19699d011920912696af79963618ec8578d28d6a9fd85628718ea2a962e20980

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260712-r66rssdz9v
SHA256 19699d011920912696af79963618ec8578d28d6a9fd85628718ea2a962e20980
MD5 03394497693be0b18de9350db3418ead
SHA1 68828dd16230367e340082a87f02dfc90d6ecb2b
SHA512 dbe790651f2a48a42c2f1b05545996f7029d3ca3b8edc292f0340a3acd361f36032bb2c919632f1b167c32d31bad7c7cb870fae6a4d9c3e231d6028e14304e59
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3A:CebAjOKn3wRKRJ3A
TLSH
T120D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1247155746\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_698534013\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_698534013\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3176	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283413732706665"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{35A6706B-4704-471D-A4B2-060A521C0832}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2168	wmic.exe
2168	wmic.exe
2168	wmic.exe
2168	wmic.exe
1264	msedge.exe
1264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2164	2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2168	wmic.exe
Token: SeSecurityPrivilege	2168	wmic.exe
Token: SeTakeOwnershipPrivilege	2168	wmic.exe
Token: SeLoadDriverPrivilege	2168	wmic.exe
Token: SeSystemProfilePrivilege	2168	wmic.exe
Token: SeSystemtimePrivilege	2168	wmic.exe
Token: SeProfSingleProcessPrivilege	2168	wmic.exe
Token: SeIncBasePriorityPrivilege	2168	wmic.exe
Token: SeCreatePagefilePrivilege	2168	wmic.exe
Token: SeBackupPrivilege	2168	wmic.exe
Token: SeRestorePrivilege	2168	wmic.exe
Token: SeShutdownPrivilege	2168	wmic.exe
Token: SeDebugPrivilege	2168	wmic.exe
Token: SeSystemEnvironmentPrivilege	2168	wmic.exe
Token: SeRemoteShutdownPrivilege	2168	wmic.exe
Token: SeUndockPrivilege	2168	wmic.exe
Token: SeManageVolumePrivilege	2168	wmic.exe
Token: 33	2168	wmic.exe
Token: 34	2168	wmic.exe
Token: 35	2168	wmic.exe
Token: 36	2168	wmic.exe
Token: SeIncreaseQuotaPrivilege	2168	wmic.exe
Token: SeSecurityPrivilege	2168	wmic.exe
Token: SeTakeOwnershipPrivilege	2168	wmic.exe
Token: SeLoadDriverPrivilege	2168	wmic.exe
Token: SeSystemProfilePrivilege	2168	wmic.exe
Token: SeSystemtimePrivilege	2168	wmic.exe
Token: SeProfSingleProcessPrivilege	2168	wmic.exe
Token: SeIncBasePriorityPrivilege	2168	wmic.exe
Token: SeCreatePagefilePrivilege	2168	wmic.exe
Token: SeBackupPrivilege	2168	wmic.exe
Token: SeRestorePrivilege	2168	wmic.exe
Token: SeShutdownPrivilege	2168	wmic.exe
Token: SeDebugPrivilege	2168	wmic.exe
Token: SeSystemEnvironmentPrivilege	2168	wmic.exe
Token: SeRemoteShutdownPrivilege	2168	wmic.exe
Token: SeUndockPrivilege	2168	wmic.exe
Token: SeManageVolumePrivilege	2168	wmic.exe
Token: 33	2168	wmic.exe
Token: 34	2168	wmic.exe
Token: 35	2168	wmic.exe
Token: 36	2168	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6056	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2052	2164	2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe	87
PID 2164 wrote to memory of 6056	2164	2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe	89
PID 6056 wrote to memory of 4972	6056	msedge.exe	90
PID 6056 wrote to memory of 2364	6056	msedge.exe	92
PID 6056 wrote to memory of 3176	6056	msedge.exe	91
PID 6056 wrote to memory of 2364	6056	msedge.exe	92
PID 6056 wrote to memory of 2364	6056	msedge.exe	92
PID 6056 wrote to memory of 2564	6056	msedge.exe	93
PID 6056 wrote to memory of 2564	6056	msedge.exe	93
PID 6056 wrote to memory of 1096	6056	msedge.exe	113
PID 6056 wrote to memory of 1096	6056	msedge.exe	113
PID 6056 wrote to memory of 1096	6056	msedge.exe	113
PID 6056 wrote to memory of 1316	6056	msedge.exe	96
PID 6056 wrote to memory of 1316	6056	msedge.exe	96
PID 6056 wrote to memory of 1316	6056	msedge.exe	96
PID 6056 wrote to memory of 4536	6056	msedge.exe	97
PID 6056 wrote to memory of 2888	6056	msedge.exe	98
PID 6056 wrote to memory of 4536	6056	msedge.exe	97
PID 6056 wrote to memory of 4536	6056	msedge.exe	97
PID 6056 wrote to memory of 2888	6056	msedge.exe	98
PID 6056 wrote to memory of 2888	6056	msedge.exe	98
PID 6056 wrote to memory of 4780	6056	msedge.exe	99
PID 6056 wrote to memory of 4780	6056	msedge.exe	99
PID 6056 wrote to memory of 4780	6056	msedge.exe	99
PID 6056 wrote to memory of 2592	6056	msedge.exe	100
PID 6056 wrote to memory of 2592	6056	msedge.exe	100
PID 6056 wrote to memory of 2592	6056	msedge.exe	100
PID 6056 wrote to memory of 2444	6056	msedge.exe	101
PID 6056 wrote to memory of 2444	6056	msedge.exe	101
PID 6056 wrote to memory of 932	6056	msedge.exe	103
PID 6056 wrote to memory of 2336	6056	msedge.exe	104
PID 6056 wrote to memory of 932	6056	msedge.exe	103
PID 6056 wrote to memory of 2336	6056	msedge.exe	104
PID 6056 wrote to memory of 1080	6056	msedge.exe	106
PID 6056 wrote to memory of 3052	6056	msedge.exe	107
PID 6056 wrote to memory of 3052	6056	msedge.exe	107
PID 2164 wrote to memory of 2168	2164	2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe	110
PID 6056 wrote to memory of 1096	6056	msedge.exe	113
PID 6056 wrote to memory of 1096	6056	msedge.exe	113
PID 6056 wrote to memory of 2956	6056	msedge.exe	115
PID 6056 wrote to memory of 1360	6056	msedge.exe	116
PID 6056 wrote to memory of 5440	6056	msedge.exe	117
PID 2164 wrote to memory of 2472	2164	2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe	118
PID 6056 wrote to memory of 3832	6056	msedge.exe	120
PID 6056 wrote to memory of 3832	6056	msedge.exe	120
PID 6056 wrote to memory of 1124	6056	msedge.exe	124
PID 6056 wrote to memory of 1124	6056	msedge.exe	124
PID 2164 wrote to memory of 2360	2164	2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe	125
PID 6056 wrote to memory of 1264	6056	msedge.exe	127
PID 6056 wrote to memory of 5872	6056	msedge.exe	128
PID 6056 wrote to memory of 5872	6056	msedge.exe	128

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2052	attrib.exe
2472	attrib.exe
2360	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.old_1783867767
  2⤵
  - Views/modifies file attributes
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffebce2c188,0x7ffebce2c194,0x7ffebce2c1a0
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,9981348051192437356,3963134929447458257,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,1551448684933865901,468143521966527728,262144 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:2
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,13774660651622200936,606607117802188360,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,17820412010499897423,11115816521091753770,2097152 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,6596300423476878850,9698845352047838137,2097152 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,10340370207478426647,5351455884491894011,2097152 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,3899130114980276071,10034081703267843256,2097152 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5396,i,10744771886358757486,962953871985413311,2097152 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:9
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3784,i,6088328482194966698,9329192008316357810,2097152 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:15
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1023053507761708784,12491427697746139513,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,277579586832743951,8105355736237683843,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13915073354974714700,14406864841109436589,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1545563287885796475,6454501509152367360,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1545563287885796475,6454501509152367360,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,10222442403780583856,7829851199184628556,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,5345921536898764867,17800637547681030242,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,16061032462408165703,14023478550720097446,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,81524259278372630,8609852366226172955,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,14306970782026243217,5438422777979105246,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,12685291913379235720,8084317260969145329,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:14
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,765437546188567882,14471851765829097137,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6628,i,12226011177938612485,9347293486077533842,262144 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,18020201799491275615,14290099089864253693,524288 --field-trial-handle=2688,i,13141829542745645023,1528388033448435545,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:5872
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.old_1783867827
  2⤵
  - Views/modifies file attributes
  PID:2472
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.old_1783867888
  2⤵
  - Views/modifies file attributes
  PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

85c8b8cc-dc57-4e38-bfa6-f146f62fbccc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85c8b8cc-dc57-4e38-bfa6-f146f62fbccc.tmp
Size 38KB
SHA256 35b22a8c863d9f2df7b51cfe2f26cd3fcf55d522a7f374344e6a6e8e9f70735f
MD5 5a27b5d3f3f1664a5bdee01b6be681d4
SHA1 b05648fd216273004614f07862a7b1a53f6626be
SHA512 98830911db304ffd8865025e04ae1fddead9a5740a024e76a9a7927cf7f5f432cbd9ab16a97931798c73f14df1ebc955d1f0c3873e895ad77f39a8383a2d8b37
SSDEEP 768:Rrv+4UNbd43jskc+wfZOcfV66LvShCQtmy2bwWV:RbsbO3jhwfffc6LvSr0wO
TLSH
T10A03C072E86899339EE782487646BB637EB85273C8C54784D6CD4B0D019369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6b8224d5b634db6e411005a43efd9440a80815dd098c6f2aab4264f6139169b1
MD5 d7672dd986cb00a1e5a181ef431d3b3e
SHA1 aec43082798549545e45689ed51df20a31275008
SHA512 326d7f5aa97c873b60f292aa4670007b55864ac38d5188a80f87903ce92ce8225d7625922fbb49731cd9eff21826c0494f24ba294edf46dd6776009305b5ebe3
TLSH
T1D2510AD0C32324E3DB6DC57769E18578B2F7859D82039A11681E5EF9C90AF28E0D1F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59af70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59af70.TMP
Size 2KB
SHA256 f92d03c2bd7a57a7d7743fd9a808d88d0cadb46a7f975365f8c1b76d43a4d87d
MD5 54f82e64c09d5f2535e549d89c1bef1f
SHA1 a2931de5c98e83d16de106bb9bf7e750d9766b25
SHA512 042251bacafaa15e7712e67db0a25717ae6bf3e71ba4c33c369051d8a300fcd8fb76a46073e3848b86be758bcb5f17d1e31be1562d6c0cd04cebe029ce5ee626
TLSH
T10251D6D4C32718A3DB6DD47369E195B8F2F6859D82438A10681E5EF5C90AF28E0C1F63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02faa7640135b28dad7dff1ab6aa902c1bbbc3c7a4c063281e10748cfccab54d
MD5 9bc7468c50ae6834623773ac54a18217
SHA1 45b6de89a6e3328cde8fbfbbab21eb8c917a2b67
SHA512 aa6ad5ec16086e82dd73b3aa91fa8959a16ef719858631d6368b24336732e2921e1c275e29f8e7cda5892c660fe38b2158ebca96ffe83fdd5ad711533df2abb4
TLSH
T1C441BCF3C3E8856E890156F0AA187E2BCE1D0914832C3D9AC9E4EF1B93F2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 586c650b529cd41413539ebb6f696a08f4461d161d2be93359728a185f938f85
MD5 09c1d93e2fc1c80df954946a7b869ed0
SHA1 eb2a99fdf3d67b4c1161b7566670242823840dc5
SHA512 9e491bd8aebed91949d349280e7cb30f2060d0cc66eb66668a4e1276654b4a29c9b15e051c57a2942d22243d35935c91780980b011797c05075fcd5045dde842
SSDEEP 192:sxRSRQyM/jK1Ml8wCI/ftsItTt2wZXszoD8p4JY/g6+WNIY3B2OwquGQIgtJ:sxRS28I/ftsGcuU4Y/5IA2Ou3
TLSH
T1B362C9156A28597BDCDBD209F951BF93D6F91573A2901E44AAFCCB0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 381bf31fae6f5ce7d74a5685bd0a0be692ce5f726369d12e72751b1f7f4c4213
MD5 94e31b59664b90f3b728b032a9cef99e
SHA1 9bd944c42bfa5589fa44b96ced87e80610033087
SHA512 dc1cde90ac873ee4bbc2b94d2ba9388f73675fc6a795121819ef5094c49be63cb95992617d5ba970f7c17a46223cb361d3c92a090eee643ac23b9af1dcee08b6
SSDEEP 192:sxRBRQyM/jK1Ml8UQZCI/ftsctTQ2wZXszoD8peJY/g6+WNIY3XOwquGQIgDUJ:sxRB2qgI/ftsqFuU2Y/5I4Ou0
TLSH
T1C862CA16AA285977DCDBD20DF551BF93D6F91573A1901E44AAFCCB0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e52adcc358abf45e8ad03108322560f153a1bf29b8677eb60c7069c61f7c0203
MD5 e255a35681b9a35d08c7bc00130693e2
SHA1 cf7302751ef2ead6ff85f2a2761737dbf568ac3a
SHA512 4b243c819c13abafd0a0d219bd0a18fac268d4982383e9261e4b53b0d52060342f743bcc974638bf21fb2ec54104a6cd6fbdfb58cab67ee301f5591375a19506
SSDEEP 192:sxRBRQyM/jK1Ml8wCI/ftsctTt2wZXszoD8p4JY/g6+WNIY3B2OwquGQIgDiJ:sxRB28I/ftsqcuU4Y/5IA2Ouq
TLSH
T14162CB156A385977DCDBD209F951BF93D6F91573A2901E44AAFCCB0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f12e7a79bd1c60c51ae8060feac466895ab9a9ae2f09d858e9e25a119c6564a4
MD5 5e30de94751a79309585c62ec8a9307a
SHA1 0053938552da18fab5c45c53304404881d4af1d5
SHA512 0c4c69bfbe82bc5fbcd1c53530c1cab401a2e00488afff0af2e3a24b050accd9929645686fea19fb1318eb3f4430313701693cb7f0bfec5e986d00f6ba4f237e
SSDEEP 768:Giqbbo7pLuL7hkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyLoMW6mro4mih:GiqbbUE7hkWg0CfDsu1jalLoF6d4ph
TLSH
T1C8E2FC3B680CCB7E4F804A9CEC29BEDB6DA801CB5698C95447EA881C03C67FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d18fa2ad-36f6-4bed-836a-6c1674942b29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d18fa2ad-36f6-4bed-836a-6c1674942b29.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 66985edaab703e62fc68a11e0458d0f78541195977ca3a76de155383a4df78a4
MD5 068393be19b7d242e5508ac1afec8435
SHA1 f470c394bfb570d51c8d58f24184e1448f84159c
SHA512 cada4b78421f3daa8334c86596bcd2910c6b7cdf29fe2ac746abeee6f8dce6747e944f389fb30f2ea34431aa347eea93ad6bed6c05640b622b056ebe6c9e700d
SSDEEP 768:Gj+9A3dtKc+wfZOcfV66cf0668vShCQRXb9M/5:V9A3Uwfffc6cf368vSrb+/5
TLSH
T1D0F2BE71EC751E738EE28B98764A7F52BEE55223C1C81A88DADD5F0C01C36AD2717825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a651fb07b3171069abfdd87c51f0f38a4b1ccf276f996ded377916553184a73b
MD5 3bcf8b4dcee4169988254162351d91a0
SHA1 6ff54e3fa44765ddf474d2f3daf41f84d3c1f4b8
SHA512 b5f2d6b25e66f65023d0d65cedc01a689c7f22a5de6b676e1c46cf99cb5d26a16c5478c1d93dd83636a177f9222bf24f29057d5be435cfebdefc833319c75f3e
SSDEEP 768:Frv+4UNbdx3duKc+wfZOcfV66cf066TvShCQRXb9M/N:FbsbT3Lwfffc6cf36TvSrb+/N
TLSH
T12A13CF71EC385A739EF28A58764A7F53BFA55223C5C90684DADD5B0C02C35EE231B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2d0c5174b1eb2a2108959fc59f34ba280eca54e2ec02d9b826887e0b59875ae1
MD5 fa180efd91c9926370e81e3f064635f4
SHA1 9a5212569ef68d8400f9f8a2211ec46b95191509
SHA512 dea0d17f8ce08ffa05092d0fa58e433cc2cae2d2f99d3282370c30c54fcb4e9d193743c11b4a77ded75b1a83800e8b07194437481dd25d6be956ae8a9c4b9ffe
SSDEEP 768:8F1j+9f3JwgIteAtfZOcfV66cf066bvShCQRXb9M/5:x9f3afffc6cf36bvSrb+/5
TLSH
T1D9038D76DC649A77AEE28BD5B70A7B46EED15263C5C899C8DACD5E0C00C32ED130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 60f8506705cb663ea38671d716d841242de2a280a73ac12a52020facf37b6df4
MD5 f2c029aa8c8adf04addf6768a15ae33f
SHA1 85c4949601163aa7459509d2ba43b37de6886969
SHA512 5c65c69e66d4b4c358b1d1ee579b5609f21e6f905859ec6970730ed07e489f48010c5711e58d0a6792f085b1a6394010c4e8cb365f1bce110f9c6202e66275f3
SSDEEP 768:Gj+9A32tKc+wfZOcfV66cf0668vShCQRXb9M/5:V9A3Nwfffc6cf368vSrb+/5
TLSH
T16BF2BE71EC751E738EE28B98774A7F52BEE55227C1C81A88DADD5F0C01C36AD2317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 7a181a5481330e1342fa37c2bed83e0e8e4feaae214fbd3b841e2e90c93f8c12
MD5 63c076a3407bd6d5e966ca68c68030e8
SHA1 3dd4d2f57f7acf09af51770ad8e8a2c0601dac58
SHA512 b803d61d19930e3ef2ed27b1018d3f8a47c2c81515c828d57282442a1b53693935930ff08f8d7b1dc804d84bf83801aa32aa2968e8012324143eb0c2945bf799
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3h:CebAjOKn3wRKRJ3h
TLSH
T11DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.old_1783867827

Path C:\Users\Admin\AppData\Local\Temp\2026-07-12_03394497693be0b18de9350db3418ead_akira_glassworm_rusty-stealer.old_1783867827
Size 2.7MB
SHA256 39128a9358e81f99bd860f939c55629f85551027264e1daf5a57a7e6be9b3e30
MD5 dc7411723343d0b46290e25063c4dd55
SHA1 089d274a8bd241a650c450a0426725c681161d33
SHA512 979c41e9796d66110da0b1adc4cfe988e9ee66913b6c7aafab83c04b8e518f7b3f6bf5cda741b3cef3fabcd44a06bee92a218ca49e392b338751e053cf09e786
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3e:CebAjOKn3wRKRJ3e
TLSH
T15DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6056_1441990244\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2164-278-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-292-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-257-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-252-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-314-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-324-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-337-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-235-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-354-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-362-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download

memory/2164-211-0x00007FF6B2F10000-0x00007FF6B31D1000-memory.dmp

Download