0b7d80323446c7bb671542cbf0a15d300d6d747ef2033c547e292bdcce7a47d5

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260709-m7e81sat3w
SHA256 0b7d80323446c7bb671542cbf0a15d300d6d747ef2033c547e292bdcce7a47d5
MD5 000fbadaf2ab72b894d6a7135647045e
SHA1 49a630ec8500910ab1a9b867cbb4ffd73ee2b335
SHA512 0124331bfa96b28d960390068fdae83687c99aaacf0bb9054ba1b3380ecad390b4aed2ac2797bcd56f3bafa90cdcbd1c7732dba198e00005e9bee8446af8af14
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3t:CebAjOKn3wRKRJ3t
TLSH
T115D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_368865503\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_115149542\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_115149542\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_942499365\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_942499365\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_942499365\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_730940833\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_730940833\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_942499365\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280687768193968"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{10F7101F-22A4-4C00-899E-09D885363AEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2320	wmic.exe
2320	wmic.exe
2320	wmic.exe
2320	wmic.exe
4732	msedge.exe
4732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3956	2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2320	wmic.exe
Token: SeSecurityPrivilege	2320	wmic.exe
Token: SeTakeOwnershipPrivilege	2320	wmic.exe
Token: SeLoadDriverPrivilege	2320	wmic.exe
Token: SeSystemProfilePrivilege	2320	wmic.exe
Token: SeSystemtimePrivilege	2320	wmic.exe
Token: SeProfSingleProcessPrivilege	2320	wmic.exe
Token: SeIncBasePriorityPrivilege	2320	wmic.exe
Token: SeCreatePagefilePrivilege	2320	wmic.exe
Token: SeBackupPrivilege	2320	wmic.exe
Token: SeRestorePrivilege	2320	wmic.exe
Token: SeShutdownPrivilege	2320	wmic.exe
Token: SeDebugPrivilege	2320	wmic.exe
Token: SeSystemEnvironmentPrivilege	2320	wmic.exe
Token: SeRemoteShutdownPrivilege	2320	wmic.exe
Token: SeUndockPrivilege	2320	wmic.exe
Token: SeManageVolumePrivilege	2320	wmic.exe
Token: 33	2320	wmic.exe
Token: 34	2320	wmic.exe
Token: 35	2320	wmic.exe
Token: 36	2320	wmic.exe
Token: SeIncreaseQuotaPrivilege	2320	wmic.exe
Token: SeSecurityPrivilege	2320	wmic.exe
Token: SeTakeOwnershipPrivilege	2320	wmic.exe
Token: SeLoadDriverPrivilege	2320	wmic.exe
Token: SeSystemProfilePrivilege	2320	wmic.exe
Token: SeSystemtimePrivilege	2320	wmic.exe
Token: SeProfSingleProcessPrivilege	2320	wmic.exe
Token: SeIncBasePriorityPrivilege	2320	wmic.exe
Token: SeCreatePagefilePrivilege	2320	wmic.exe
Token: SeBackupPrivilege	2320	wmic.exe
Token: SeRestorePrivilege	2320	wmic.exe
Token: SeShutdownPrivilege	2320	wmic.exe
Token: SeDebugPrivilege	2320	wmic.exe
Token: SeSystemEnvironmentPrivilege	2320	wmic.exe
Token: SeRemoteShutdownPrivilege	2320	wmic.exe
Token: SeUndockPrivilege	2320	wmic.exe
Token: SeManageVolumePrivilege	2320	wmic.exe
Token: 33	2320	wmic.exe
Token: 34	2320	wmic.exe
Token: 35	2320	wmic.exe
Token: 36	2320	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6028	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 2884	3956	2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe	87
PID 3956 wrote to memory of 6028	3956	2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe	89
PID 6028 wrote to memory of 5872	6028	msedge.exe	90
PID 6028 wrote to memory of 4844	6028	msedge.exe	91
PID 6028 wrote to memory of 1852	6028	msedge.exe	92
PID 6028 wrote to memory of 4844	6028	msedge.exe	91
PID 6028 wrote to memory of 4844	6028	msedge.exe	91
PID 6028 wrote to memory of 2888	6028	msedge.exe	93
PID 6028 wrote to memory of 2888	6028	msedge.exe	93
PID 6028 wrote to memory of 996	6028	msedge.exe	95
PID 6028 wrote to memory of 996	6028	msedge.exe	95
PID 6028 wrote to memory of 996	6028	msedge.exe	95
PID 6028 wrote to memory of 2392	6028	msedge.exe	96
PID 6028 wrote to memory of 2392	6028	msedge.exe	96
PID 6028 wrote to memory of 2392	6028	msedge.exe	96
PID 6028 wrote to memory of 5760	6028	msedge.exe	97
PID 6028 wrote to memory of 5760	6028	msedge.exe	97
PID 6028 wrote to memory of 5760	6028	msedge.exe	97
PID 6028 wrote to memory of 4852	6028	msedge.exe	98
PID 6028 wrote to memory of 4852	6028	msedge.exe	98
PID 6028 wrote to memory of 4852	6028	msedge.exe	98
PID 6028 wrote to memory of 4000	6028	msedge.exe	99
PID 6028 wrote to memory of 4000	6028	msedge.exe	99
PID 6028 wrote to memory of 4000	6028	msedge.exe	99
PID 6028 wrote to memory of 3120	6028	msedge.exe	100
PID 6028 wrote to memory of 3120	6028	msedge.exe	100
PID 6028 wrote to memory of 3120	6028	msedge.exe	100
PID 6028 wrote to memory of 2764	6028	msedge.exe	101
PID 6028 wrote to memory of 2764	6028	msedge.exe	101
PID 6028 wrote to memory of 124	6028	msedge.exe	103
PID 6028 wrote to memory of 5880	6028	msedge.exe	104
PID 6028 wrote to memory of 124	6028	msedge.exe	103
PID 6028 wrote to memory of 5880	6028	msedge.exe	104
PID 6028 wrote to memory of 3344	6028	msedge.exe	106
PID 6028 wrote to memory of 3396	6028	msedge.exe	107
PID 6028 wrote to memory of 3396	6028	msedge.exe	107
PID 6028 wrote to memory of 5724	6028	msedge.exe	110
PID 6028 wrote to memory of 5724	6028	msedge.exe	110
PID 3956 wrote to memory of 2320	3956	2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe	111
PID 6028 wrote to memory of 5112	6028	msedge.exe	115
PID 6028 wrote to memory of 4928	6028	msedge.exe	116
PID 6028 wrote to memory of 3452	6028	msedge.exe	117
PID 3956 wrote to memory of 4612	3956	2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe	118
PID 6028 wrote to memory of 2196	6028	msedge.exe	120
PID 6028 wrote to memory of 2196	6028	msedge.exe	120
PID 6028 wrote to memory of 3128	6028	msedge.exe	124
PID 6028 wrote to memory of 3128	6028	msedge.exe	124
PID 6028 wrote to memory of 440	6028	msedge.exe	125
PID 6028 wrote to memory of 440	6028	msedge.exe	125
PID 6028 wrote to memory of 5504	6028	msedge.exe	126
PID 6028 wrote to memory of 5504	6028	msedge.exe	126
PID 3956 wrote to memory of 3248	3956	2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe	127
PID 6028 wrote to memory of 4732	6028	msedge.exe	129
PID 6028 wrote to memory of 5548	6028	msedge.exe	130
PID 6028 wrote to memory of 5548	6028	msedge.exe	130

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2884	attrib.exe
4612	attrib.exe
3248	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.old_1783595172
  2⤵
  - Views/modifies file attributes
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x308,0x7fffd45ac188,0x7fffd45ac194,0x7fffd45ac1a0
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,1006738225828244531,18175043100500302617,262144 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,8964463326578509680,6093123891470948543,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,13739538790695668552,4076408802278094238,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,7891419046628027677,541630709783177005,2097152 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,9205082480925380423,17858226853701868341,2097152 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,13412700525526610683,6451686754894340789,2097152 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,7818552953207522620,17363018475666942502,2097152 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3756,i,12912037783423274445,17962001157471372039,2097152 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:9
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5232,i,14173356289631532685,13332783712011901907,2097152 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:15
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,13135594469279102846,8658501129052062773,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,3790424037466377498,1309452003695979911,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,15962512808706978425,2761068038201526145,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13224086284347826633,11105983953930461480,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13224086284347826633,11105983953930461480,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,6447714855775779521,13540129867976512016,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,14952626735333741473,18109198763231056504,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,7421660698030802082,10867856954581926287,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,9837922341429299045,2819879829616917447,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13521334161338397196,3474336282336608693,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3160,i,6249744268553303060,4241075734847141278,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,2646769449463010345,6671964955470081421,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,9015277505699358804,3983877946556160499,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,14864215255443942323,7454288995711332085,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6976,i,14654398790933300873,8908376574121941704,262144 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,16487054420383408480,12528304416947025839,524288 --field-trial-handle=2056,i,5336379579037346633,7522541733180713846,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
    3⤵
    PID:5548
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.old_1783595232
  2⤵
  - Views/modifies file attributes
  PID:4612
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.old_1783595293
  2⤵
  - Views/modifies file attributes
  PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 33c6e6bae4ee9250332fc0a0b2e5c986f8eb2deb7cfb0ec751d4103398239b4c
MD5 74727b4352a31c683cbe2509206d5bb1
SHA1 9cf653b0f525a7c883fb4a377664b4e16e5557f8
SHA512 9adea13063f4c2028e884bd6c48340080dd142efb6412a6eaced0704a4106259503e51aa0760da81e53710d62c167935e2cb0c8a9f4f9e7b7e210cbbbb7e4c70
TLSH
T19CD022A232388808CEC0303230A082A8A322C030000A0A0A0080FA38CC80AF3C20A0AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9a80f6c421414a8b66bf8507c53a0c4ffeb5ba8b94b60ab018ba461aa97acd
MD5 7d69ac67ab7824947bec495abe90ec4a
SHA1 a3c132aa3f49dcdcce56c4c6968c36937f0281d6
SHA512 96cc53c1ea47adf6bf5c07be3692a428e441878e2f62d51e8f602bd99412a2004cb5f7f97f8d380a16d29844233c2d6b1a7141b6130f93761e62ba2cb077211d
TLSH
T151D09B9672258914CDC03572745452696766C53055094A465441B678CC556F3C51B1AE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 aa9cbb5f0d1cc9c0b163e6e2bfb18f86e39f516ab42553fb193074eed63a9cf0
MD5 03a75c2c646221414a9360efea18b3f8
SHA1 8cfdaed0b648da0fbf038a03c4e7fb3373ceb4d6
SHA512 d0eae84d0dc07721575e13d6210bb0f40a1ee9ea31cd8ace2b336e5b30ebfd2f76daa245ef1a24ad808f3bfb9c6959745cc57c171bfc46fa817b855d44cc3f37
TLSH
T1A241314047AB75E0CB5B527167D10A84BEBCB04A4DCB9F63A5C3A138AD3A38C147B7E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fdee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fdee.TMP
Size 2KB
SHA256 9777e308175ecba647d2eed49d02ae54056a19916fb605fcb4d4d173606128dd
MD5 7cb9450d384164ba7c5f3ebf1a688406
SHA1 43c165029a4ea940aac2e6bb8adc6dfbb3a405e1
SHA512 f5c57bf92d7d3585f10360bb63879e4ec15371e70e5804ce77bcb1c248d7609da2b89e4830b0ae0182f4295a1d1e8931637a301f12a8238cabdd4e35d43fea5c
TLSH
T1E241EB4043AB35E0CB5B567263E01684BE7CB40A4CCBAE23A0C3A138AD3A78C147B7D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5829cc582a20391f74a30b2aea535762eb9e585ee87d11593dc3b60a6534b4ce
MD5 4c4a89f419c0d993ad4bf0c449e181ba
SHA1 9bac4ab685237878b09e8034f382b0c75a4513bb
SHA512 70c1f10c4c53c5b6095f4be8f5eb711d38ef30176a2c6ff5722056fe38fd2f34170554d415491fc263e1a400d105a3af1998bab0b496a7df7e3b9fc335c259f3
TLSH
T12A51AAF3C3E8866E890156F4BB186E2BCE1D0914832C3D5AC9E4EF1B93E2471E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a6816feeb0a89fd642aa0f8bd40ac5611d1e1415e10e6cdc2f8267a70fc8ccb9
MD5 2126ee17cb1f4e0aa8fa5691ffdb4118
SHA1 aa43b07b69e3b1d0b47a0c7df686f2652095dd18
SHA512 154c69111413d2e4724d8adf80b0aaaf3268831183d584ea20b8c8eb81a394353ec363276702549fe7b05dcc3d6f11a1646c0e25199711e75aa946cb8668a624
SSDEEP 192:sxRsRZyM/jK1Ml8wCH/fxsfiR82YwZqPzqgEzoA8p4u/g6+WNIYV4Oweo+GFIgtJ:sxRs38H/fxsKRmuqrqglz/5I7Okj3
TLSH
T1F362D9156A34997B9CDBD20CFA557F53D6F81533A2941E44AAFCCB0C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3e88081729cc8e287ee754f1bc2840857f7f8899f1e1f25a6636e607d67b65dd
MD5 398010edadf56961abdb02b732431789
SHA1 794c60a4d25d92fd551d71b60798152e1c7e64ee
SHA512 a7244325b2bd3593b2e53a03af2c3d4a0253144a5034d43e7f7df47b7917a1d9383f94faf36488d9550c008d0a424eae00d1bab4af83414fafd464ee2df82b3d
SSDEEP 192:sxRvRZyM/jK1Ml8UQ6CH/fxsGiR82fYwZqPzqgEzoA8peu/g6+WNIYViOweo+GFL:sxRv3q9H/fxsfR7Auqrqglh/5IzOkjL
TLSH
T17A62D816693499779CDBD20DFA81BF93D6F81533A2541E44AAFCCB0C01E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b983129b2178b4c0dc12465aa654bcdc20ce84cc3880d06c3e0cbc38d14037e8
MD5 ae939cb892c4eb344c1aa0faf0f0687a
SHA1 1a67fab0d39bf4edb9965e63e7728c964821e4a7
SHA512 8a7c089593dbcaa7da41f8fb94a44fef9299d47230744a27c035fed7181d8026d2ce10f417cca91faa7aef16ea4547a315e2f4fefa555a3c836d62a12b49e45f
SSDEEP 192:sxRvRZyM/jK1Ml8wCH/fxsGiR82YwZqPzqgEzoA8p4u/g6+WNIYV4Oweo+GFIgDJ:sxRv38H/fxsfRmuqrqglz/5I7Okjd
TLSH
T18962D8157A34997B9CDBD208FA45BF53D6F81532A2541E44AAFCCB0C01E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 65145990a9c33d82197b41ea01f1d942ca9f86a52233616d518ac72fcb109761
MD5 36eedcee3519a26968fd5dd827a2f7d7
SHA1 5f139b8164072a432e1b837d0631d939492f253b
SHA512 708d9eac6e1566768ffabfd80ddac0ae6b4dfc997df365d5d5e93929e286bb36500794730eb1fc966e6abf7ae1422053995cd9befcb38d6339479e011d2fee02
SSDEEP 768:7Oo6Hm7pLuL73mWg/zfmj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOG+ypYvro0ojyA:7Oo6HGE73mWg/zfmju1jahG+wY80eB
TLSH
T1CAE2EC7B680CCB7E4F40499CED2A7E9AADA801CF96D8C95447FA880C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d4d77b57479cfaa8db3bfb251fb5c74071394495e3414a8d26a0ac06185de0a4
MD5 0600e7eb5dba4dd8881740bead7cc247
SHA1 cd95e557d53174673c2dac259420620394b7643b
SHA512 028a2d81b801a17c08c3fa3f3bf67bce7fe08ecdf17b0ec03af57d533bb3f6a33065f994158f605ed528761e1ed5643e86a53146e2ad20b1cdf5d0f71890fe48
SSDEEP 96:KRLURlTp5FWtC4gNFK40gjFcrzKtZ+HlyLf1vz3W7gugn3K4Wg53cdF4LDyVCbvR:CLURlTp5wtCZNv0gjarzKtZ+HlyLf1vr
TLSH
T19C9144057176024038BD79449169CCABC6C2B066350BA83B7BB851F75F6BE038DFE9E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a85ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a85ac.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a731e3ccf5fc3aff10ae1239123f81c275e19fa94259f2075693df4bc319ef17
MD5 476be2c180495c2d80e18462b96d118f
SHA1 9e34636a3b765e83c4a7ba35a25831afe8ca532b
SHA512 3f0e97cc1200e216784e202a39a57b0da980179f8d4f804fa99d43ce5db51e29facf285a58a1cf4c09de67ff42e08b2275d825a972cf5e57c521d582a0a53071
SSDEEP 768:vj+9v3c+yxwOBxct9JiGcC3aHOQiBptBb9MhS:C9v3DEiPb+hS
TLSH
T1DAF2BF71AD26EE23AC92C294B3563796EFE4517356C82E04D6E85E0D08877AE4317C3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b1839b60db153827c869146b00d74405fdc40506afb1f0fb050338d719856f4a
MD5 2fb04fde132534cda3857cd1be6b292d
SHA1 f6c3e895d4702b0230eec9d006922d08a3b1e598
SHA512 ae13bfb87e6a2ebbd347f0dceb38682e56db41a958b8267eca448687fe4cebf7e2bfc968e0b4e1c6f56c6109b6471f754c3a7defc43b224eec905b5b031feb20
SSDEEP 768:krv+4UNbd83RJAxwOBsJiGcC3aHOQiBVeUirYb:kbsbS3NEi+UiK
TLSH
T10503CF32A928DD37DCE2C284B38B7617BFB8516356C81B44C6D82E5D059B29E0307D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1569c582645a8376564c987b93ad87058379dcee8e3e3e160fe5cb038be83728
MD5 89a55e68a71e417aec7befd674ea281b
SHA1 b3e18585c831cb79da83f15d2cb465ca0946d16c
SHA512 f8e7d51f66b5427837088fb53ef77a9a64c06f604955c15e4399fb91d8cf09cefd40fa9b95625f1323df0f7befd9a7803fae5db3afb98dca9ffef67be0718ec0
SSDEEP 768:Srv+4UNbda33FyxwOBxctVJiGcC3aHOQiBptBe:Sbsb03jEiPe
TLSH
T1E303BF71B929EE33ACA6D284B2577253BFB8116356C81F04D6E81E4D449B69F030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4c55a29ebe93c0c6d63d54edf1b2211523bb096846e36a572dd773d3d0bc9471
MD5 71120ab25eae92f7259d802a143a8f05
SHA1 29ceb53bc46cceb22332be5e010e264f3ceef6f1
SHA512 ef57a5a0b9fd15b18b2594169c3f5b58de5a54a3bb5bff5824a7214ebdd2435ac6c0f19da869e8b42b56fede2d604844f33481d32a4cc133051456fe9bdaa175
SSDEEP 768:bF1j+9e3pwgr+WjwOBxct9BJiGcC3aHOQiBptBb9MhS:69e3+PEiPb+hS
TLSH
T15D039E36EC15DE2BECE287C5B7567656EFE011A386C86D84DAD85E4D00C72DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 97f5ce3cf0c11a4d75ecf79d895b837c38b99665fadbf6aa85506ef6aa5da159
MD5 ea5a57c484235ed2f07b060d469976f5
SHA1 a2f49e4873781f7f3997ac8b9bfbb2d43143346a
SHA512 f9bf607e49af8e6aeb71b52919cef359314fca0e04453917f6d89740098463c03271c2d3b9b6c78893e3ab58e74571652e5da5945262589117dace6873f5aedb
SSDEEP 768:Dj+9v3p+yxwOBxct9JiGcC3aHOQiBptBb9MhS:G9v3UEiPb+hS
TLSH
T16CF2BE71AD26EE23AC92C294B3563796FFE4517356C82E04D6E85E0D08877AE4317C3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

4a57d79d-08cb-4798-91e9-ad74c3ab4d66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4a57d79d-08cb-4798-91e9-ad74c3ab4d66.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 8f700208c127f8805f0cd57d3131f969ae3451b47e2457aa9b0ffc3fa04514c4
MD5 24c179b3af7d96d836b5bc96a99df8e8
SHA1 a810f4cdaf88a8a92598a16061f07d0a3ed8ad8c
SHA512 bf1d40e6608f0daff21b1058dd9a560474aa2d66b54d070745fecb2426a165a18e466248548915454e5ab8fa8f770d8c706d071871f911bb29cbffa68dc6aad6
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3w:CebAjOKn3wRKRJ3w
TLSH
T1CED57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.old_1783595232

Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_000fbadaf2ab72b894d6a7135647045e_akira_glassworm_rusty-stealer.old_1783595232
Size 2.7MB
SHA256 9a3af1ac3eb7f262ba082bb537030fcc784bf95c4b91be84196a073005cd6c30
MD5 4197edaa896173c2a33397c3f4e6200e
SHA1 7bb6cf65b2612f9e44a6274995fe48f6ae4e20bc
SHA512 f7cc4f0488c2530e090110627ffb66d04c2e0e913498895ce7d10023d6c48a97e5d2e85d2831722bb280ed012eda425771a27fac4a44b68754b47e545fd45303
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3J:CebAjOKn3wRKRJ3J
TLSH
T163D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6028_151779325\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3956-277-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-317-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-273-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-334-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-351-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-256-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-368-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-381-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-252-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-399-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-235-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-421-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download

memory/3956-201-0x00007FF795480000-0x00007FF795741000-memory.dmp

Download