755732494a044d20bca7a9ab3261ca99cbdd7e0b2f688212a6388847b21fc380

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260710-agrsxact4w
SHA256 755732494a044d20bca7a9ab3261ca99cbdd7e0b2f688212a6388847b21fc380
MD5 4d7775192f9515493ecd88028a8f8500
SHA1 c45bfcb81004a756ef68f579bf27e2b685dfe6b2
SHA512 44a34261c6c98c9f15df5083b03b82bbbc9c3d4fcae98ef511a24c9859a779007fde9dd5a9c3e09756b7ae117527cd8db1219d056b0210ec788b5a4240e3c4d7
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3B:CebAjOKn3wRKRJ3B
TLSH
T164D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1709737878\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1348279318\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1348279318\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1082237670\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1709737878\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_404091667\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_404091667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_404091667\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_404091667\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1348279318\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1348279318\sets.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_236768041\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1082237670\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5380	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{D97F2619-1934-4379-A6A9-512EB1B82960}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1480	wmic.exe
1480	wmic.exe
1480	wmic.exe
1480	wmic.exe
612	msedge.exe
612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2396	2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1480	wmic.exe
Token: SeSecurityPrivilege	1480	wmic.exe
Token: SeTakeOwnershipPrivilege	1480	wmic.exe
Token: SeLoadDriverPrivilege	1480	wmic.exe
Token: SeSystemProfilePrivilege	1480	wmic.exe
Token: SeSystemtimePrivilege	1480	wmic.exe
Token: SeProfSingleProcessPrivilege	1480	wmic.exe
Token: SeIncBasePriorityPrivilege	1480	wmic.exe
Token: SeCreatePagefilePrivilege	1480	wmic.exe
Token: SeBackupPrivilege	1480	wmic.exe
Token: SeRestorePrivilege	1480	wmic.exe
Token: SeShutdownPrivilege	1480	wmic.exe
Token: SeDebugPrivilege	1480	wmic.exe
Token: SeSystemEnvironmentPrivilege	1480	wmic.exe
Token: SeRemoteShutdownPrivilege	1480	wmic.exe
Token: SeUndockPrivilege	1480	wmic.exe
Token: SeManageVolumePrivilege	1480	wmic.exe
Token: 33	1480	wmic.exe
Token: 34	1480	wmic.exe
Token: 35	1480	wmic.exe
Token: 36	1480	wmic.exe
Token: SeIncreaseQuotaPrivilege	1480	wmic.exe
Token: SeSecurityPrivilege	1480	wmic.exe
Token: SeTakeOwnershipPrivilege	1480	wmic.exe
Token: SeLoadDriverPrivilege	1480	wmic.exe
Token: SeSystemProfilePrivilege	1480	wmic.exe
Token: SeSystemtimePrivilege	1480	wmic.exe
Token: SeProfSingleProcessPrivilege	1480	wmic.exe
Token: SeIncBasePriorityPrivilege	1480	wmic.exe
Token: SeCreatePagefilePrivilege	1480	wmic.exe
Token: SeBackupPrivilege	1480	wmic.exe
Token: SeRestorePrivilege	1480	wmic.exe
Token: SeShutdownPrivilege	1480	wmic.exe
Token: SeDebugPrivilege	1480	wmic.exe
Token: SeSystemEnvironmentPrivilege	1480	wmic.exe
Token: SeRemoteShutdownPrivilege	1480	wmic.exe
Token: SeUndockPrivilege	1480	wmic.exe
Token: SeManageVolumePrivilege	1480	wmic.exe
Token: 33	1480	wmic.exe
Token: 34	1480	wmic.exe
Token: 35	1480	wmic.exe
Token: 36	1480	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5004	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3380	2396	2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe	86
PID 2396 wrote to memory of 5004	2396	2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe	88
PID 5004 wrote to memory of 2580	5004	msedge.exe	89
PID 5004 wrote to memory of 4784	5004	msedge.exe	90
PID 5004 wrote to memory of 5380	5004	msedge.exe	91
PID 5004 wrote to memory of 4784	5004	msedge.exe	90
PID 5004 wrote to memory of 4784	5004	msedge.exe	90
PID 5004 wrote to memory of 4964	5004	msedge.exe	92
PID 5004 wrote to memory of 4964	5004	msedge.exe	92
PID 5004 wrote to memory of 3596	5004	msedge.exe	93
PID 5004 wrote to memory of 3596	5004	msedge.exe	93
PID 5004 wrote to memory of 3596	5004	msedge.exe	93
PID 5004 wrote to memory of 1580	5004	msedge.exe	94
PID 5004 wrote to memory of 1580	5004	msedge.exe	94
PID 5004 wrote to memory of 1580	5004	msedge.exe	94
PID 5004 wrote to memory of 3000	5004	msedge.exe	96
PID 5004 wrote to memory of 4296	5004	msedge.exe	97
PID 5004 wrote to memory of 3000	5004	msedge.exe	96
PID 5004 wrote to memory of 3000	5004	msedge.exe	96
PID 5004 wrote to memory of 4296	5004	msedge.exe	97
PID 5004 wrote to memory of 4296	5004	msedge.exe	97
PID 5004 wrote to memory of 3240	5004	msedge.exe	98
PID 5004 wrote to memory of 3240	5004	msedge.exe	98
PID 5004 wrote to memory of 3240	5004	msedge.exe	98
PID 5004 wrote to memory of 3196	5004	msedge.exe	99
PID 5004 wrote to memory of 3196	5004	msedge.exe	99
PID 5004 wrote to memory of 3196	5004	msedge.exe	99
PID 5004 wrote to memory of 2424	5004	msedge.exe	100
PID 5004 wrote to memory of 2424	5004	msedge.exe	100
PID 5004 wrote to memory of 4648	5004	msedge.exe	102
PID 5004 wrote to memory of 4648	5004	msedge.exe	102
PID 5004 wrote to memory of 3460	5004	msedge.exe	103
PID 5004 wrote to memory of 3460	5004	msedge.exe	103
PID 5004 wrote to memory of 1064	5004	msedge.exe	105
PID 5004 wrote to memory of 4392	5004	msedge.exe	106
PID 5004 wrote to memory of 4392	5004	msedge.exe	106
PID 5004 wrote to memory of 3216	5004	msedge.exe	109
PID 5004 wrote to memory of 3216	5004	msedge.exe	109
PID 2396 wrote to memory of 1480	2396	2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe	110
PID 5004 wrote to memory of 4116	5004	msedge.exe	113
PID 5004 wrote to memory of 5372	5004	msedge.exe	114
PID 5004 wrote to memory of 5404	5004	msedge.exe	115
PID 2396 wrote to memory of 592	2396	2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe	116
PID 5004 wrote to memory of 5028	5004	msedge.exe	118
PID 5004 wrote to memory of 5028	5004	msedge.exe	118
PID 5004 wrote to memory of 5488	5004	msedge.exe	122
PID 5004 wrote to memory of 5488	5004	msedge.exe	122
PID 5004 wrote to memory of 1900	5004	msedge.exe	123
PID 5004 wrote to memory of 1900	5004	msedge.exe	123
PID 5004 wrote to memory of 1004	5004	msedge.exe	124
PID 5004 wrote to memory of 1004	5004	msedge.exe	124
PID 2396 wrote to memory of 5844	2396	2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe	125
PID 5004 wrote to memory of 612	5004	msedge.exe	127
PID 5004 wrote to memory of 4328	5004	msedge.exe	128
PID 5004 wrote to memory of 4328	5004	msedge.exe	128
PID 5004 wrote to memory of 1948	5004	msedge.exe	129
PID 5004 wrote to memory of 1948	5004	msedge.exe	129

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3380	attrib.exe
592	attrib.exe
5844	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.old_1783642287
  2⤵
  - Views/modifies file attributes
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fffd37dc188,0x7fffd37dc194,0x7fffd37dc1a0
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,17134065820287794262,180868575142202613,262144 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3119039575321623762,11119216228098630757,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,5166589102101474860,17406520434919601740,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17897248643097790785,13065935958333593855,2097152 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,10362803472918929957,11970922819239866084,2097152 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,7995414428982437408,16957302256593063246,2097152 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:9
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,17290050741342977856,2751177210662123142,2097152 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3688,i,13302704257994456046,930757347027355390,2097152 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:9
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5468,i,8270224455035211753,12254484467467392525,2097152 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:15
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,909022472015733554,4039750387164249319,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,17290088449245317373,3399453334172261838,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,3016998002330275738,12863157418714994841,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,17878210205403766978,7214449992986910615,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,17878210205403766978,7214449992986910615,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,12656235169332173681,16982136369052466734,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,13128674056928865226,13239507305917036721,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,1249898288293938543,15288587455383884126,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,7364245076972461026,6243452467603388417,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,5094579899389516808,1368785108112139548,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,7928425981364893121,3120648157248970123,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,7846488434005682271,3955011214377004538,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,3224234276445921412,3620872833497018874,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,6531403720474609342,14061655087518860840,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:14
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,11010603037448185033,6337541490577472189,262144 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,14611407073838002426,653764300080695188,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,11578945220492849926,1355041431784736458,524288 --field-trial-handle=2176,i,8066007345593427058,2356488576391989374,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:1948
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.old_1783642347
  2⤵
  - Views/modifies file attributes
  PID:592
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.old_1783642408
  2⤵
  - Views/modifies file attributes
  PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c658acd8de438ea8de47bf3fca835ab3cf801095c8ddd7f0ac0f25e45379057
MD5 863b22d2414d28e83c30d4f5b2595120
SHA1 442d53bcada0830e0e57ec766cbcc9e8813b75bb
SHA512 dc74019ae9e6d25a1a80524ed0499d74b696b2942c40911613f1655c6ccdb9ea9ad904437d35d5308487aefb9cd4f3ac48fe75ec2805ec46c6d8e1cfa299e0d0
TLSH
T1245130412BAB1BC2D76687F1DDEA08AA36F5C85561CF5E31005E6C336B02F2E5BE1523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fc77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fc77.TMP
Size 2KB
SHA256 901403f4da56be5f6f57108ee70bfe74b13306a2b5b50450f6cec4bccb03872f
MD5 d3e177eb53cf0744d7466781720ab8d3
SHA1 ecf03ed4e1e2443157f45194ab74d88585125133
SHA512 9b4a92c3f296a6ccc243ad2652d54cf2bfa0a7992b0a9e7737dedc17e846fa1199f7b24d065ee35e073832889919f3dd583c8019bd4a5cb59560a60d0bd30061
TLSH
T109513E512BAB5BD2C72687F1DDEA046A36F0C84961CF5E30404E6C336B02F2E5BD1023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5cf98e42dc8937e8b8a1d2310c71f5706dc0c158beeb9d30b128d395d399486e
MD5 06519590f8c41113e07587f11fff4a9b
SHA1 2dc03ddbfa4615fafdab4b152424528e72c6f195
SHA512 1d5659cd407e27aa7f3a9738e01dbdc473d6b4ff24e0d9accb2a4820aa88e7f8e42d8b4eb53ddfe1363a9d7433417fcc638e5a68a69102ad86ed3731af5d5d8b
TLSH
T1FF51EFF3C3E4866ED90156F0AA187E2BCE1D0A15832C3D5AC9E4EF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2e7f8786d0e4237b39c376eb4d9367651a7bd9c9e1f1bc9490e3d636975c6976
MD5 a2650351d6e8d0a27986f7c4dc85913c
SHA1 22829e7baa1f12595a8bc7a7422db6aaa88a773e
SHA512 14c012f9bd128fd345a507dc8031df89b77c74054bb6c52c71a8efa042a9e1804ad0b2f1664f7e5dd9f371bc7d6f6733978d5d285cedbeb88e88c44fa7277e04
SSDEEP 192:sxR1RjyM/jK1Ml8wCU/fXsP4dwZza5zoA8p4m/g6+WNIYo2OwhCYEGRIgtJ:sxR1j8U/fXsQdulP/5I2OL23
TLSH
T15262FA156A245937DCDBD20DFA41BF93D6F81533A2901E44ABFCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b305860f4fd2161bd1923682d23c3f1befe6f553b06c94d295733391b474c3a0
MD5 92e0c19a0b0a9af4bda1a0297bb155be
SHA1 d1db5232e7371e7f95279632d908af87e099ec31
SHA512 de1ef16443337454acfaf34539d8f0badf2856e39e84b5b48eee1b04a6a82ff2f9e88dbab00340f3aaef8826f4b1d0a87bf8ed837713dedd58aef936d359674f
SSDEEP 192:sxRKRjyM/jK1Ml8UQjCU/fXsL4dwZza5zoA8pem/g6+WNIYomOwhCYEGRIgDXJ:sxRKjqmU/fXskdul5/5ImOL2F
TLSH
T19162E9166A245937DCDBD20DFA41BF93D6F81533A2901E44ABFCCA1C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8c997724b66e00a85a8f544ae4599cdf30c583b03d45e03554a4c99278517b42
MD5 efc3072e58b08b76eb265847016394f0
SHA1 be57cd93211c1ad98e92e94c2367cb914d04209a
SHA512 308939d81c100c1fdd43afc3e33883b36d6b07e7a326f55775e61c51799324cc6c42648b09922635503bebc82b20d170a4ca9cdddec8d9a69840de10254cac8c
SSDEEP 192:sxRKRjyM/jK1Ml8wCU/fXsL4dwZza5zoA8p4m/g6+WNIYo2OwhCYEGRIgDXJ:sxRKj8U/fXskdulP/5I2OL2F
TLSH
T1F562E9156A245937DCDBD20DFA41BF93D6F81533A2901E44ABFC9A1C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b9986078461a98059ca4f499550cf3353937b216b0a9fcdf99c96044df0c8904
MD5 addc2b56c8a4f0b93338af53282ef829
SHA1 27fed162a280967c950828ab1ba9d09a580b4c94
SHA512 d81f2795aeba7364ca23ca5fe9e2695d68c3932d2b63e947476737bfc7294a9da6cb412a5cf29f1cbb4e7db7258fe1841bc104160916bbd6491baf8930555aa9
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVtnpVuG9rock6id:jXwHnUE7gRWgs2fJ2u1jamnp4G2d2C
TLSH
T18BE2FC3B680CCBBE4F404ADDEC29BD9E6DA801CB96D88D5447FA840C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a80ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a80ca.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 56c53cd1eeca8b64dcddc317e062b3a104af36e7d6b47c5c65bc5ed8cce5872e
MD5 c599f31bc41ca7eec9cf4f28baa7fab4
SHA1 e6b257ea853db868053fe2f21fc0eb770918467f
SHA512 3f989ca8661c68668107433a5040fbdb0c906ae600192fd54fc1edf5b3f93c6c6dbd6ab512283f55ceddf08f37372fd3899814f4b3b9992ca2cbafc3d1649790
SSDEEP 768:drv+4UNbd43ABR8/TBOWGatDtiONXyer1IRCzni9peVH1SK3:dbsb63AomSIqnaEH1R
TLSH
T1DE13AE31A4A8DE338DE6A396B14777537FF8206785840B50EEE61F4E068799E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8f39d14bb539bee93efb9cd6c641d8fe93dd4fa4433a38e40cc0a12e7417a245
MD5 3ddb387ec552c32b3245f7b47f0b26a9
SHA1 33c021b2911b50af8e9f4efc6c927ea6dd200437
SHA512 29ff56c7bed016587717983d5b3bd2748ae4cbe6ebac543a589c8bd47ef4ae78491e3960c58b8da6b90600da702352f74448989dc0973a0c76275b7f45dd44ab
SSDEEP 768:uj+9e3HBR8/TBOWGatDtiONXyer1IRCzni9pb9MK:N9e3HomSIqnab+K
TLSH
T13CF2AE31E4669E234CE2A3D6B2072B97BFF42067C5C41E44EEEA5F4E0583A5D170B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ad93e2c7f0a143a342b8b34c0a7f19d1014b205b43a7dfaa37826c12796e29b0
MD5 0608f59ad7d82f5f6d229cdbc9bf7cae
SHA1 4c9ac1682493e144687206be499e4154c9a9aa16
SHA512 ddba189b3b9601887ec123823fc2502d69faa15dd1caf0e9d059f8be808e2d3d2843a090fbbf6d269a96bf01f056906591352379e6c68604b733451da697b7c0
SSDEEP 768:hrv+4UNbdz3Du/TBOWGa9ONXyer1IRCzniB3eVH1SK7:hbsbV3qNSIqnEEH1l
TLSH
T10803BF36A4A89E338DE2A3C6B14776037FF86057D6840B90EDDE2F4E069B59D130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d629521416dbef01e7e7b7f86eae485cfe55d274cdaf28c2aab32951bd5778af
MD5 c172c849c5c2cf638a109766cddf6686
SHA1 f0ff64e04e3c7d284745a5d861a7f4b632540470
SHA512 667d71772139d1b13126f25358bfe20028155c350ab4b0a8d995bb56a073b1097336593e26e716e0e2a0ebcec823396f8421629b724e5f479c332a9b735653c2
SSDEEP 768:xrv+4UNbdn3tBY8/TBOWGatDtxONXyer1IRCzni9peVH1SK3:xbsbx3tF1SIqnaEH1R
TLSH
T1F513BF31A4A8DE338DE6A396B14777937FB82067C5840B90EDE61F4E068799E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dd70fab8e5fb448b98c57c164fb99a101d33839311c0cc92e49560dbc09dcbee
MD5 963199248cf98bd99d76b331725aa80c
SHA1 6774c27a375d651cd878c5256fc8c9defca06648
SHA512 0d65497f29d9d004074f5f68e99cb669605c826b6d521be9bf2c4c5c166058064a8ad1f43629fe859496a0b22527b8a5d7537aace475a2caf6e5e4f8923a13ac
SSDEEP 768:+F1j+9e3GwgOBRvcsOWGatDtFONXyer1IRCzni9pb9MK:79e3xLnSIqnab+K
TLSH
T12D038C36D895CE279CE297D6B30A3B97EEF410A7C5C89AD4EED95F4D00C369D030A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

7b1032ea-b814-494d-b4f5-6b640d87c160.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7b1032ea-b814-494d-b4f5-6b640d87c160.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 651a2a55e891abdda19f53abed72434f77341791bdded9e2b6292d7721d05322
MD5 4714da7cd7aa188a58585c6cc14e0584
SHA1 6650fed849a29b4d9b194ce22e3cb97be00f6c1c
SHA512 b39bacb2c89c99ff166f73cb4abb5c5eaffe344a54859421ea66fa8c837f107f0fdc80fb046f387c46b6eca25c5ed4fe1fe3a97f019a2387bc3b9e5651b92ac1
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ39:CebAjOKn3wRKRJ39
TLSH
T168D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.old_1783642347

Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_4d7775192f9515493ecd88028a8f8500_akira_glassworm_rusty-stealer.old_1783642347
Size 2.7MB
SHA256 7be997e3646763f0ceb0d1d0abd3573d0497d5eeb87bf2492204d8a5413b18ec
MD5 5a30e2267155567b5931be49b8e139c8
SHA1 1fe49ec71cb7d888c2197590491ab988e9f6ded5
SHA512 962ac7f90b2930e83597c39aa5a6976b15940a4ec5d8b55e1f18d7b6ce734775fd81d66637aa7e780fadd3499b3302bdcef9e146eb37c597cba863c9c62b7c51
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3x:CebAjOKn3wRKRJ3x
TLSH
T1A2D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5004_413365824\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2396-227-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-323-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-191-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-348-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-297-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-365-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-373-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-271-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-395-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-410-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-246-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-280-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download

memory/2396-435-0x00007FF62B060000-0x00007FF62B321000-memory.dmp

Download