b2af57a4fe4ac3aa2b06eb43629ed7ec58f481a2df432c03bbba16512faac7b7

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260709-mdnnashv4s
SHA256 b2af57a4fe4ac3aa2b06eb43629ed7ec58f481a2df432c03bbba16512faac7b7
MD5 a952835999199b44f522ff1da180631d
SHA1 81049a6aea1a019ae5d0592dad24f6c9f54d97ac
SHA512 6e260b2bf0800b9f055c4291237f7898d490f61ee67c4e63c506f87cb799bbb85dddb5c78d13281cb01d067d091e5e2acfb314bdd95dde14339403a785a680f0
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3v:CebAjOKn3wRKRJ3v
TLSH
T13CD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_772895624\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1524664419\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1200352829\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1200352829\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_2099415672\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_2099415672\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_2099415672\sets.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1898471607\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_772895624\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1524664419\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1200352829\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_1200352829\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6048_2099415672\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5576	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280660785394988"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2377119455-1173575704-3843639301-1000\{BB16559E-D3C6-4071-B5C3-37781B4EA481}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3164	wmic.exe
3164	wmic.exe
3164	wmic.exe
3164	wmic.exe
3200	msedge.exe
3200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5556	2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3164	wmic.exe
Token: SeSecurityPrivilege	3164	wmic.exe
Token: SeTakeOwnershipPrivilege	3164	wmic.exe
Token: SeLoadDriverPrivilege	3164	wmic.exe
Token: SeSystemProfilePrivilege	3164	wmic.exe
Token: SeSystemtimePrivilege	3164	wmic.exe
Token: SeProfSingleProcessPrivilege	3164	wmic.exe
Token: SeIncBasePriorityPrivilege	3164	wmic.exe
Token: SeCreatePagefilePrivilege	3164	wmic.exe
Token: SeBackupPrivilege	3164	wmic.exe
Token: SeRestorePrivilege	3164	wmic.exe
Token: SeShutdownPrivilege	3164	wmic.exe
Token: SeDebugPrivilege	3164	wmic.exe
Token: SeSystemEnvironmentPrivilege	3164	wmic.exe
Token: SeRemoteShutdownPrivilege	3164	wmic.exe
Token: SeUndockPrivilege	3164	wmic.exe
Token: SeManageVolumePrivilege	3164	wmic.exe
Token: 33	3164	wmic.exe
Token: 34	3164	wmic.exe
Token: 35	3164	wmic.exe
Token: 36	3164	wmic.exe
Token: SeIncreaseQuotaPrivilege	3164	wmic.exe
Token: SeSecurityPrivilege	3164	wmic.exe
Token: SeTakeOwnershipPrivilege	3164	wmic.exe
Token: SeLoadDriverPrivilege	3164	wmic.exe
Token: SeSystemProfilePrivilege	3164	wmic.exe
Token: SeSystemtimePrivilege	3164	wmic.exe
Token: SeProfSingleProcessPrivilege	3164	wmic.exe
Token: SeIncBasePriorityPrivilege	3164	wmic.exe
Token: SeCreatePagefilePrivilege	3164	wmic.exe
Token: SeBackupPrivilege	3164	wmic.exe
Token: SeRestorePrivilege	3164	wmic.exe
Token: SeShutdownPrivilege	3164	wmic.exe
Token: SeDebugPrivilege	3164	wmic.exe
Token: SeSystemEnvironmentPrivilege	3164	wmic.exe
Token: SeRemoteShutdownPrivilege	3164	wmic.exe
Token: SeUndockPrivilege	3164	wmic.exe
Token: SeManageVolumePrivilege	3164	wmic.exe
Token: 33	3164	wmic.exe
Token: 34	3164	wmic.exe
Token: 35	3164	wmic.exe
Token: 36	3164	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6048	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 2816	5556	2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe	88
PID 5556 wrote to memory of 6048	5556	2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe	90
PID 6048 wrote to memory of 2316	6048	msedge.exe	91
PID 6048 wrote to memory of 2080	6048	msedge.exe	92
PID 6048 wrote to memory of 5576	6048	msedge.exe	93
PID 6048 wrote to memory of 2080	6048	msedge.exe	92
PID 6048 wrote to memory of 2080	6048	msedge.exe	92
PID 6048 wrote to memory of 1064	6048	msedge.exe	94
PID 6048 wrote to memory of 1064	6048	msedge.exe	94
PID 6048 wrote to memory of 3916	6048	msedge.exe	96
PID 6048 wrote to memory of 3916	6048	msedge.exe	96
PID 6048 wrote to memory of 3916	6048	msedge.exe	96
PID 6048 wrote to memory of 4444	6048	msedge.exe	97
PID 6048 wrote to memory of 4444	6048	msedge.exe	97
PID 6048 wrote to memory of 4444	6048	msedge.exe	97
PID 6048 wrote to memory of 1608	6048	msedge.exe	98
PID 6048 wrote to memory of 1608	6048	msedge.exe	98
PID 6048 wrote to memory of 1608	6048	msedge.exe	98
PID 6048 wrote to memory of 2392	6048	msedge.exe	99
PID 6048 wrote to memory of 2392	6048	msedge.exe	99
PID 6048 wrote to memory of 2392	6048	msedge.exe	99
PID 6048 wrote to memory of 2348	6048	msedge.exe	100
PID 6048 wrote to memory of 2348	6048	msedge.exe	100
PID 6048 wrote to memory of 2348	6048	msedge.exe	100
PID 6048 wrote to memory of 3044	6048	msedge.exe	101
PID 6048 wrote to memory of 3044	6048	msedge.exe	101
PID 6048 wrote to memory of 3044	6048	msedge.exe	101
PID 6048 wrote to memory of 4120	6048	msedge.exe	102
PID 6048 wrote to memory of 4120	6048	msedge.exe	102
PID 6048 wrote to memory of 3812	6048	msedge.exe	104
PID 6048 wrote to memory of 3812	6048	msedge.exe	104
PID 6048 wrote to memory of 5696	6048	msedge.exe	105
PID 6048 wrote to memory of 5696	6048	msedge.exe	105
PID 6048 wrote to memory of 1168	6048	msedge.exe	107
PID 6048 wrote to memory of 5864	6048	msedge.exe	110
PID 6048 wrote to memory of 5864	6048	msedge.exe	110
PID 6048 wrote to memory of 4212	6048	msedge.exe	111
PID 6048 wrote to memory of 4212	6048	msedge.exe	111
PID 5556 wrote to memory of 3164	5556	2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe	112
PID 6048 wrote to memory of 2612	6048	msedge.exe	116
PID 6048 wrote to memory of 5420	6048	msedge.exe	117
PID 6048 wrote to memory of 2960	6048	msedge.exe	118
PID 5556 wrote to memory of 4644	5556	2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe	119
PID 6048 wrote to memory of 2440	6048	msedge.exe	121
PID 6048 wrote to memory of 2440	6048	msedge.exe	121
PID 6048 wrote to memory of 348	6048	msedge.exe	125
PID 6048 wrote to memory of 348	6048	msedge.exe	125
PID 6048 wrote to memory of 2308	6048	msedge.exe	126
PID 6048 wrote to memory of 2308	6048	msedge.exe	126
PID 6048 wrote to memory of 5432	6048	msedge.exe	127
PID 6048 wrote to memory of 5432	6048	msedge.exe	127
PID 5556 wrote to memory of 5076	5556	2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe	128
PID 6048 wrote to memory of 3200	6048	msedge.exe	130
PID 6048 wrote to memory of 3556	6048	msedge.exe	131
PID 6048 wrote to memory of 3556	6048	msedge.exe	131
PID 6048 wrote to memory of 3636	6048	msedge.exe	132
PID 6048 wrote to memory of 3636	6048	msedge.exe	132

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5076	attrib.exe
2816	attrib.exe
4644	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.old_1783592473
  2⤵
  - Views/modifies file attributes
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffeb66cc188,0x7ffeb66cc194,0x7ffeb66cc1a0
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8240924108844109759,3981129250781685997,262144 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9291777828718415848,742053479862081906,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,808975416484023264,17233761328949844527,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,5372651875989981924,8254892295497941698,2097152 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,14581994785937675513,10213852302773151230,2097152 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,13240250603684173260,2403325234391359223,2097152 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,234987603873648081,8315566680199873420,2097152 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:9
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5332,i,17929490707131591240,2639467919820833350,2097152 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:9
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3800,i,5973727856477001827,4793382380743947455,2097152 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:15
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,3832786989489723872,13512673484092475321,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,15589686762948976003,13248995304361555234,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7154929523985110173,13555186493675478732,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,16779667631258874652,12047808103225866141,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,16779667631258874652,12047808103225866141,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,9539943470759096470,6079629472514211150,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,14182816884338211699,9041807549298217163,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,4632604946338214245,6274933264086525052,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,7364810092451850042,5526011991601208902,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,3214898776346425097,4189572320546705304,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,14442818950997191177,2047924421265255405,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8813715672989457413,14832943428511655993,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
    3⤵
    PID:348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,11877045626221403577,5614568794865392851,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15623833516271470348,12882904330631766241,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,17619720130316663910,17459027413304970089,262144 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,4168023170382055838,9440958253551678647,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,1758642350414799552,13847653442446759189,524288 --field-trial-handle=2360,i,17908003272597359212,4434950741215809219,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
    3⤵
    PID:3636
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.old_1783592533
  2⤵
  - Views/modifies file attributes
  PID:4644
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.old_1783592594
  2⤵
  - Views/modifies file attributes
  PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bd7522092caa7acb2896abf03445b2a858eb69dc549865b3e5bf18e4c3bc23d5
MD5 58c31a20c7de556649fbb92458c6b014
SHA1 ca2844f0bddf04a25bdbd2f2b3b673584cf5d97b
SHA512 c0209e6c563f8591a3f9d97281b30ed145b122815fcbacdf9965a52f2d01cdd41a43eb90165b3566a079ec0be81a1b43748a17e7c4f70efee5f9ddf7e5c90d95
TLSH
T13DD02BA0B10D184CCA50383030F145035601402054020914C140E0388CE8142029F0BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 823a294f2a4128b32cd52b71d49126529ba4f45eaeca7814a76499f4a30fa6ce
MD5 918f47b266bd4a4b034c661fe1d0c43a
SHA1 3dfd3de7043323929ef2f5439b4b6bcc5c372f4a
SHA512 0408187b458e83bb5887d5002a893830961e74fa21773bf427fca5d6991e31d83bcf7c6633545402f4eada91cc1b8b110961aa872cfd009976c81f65cf77a86d
TLSH
T192D02BA4B10D194CCA50383030F0450356014020A8020914C040E0388CE8142029F0BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b9168c04526bb64aa54256049047b6ce379c3fe9f754dec2fb0228303cff2250
MD5 1595585ce2dfe70e03c2205a9b294f2e
SHA1 c189cdf58549436da2eac78833b2bb64b53ca8a7
SHA512 3d89c79d074e62546145d3363da76b65cc9c0a2ac7863e7b392ce14ca5e993e6998ee35f1bc4337ad058e6addc2fc64b9f7936c8f3346e325b846481d5d82cd7
TLSH
T1A151404C8FBA2BCDF3A25EB516F1858936B087DE41079F00289495344BC6F7CA2AD0E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599457.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599457.TMP
Size 2KB
SHA256 2336d676ca5b3807445bcd56e68f4ce4dedc74afa2125d11756e5b5354535c5d
MD5 5d47b4746cbd3ead55cfb938fdf9755b
SHA1 d08a221174a709fee33450dcad2e459211839b8c
SHA512 b81f20d342cafad62a857c4631b6016eb8da7dd8b5a1064d14b01219421bb2baceda80b87bfcfe1762a71d78c1781e7587094eb325e45d6764532cac376b53ab
TLSH
T11051515C4FBA2BCDF3A15E7216F0859936B087DE410B9F0068A090300BC6F3C62AE0D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 632a79cb9c7774406e0d6088b67deb44dbdfaa62a908f566b5bc272d4122041f
MD5 a55784cd10cd7c892438f6a5de218b71
SHA1 c3818cdcc35bda9841f19ffab374391848171398
SHA512 7caea3bc252634a64c441a0393c03c062c6e5176b06ffb4e1799a2bbc337f0fce79eae018eb97270d3b2ac9b72b8b1ec2865e6984db00f9646600d42bdda8d0e
TLSH
T1BB51AFF3C3E8856DC91156F4BA187E2BCE2D0A14832C7D5A89E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ea69a11957ea9efa035afc3ec06e903c9061e5dd3be001a5929dd41d1df7ec6c
MD5 d6176e9c69b520b3c06a284899809c40
SHA1 66ee2bb45fccbbcefa167f26d10839b1561fcd77
SHA512 ea7bf1c5d57b72075f20ed3bf28ccba1b19f15cb978c009d59783003e0a2f8152da41a584c680fd1f5e7ad64e46b3318a9dac14cc50d91ea6bcbfa1073022f91
SSDEEP 192:sxRzRCyM/jK1Ml8wCbV/fusfiZJbUFzoA8p40/g6+WNIYqrOwGKGzIgtJ:sxRzU8bV/fusfEjB/5ItOJ3
TLSH
T18F62DA156A24993BDCDBD20DFA557F53D6F91533A2901E44AAFCCA0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4babcb2e120f35938692918c095a0884b21a068a471e55fd1d588138032971d8
MD5 24f7f7b89590c7e610a589f10e8d7f6d
SHA1 f51f5cf4b7807b257675cddab94c08d4f30aa081
SHA512 94eea67d2a155c7f0dde06c53f5efedb331b7a7f6aabb4f0b11663edc34c7458b6e58aa59ca5b1d105f6156578940aee47cf896c04bf08bbe9e11e1f6d2e1572
SSDEEP 192:sxR8RCyM/jK1Ml8wCbV/fusyiZGZ74OzoA8p40/g6+WNIYqrOwGKGzIgDpJ:sxR8U8bV/fusyEw74zB/5ItOJv
TLSH
T19B62DA156A34993BDCCBD209FA55BF53D6F9153392901E44AAFCCB0C05E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f63d4686ac4a288ca804ddb82a2debbb300019ddec62b98f2738cb08bada691e
MD5 58454dd50e9c9ea88354bc8f20fb5023
SHA1 e27b8bf20f1b8393c9749b6ea196c1683497d590
SHA512 ab0718044943cde20a5f332ac5d857d3c91be965a0c21bb19650ab14a9e5b383a3481f7b411d88c97a24ff9f39e88d07bd26d03978931d3cc7ae3cbdd90cb762
SSDEEP 192:sxR8RCyM/jK1Ml8UQ5CbV/fusyiFGZ74OzoA8pe0/g6+WNIYqhOwGKGzIgDrJ:sxR8UqAbV/fusyYw74zr/5I3OJ5
TLSH
T1FE62D915AA249937DCCBD209FA55BF53D6F9153392901E44A6FCCB0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 36edddff3486a608260d365482acb3d199e6651223e16504177b01ab0829f2cc
MD5 17006a9f804ea35a4f6f02f15026730a
SHA1 a75ab775b9272c1ec668b591a8763a0c9251bb1a
SHA512 c0fbac69ce17e8009ec8d3d9abe81c55bda47141d263a2dea8656bc7c27e00960b937a051c1dbb7d59a89f4ced8abbd2d0f8b0a7202737b13163ace72a2511e1
SSDEEP 768:iEELZC7pLuL7neWgsSffI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEN4oKWWroFBYPS:iEELZaE7neWgsSffIu1ja3N4ZWtFBayb
TLSH
T1E5E2EB3B680CCB7E4F804A9DAC297D9B6DA801CB96D8CD9447EA890C03C67EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b863a61bc316335bc50180a8cb69e519f695f22ceec08cb9ac387a0aade8f38b
MD5 0abdf37e8a2f1f8af0f6a515489316a7
SHA1 0a6e8ac815279e08105ec7a33fbe206b37708509
SHA512 063b5d925ef99aba57773444da16ffc385aa2a0d44874a7766baa2e79171f1ebec7f3aa2aee31319b7b72b770391e0c8dfd8aa0ad7a59c52ee68cd88f3055ac2
SSDEEP 96:KRinOiU0kiWs5RgSiK4HgI1+c1e121V1U1G1fHr0xFzJZlWNiYgtlK4UgDlcLTqw:CinOiU0kds5ySaHgIT8M32cxHr0xFzJg
TLSH
T15B91055470371380383DAD4892B8DC5BA5C670E17019A82B3F6972D26F6BE029EFE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1907.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1907.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 782dc2bd2fbbab88c02ae71066a328e469390f6401ac1d100b9c226793368bf9
MD5 dce119e3e7e9339b3045c71cab28dc2f
SHA1 502597b5a63f765afb4b908e33ddc4b8d02cf3e4
SHA512 2b2c2060927c7655ac9ad860d29f7f9d6e914edee6f50fb515318a842719dd9ae762ddce85393a0c8a4ddf70ee510aba4ee3817263f81926b4b197b1ba1a77eb
SSDEEP 768:wj+9T3HHyn5Cl0ef6Pf6DB0nXe75YIbIm3k4XWlImYFdTb9MP:P9T3Vf4fqWVM735WlIFFb+P
TLSH
T199F29F309D65EE73CCF1929CB3473686FEF401B7C9841A44DADA9F0C069766D1B4682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1a0aaa6ae8f63e13df3c97bd1e4ca58351e1f94132a98f888c78f8d5f546e2fb
MD5 d64bcffe3aa7565679c4088a0c766749
SHA1 cead5998ea9eb191960422cb92e30b82fd59fb6c
SHA512 ca140db3209194ade604ea5a8944f6ba657426dcfa01ab64bb7c80e2aa834c2d88b40437f59a1b2a074c7091401616559c6615f48034589ee04a9859d74f6743
SSDEEP 768:urv+4UNbdZ3Kol5Cl0ef6pB0nXe75YIbIm3k4XWlImYFhyUij1c:ubsbb3OfQWVM735WlIFEUN
TLSH
T17103BF319964E933CDF2A189B24B7543BFB81163DA840B84C9EA2F4C879F56E1707D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f5f86087cbb6543900f264627cf456c4738792539b17117e474cb14304dfe50a
MD5 860311d5d1b059d6c38d6bace892fa84
SHA1 6d78ad265999cd521235b435e533190da0ef77c9
SHA512 636e39237ffb2c4335d7af935d18fbbcd2aad530507f0ddde5ce7ce31840e20bf0701eebea69566fc9dc90e2d08b80005d1162ea5acad801d94726bc57a7b6f1
SSDEEP 768:brv+4UNbd43SHkn5Cl0ef6Pf6MB0nXe75YIbIm3k4XWlImYFdTm4:bbsbm3Uf4f5WVM735WlIFFm4
TLSH
T1B603AF309964ED73DCF2A2CCB2477683BEF801A7C9844B44CAD65F4C469B59E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 464acdf976935f793852f0395520a22c268f9639dc27771e2afd93e03341cfcd
MD5 a5133ca24596f41c53ed27f41dc2da3e
SHA1 477a052d167163139d2793972e56fca9f01f0d4e
SHA512 8de104a562c3f218ae0e1cfbecd17ecf31c8f8e1ea03b0448497a919de2fa6d79e74d74b0a786fb8f0105fa161ed254490376425a066f8a170b29bb3c8c3972a
SSDEEP 768:Xj+9T3CHyn5Cl0ef6Pf6DB0nXe75YIbIm3k4XWlImYFdTb9MP:a9T3kf4fqWVM735WlIFFb+P
TLSH
T1C2F29E309D65EE738CE192DCB3473686FEF401B7C9881A449ADA9F0C069766D1B4682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ddf25c8d6f52c01301ea68dd573f29ae003daf50b6eb5f3de3f976dcc2ee8bf4
MD5 dcda5590cc0994ed38a7079104dd9b4c
SHA1 58f521906e3752abf1b09a81b0a93157db74ebbd
SHA512 a9946e95b090688b3b1c825a541c3334d4785506f3d3a35d5fe1a207eedeba0c57db107ad1e4d2e9411b25a7c915a3719a7541a8aabcd4556234efb211db3e16
SSDEEP 768:cF1j+923Qwg1Hy0ef6Pf6QB0nXe75YIbIm3k4XWlImYFdTb9MP:R9231f4flWVM735WlIFFb+P
TLSH
T1A3038E31DC64EE77ECF297D9B3067A86EEE001B7C9885AC4DADA5F0C01872AD0706C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 b45175d8d344923abbf1024c08ba7ce341dcb82cf8644d640690dc20f909677f
MD5 3e681ac09f8ff9ceadbbdb0a165d56a7
SHA1 80b30343e095267f58771bfcae9a07d8692e0913
SHA512 5fa3b96a11f429627d30941fb47ed03a72c1eff4c15bacfe2b2803c5477a78b4868ea9566c35187b01a552020bb61d90cb7ac4f4729912c76e2bd6d72eb80446
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3Z:CebAjOKn3wRKRJ3Z
TLSH
T133D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.old_1783592533

Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_a952835999199b44f522ff1da180631d_akira_glassworm_rusty-stealer.old_1783592533
Size 2.7MB
SHA256 91b724c736e56268b3bd134bc3b2d487ce180ac8bfcfd9dcac5c1d8a20f1ff58
MD5 949c20e8d03b32b4664dd6670f92d938
SHA1 2ab07194426f4ccd39eac402ffbc30a55704ef43
SHA512 e434d2955c06f74693705ae4f40d73b317d0dbb691de727716f0ce81a7a000b1f54103a0dbb43a40a225f79444c8e60e591774603db94e84ac492a2056742448
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ30:CebAjOKn3wRKRJ30
TLSH
T103D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6048_2131509607\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5556-252-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-273-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-256-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-325-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-342-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-291-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-366-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-235-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-383-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-389-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-404-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-199-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download

memory/5556-274-0x00007FF755030000-0x00007FF7552F1000-memory.dmp

Download