yAJDQfAoyUiW+J:+bsbn3u/SWh0SfZyU7e
TLSH
T19103D031F8948C338DE6D2C5B18B76577FB860239AC94A84D8ED6F8D078765E230B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 616230519765cea331a326525b6ad9376502801f40f2a9edfedc24f92f7c2fee
MD5 64843713297d74e740f6dfdf7493c277
SHA1 2dbb4e31e5f424c094beb6ffadebe64f0c7e5419
SHA512 dc311d5d0487a234ce16d83eda812131224a6ed14ca9248778d1a138adc3a206b508dc7eea75db14019ed7e87e068bc566176b1da02374eae84a0385563e8616
SSDEEP 384:nDtNn/s3n9SqR38Nb3ZtL3XCXPtWf0a1pZieeCU7Na/VKrrakh0okWfIJ45q9QMw:Dj+993wqLa1TUZ+VCrh0yAJDQfQ7b9M7
TLSH
T143F2CF70B8918D7348E2C784B2873796AEF411778ACD5D88E8EDDF4D0A837AC2257816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 ed300492d51e789326cb7d1b7768894098bb4102bc251d1150c746b7cc40c442
MD5 96bdd6e3aee870d6ef2058a7586f9a26
SHA1 2b464cdbc894d872b56db65e2c9c0c3f750b452c
SHA512 15097658369dd7addd0697e912322dbcc48d122bb57aa67d9d4189df940fc6d1de5c81e04f8a2744c4c47dbed9f7e53a5f9cf92304cdd2db00d6f82937a736c7
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3L:CebAjOKn3wRKRJ3L
TLSH
T121D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.old_1783398358

Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_373d633785fc871e9a166eb5137ff6d1_akira_glassworm_rusty-stealer.old_1783398358
Size 2.7MB
SHA256 0cfc69877274b683cc18837d0453929baf44af6c741ea4a6305b24c2665a2701
MD5 82186e9f6cd26830471b774e574da5a9
SHA1 a436dc58475cf191029b4cbac1bcfa839a433342
SHA512 f8dac3899491723447614a0a613627f827796d00cdd4a9870ee406088e680e38f655964a3ef818a8ffecef198a278ed6828766d53fe5424f8dd6a9d591f84411
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3i:CebAjOKn3wRKRJ3i
TLSH
T1E4D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1948_691827077\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5268-199-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-291-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-317-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-274-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-334-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-351-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-273-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-360-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-373-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-256-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-391-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-252-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-413-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download

memory/5268-235-0x00007FF7B3030000-0x00007FF7B32F1000-memory.dmp

Download