6ce25925a2015c6c39d53c1ab63ca18608ff01c21f089192f39489d84da4afd5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260715-nmacpsaz7q
SHA256 6ce25925a2015c6c39d53c1ab63ca18608ff01c21f089192f39489d84da4afd5
MD5 b4c7ae29eb47a622651ce49397dfb6d9
SHA1 675311d442082e8a310fc135c81bf31b76c0bd64
SHA512 58da9a6b0671e7b9b6afb9952c819bba424be1e68b2dc352b650d0766238bec194dd1d2c919f16610df9dda887eb695cb8242fef276821cae2780575f89267af
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3C:CebAjOKn3wRKRJ3C
TLSH
T11ED57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_1067949220\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_833056166\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_959680989\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_959680989\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_1033370006\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_1033370006\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_833056166\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_1033370006\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_1033370006\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4664	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285886312808913"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{8D72A51F-E630-4D21-A105-35434BC41137}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4480	wmic.exe
4480	wmic.exe
4480	wmic.exe
4480	wmic.exe
5320	msedge.exe
5320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
708	2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4480	wmic.exe
Token: SeSecurityPrivilege	4480	wmic.exe
Token: SeTakeOwnershipPrivilege	4480	wmic.exe
Token: SeLoadDriverPrivilege	4480	wmic.exe
Token: SeSystemProfilePrivilege	4480	wmic.exe
Token: SeSystemtimePrivilege	4480	wmic.exe
Token: SeProfSingleProcessPrivilege	4480	wmic.exe
Token: SeIncBasePriorityPrivilege	4480	wmic.exe
Token: SeCreatePagefilePrivilege	4480	wmic.exe
Token: SeBackupPrivilege	4480	wmic.exe
Token: SeRestorePrivilege	4480	wmic.exe
Token: SeShutdownPrivilege	4480	wmic.exe
Token: SeDebugPrivilege	4480	wmic.exe
Token: SeSystemEnvironmentPrivilege	4480	wmic.exe
Token: SeRemoteShutdownPrivilege	4480	wmic.exe
Token: SeUndockPrivilege	4480	wmic.exe
Token: SeManageVolumePrivilege	4480	wmic.exe
Token: 33	4480	wmic.exe
Token: 34	4480	wmic.exe
Token: 35	4480	wmic.exe
Token: 36	4480	wmic.exe
Token: SeIncreaseQuotaPrivilege	4480	wmic.exe
Token: SeSecurityPrivilege	4480	wmic.exe
Token: SeTakeOwnershipPrivilege	4480	wmic.exe
Token: SeLoadDriverPrivilege	4480	wmic.exe
Token: SeSystemProfilePrivilege	4480	wmic.exe
Token: SeSystemtimePrivilege	4480	wmic.exe
Token: SeProfSingleProcessPrivilege	4480	wmic.exe
Token: SeIncBasePriorityPrivilege	4480	wmic.exe
Token: SeCreatePagefilePrivilege	4480	wmic.exe
Token: SeBackupPrivilege	4480	wmic.exe
Token: SeRestorePrivilege	4480	wmic.exe
Token: SeShutdownPrivilege	4480	wmic.exe
Token: SeDebugPrivilege	4480	wmic.exe
Token: SeSystemEnvironmentPrivilege	4480	wmic.exe
Token: SeRemoteShutdownPrivilege	4480	wmic.exe
Token: SeUndockPrivilege	4480	wmic.exe
Token: SeManageVolumePrivilege	4480	wmic.exe
Token: 33	4480	wmic.exe
Token: 34	4480	wmic.exe
Token: 35	4480	wmic.exe
Token: 36	4480	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3756	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 1820	708	2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe	87
PID 708 wrote to memory of 3756	708	2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe	89
PID 3756 wrote to memory of 700	3756	msedge.exe	90
PID 3756 wrote to memory of 4664	3756	msedge.exe	91
PID 3756 wrote to memory of 1412	3756	msedge.exe	92
PID 3756 wrote to memory of 1412	3756	msedge.exe	92
PID 3756 wrote to memory of 1412	3756	msedge.exe	92
PID 3756 wrote to memory of 2164	3756	msedge.exe	93
PID 3756 wrote to memory of 2164	3756	msedge.exe	93
PID 3756 wrote to memory of 4560	3756	msedge.exe	95
PID 3756 wrote to memory of 4560	3756	msedge.exe	95
PID 3756 wrote to memory of 4560	3756	msedge.exe	95
PID 3756 wrote to memory of 1928	3756	msedge.exe	96
PID 3756 wrote to memory of 1928	3756	msedge.exe	96
PID 3756 wrote to memory of 1928	3756	msedge.exe	96
PID 3756 wrote to memory of 5468	3756	msedge.exe	97
PID 3756 wrote to memory of 5468	3756	msedge.exe	97
PID 3756 wrote to memory of 5468	3756	msedge.exe	97
PID 3756 wrote to memory of 4532	3756	msedge.exe	98
PID 3756 wrote to memory of 4532	3756	msedge.exe	98
PID 3756 wrote to memory of 4532	3756	msedge.exe	98
PID 3756 wrote to memory of 4240	3756	msedge.exe	99
PID 3756 wrote to memory of 4240	3756	msedge.exe	99
PID 3756 wrote to memory of 4240	3756	msedge.exe	99
PID 3756 wrote to memory of 1204	3756	msedge.exe	100
PID 3756 wrote to memory of 1204	3756	msedge.exe	100
PID 3756 wrote to memory of 1204	3756	msedge.exe	100
PID 3756 wrote to memory of 3920	3756	msedge.exe	101
PID 3756 wrote to memory of 3920	3756	msedge.exe	101
PID 3756 wrote to memory of 2668	3756	msedge.exe	103
PID 3756 wrote to memory of 3232	3756	msedge.exe	104
PID 3756 wrote to memory of 2668	3756	msedge.exe	103
PID 3756 wrote to memory of 3232	3756	msedge.exe	104
PID 3756 wrote to memory of 5972	3756	msedge.exe	106
PID 3756 wrote to memory of 2448	3756	msedge.exe	107
PID 3756 wrote to memory of 2448	3756	msedge.exe	107
PID 3756 wrote to memory of 2256	3756	msedge.exe	108
PID 3756 wrote to memory of 2256	3756	msedge.exe	108
PID 708 wrote to memory of 4480	708	2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe	111
PID 3756 wrote to memory of 3752	3756	msedge.exe	115
PID 3756 wrote to memory of 944	3756	msedge.exe	116
PID 3756 wrote to memory of 1248	3756	msedge.exe	117
PID 708 wrote to memory of 2644	708	2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe	118
PID 3756 wrote to memory of 5432	3756	msedge.exe	120
PID 3756 wrote to memory of 5432	3756	msedge.exe	120
PID 3756 wrote to memory of 264	3756	msedge.exe	124
PID 3756 wrote to memory of 264	3756	msedge.exe	124
PID 3756 wrote to memory of 5152	3756	msedge.exe	125
PID 3756 wrote to memory of 5152	3756	msedge.exe	125
PID 3756 wrote to memory of 1632	3756	msedge.exe	126
PID 3756 wrote to memory of 1632	3756	msedge.exe	126
PID 708 wrote to memory of 3900	708	2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe	127
PID 3756 wrote to memory of 5320	3756	msedge.exe	129
PID 3756 wrote to memory of 120	3756	msedge.exe	130
PID 3756 wrote to memory of 120	3756	msedge.exe	130

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2644	attrib.exe
3900	attrib.exe
1820	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.old_1784115026
  2⤵
  - Views/modifies file attributes
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffd60fdc188,0x7ffd60fdc194,0x7ffd60fdc1a0
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,18379513733303473832,12307535094000841559,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,17501046568225004053,13654098578853005253,262144 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,4053701643682832512,7434809710281134194,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,11712183952384214622,12224853884950773312,2097152 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,10416827176089020242,5593188376943296520,2097152 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,5898165774149980773,18083299142191372667,2097152 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,2060275908381387642,6341831455816477923,2097152 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:9
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5352,i,11101062105900389357,17780184827600495285,2097152 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:9
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5444,i,9766395609513474598,2223659292355366245,2097152 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:15
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,815916262345611195,5897589932691484876,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,16468562109819439393,9488089428983810744,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,9548762270465259105,13769467509934967777,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,8769916629642780637,12187652804541329755,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,8769916629642780637,12187652804541329755,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,8131546361261180812,1999440112827573256,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12272796704319581733,8421968396465196974,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7545743887361840575,18107680015468719429,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,12800423600350094288,16841695778245254317,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,409894900694648990,15315685645102095943,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,7408657304039664596,7262978578815338638,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,12234042975824514701,9911619461900459839,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,11295125488799640091,2599244924449473032,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:14
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=164,i,11105149803180036155,2951177351125111689,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,6722551262445275769,12257301442426412262,262144 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,12811085148304906309,1443790172952816825,524288 --field-trial-handle=2596,i,17168345430053920580,17153883812083339342,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:14
    3⤵
    PID:120
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.old_1784115086
  2⤵
  - Views/modifies file attributes
  PID:2644
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.old_1784115147
  2⤵
  - Views/modifies file attributes
  PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2ed6b94e-20f4-4adc-9a99-f4407028a445.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2ed6b94e-20f4-4adc-9a99-f4407028a445.tmp
Size 38KB
SHA256 b843cea3b3219bdc6b0a07be21e06db7fb14b6a611e62663a345eca80b9bb389
MD5 173c31bc604e5ba6a148acf4f5af153c
SHA1 bb78c4480b3a3022832c34d2d8e42663ffe43c96
SHA512 14deda17fd9c134c85fe2f52ad62923e1e5e1f86742240ff5ec0d78207614d2adeea61c075bb35264c4729ccfc1ec314f9abdde0b06d0b2aa451341cf10b9cd0
SSDEEP 768:6rv+4UNbds3khDZIO0oGJNzc4ReyIsX2eVH1S5D:6bsbS30GJtc44bsmEH1Y
TLSH
T16A03CF32A8688977ACF69686B40776537EF8611782D81E94C5DE5F0C4A8B5DC130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

9179caff-7e06-4cd1-bc5e-cdf4a7c1ebab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9179caff-7e06-4cd1-bc5e-cdf4a7c1ebab.tmp
Size 32KB
SHA256 29523fb3ec526df1d8f06c86dd3c6f35b06ce34a251df38972a606ac379bf50e
MD5 2df01ebe2fdaa11e29422664f2471a4f
SHA1 e842c6a9630e36428f0d1f2f915ecefcfe908094
SHA512 0f4453a80e9bf4039e3f2e53f592baa7073f646464165d5d8a9de81ea8287ecfccec79a1eb8fbd4efd00d78ab340e397ceb893968b9fe4a1b11915a9a749cb06
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVESOu4YgroSy8IT:wGedPsE7X6WgoufDMu1jaDSOVYrJT
TLSH
T1F0E2EB3B690CCB7E4F804EDCEC29BE9EADA801CB56D8C95447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 078f58e6b91307202ab84aa78d5ab1e824793a75f89bde022a79490d6bc9628f
MD5 c838a69908ec521c8a67c40debf43cfa
SHA1 8de29573356dab5bfb154158a319b00ecdeb480e
SHA512 12c9631d6022f3b054f50dff12a556b4dfd48f1142e2f11003a37c660ce0683db517c2299f59dfa00e21967962354bb8fc17be91aa567c2f2c23f241e268e29c
TLSH
T1D861967853B54DD2DB29AA7AB1E9B86B33F6806A47073E00E2842F355C05F75ABE1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dae5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59dae5.TMP
Size 3KB
SHA256 29efb3edad4ccfc9a925fadcc72d9f150b1573353c6331d82dfecee96d89c28f
MD5 eb47418d02dd8348329ae9736ac678eb
SHA1 7131e86e049148b209fefeedbbf259c7e802e506
SHA512 971e7b576904ddda9e90e2aefca94626771ec9af1439269ce2dbf3e51590491190bafab8b0e0ec4cc7715dfc7acf13a53f47cd8097edafce59b98f669d933b86
TLSH
T1E751847553B64DD2DB29AA7AF0E9746B32F6806A43073E00F2852F345C05F745BE1113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a5aefdc827413599799651c51b37aa3ae8ff845cd693b8e969845d3c05093e38
MD5 49189a42fed4fea182115f1d74ea3859
SHA1 466fb638663fc31534af58073e27c53a2f7c90bd
SHA512 156e65924a5fe4060f07739cd339ac6bb52b4146213f5ae0f1faf66105f4485aef8bba9bae9754cd7ce71ef5a1ca204e184cd31f23648c7e27d3e3d83dcd6fd5
TLSH
T1E141BDF3C3E4866D890196F0AA187E2BCE1D0915432C3D5AC9E4EE1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 84c5b11ce119f92eec3eea23c0431915530c08b770c72d419332ccac77320e31
MD5 114fcbc9b5ba5a0b8662aea2d79b5e16
SHA1 425375fb3728a70b022a36de00d2ffd13d9aa438
SHA512 fc33f42a367ee6e0c71ee7d7bdb56f06ed7668a6ea8ae8208dd9bbbbf2ccea97594c904fe960e4343bd4a04b043149a74e2e582ab5cf546d41bf86e720f97f76
SSDEEP 192:sxRlR0yM/jK1Ml8wCI/fGsrN8nZ6CzzoA8p4f/g6+WNIYn8sOwth1GCIgDcJ:sxRlG8I/fGsh8Z6DG/5ITsOqhU
TLSH
T1A962D9156A245D7B9CDBD20DFA41BF93D6FC1523A2941E44BAFC8A0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6dae366a5022e3707c7a2450827928588f6be05d121f77d32a8765a3fa6c9b95
MD5 4dffff0fc55b8d863c02cc7423fd78b7
SHA1 2efd9ea60ec3d23e785bd44e7a1f3e31a05b64a4
SHA512 f1612d1c4246a5d8ea18d08ab6f79928b6faa33bcb48feb4bef0af00444cef19afcf2c51996eb46db93658d11513ded672b161dc5b38a153614226ac764b4d91
SSDEEP 192:sxRWR0yM/jK1Ml8wCI/fGsrN8nZ6CzzoA8p4f/g6+WNIYn8sOwth1GCIgtJ:sxRWG8I/fGsh8Z6DG/5ITsOqh3
TLSH
T11A62D8156A24597BDCCBD20DFA45BF93D6FC1523A2941E44BAFC8A0C04E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a72befee069b7a3428828a4b0e342b3df69858bd413f0fe99ab3e65160bbc4ec
MD5 f3f61033612deb2bda06334cf3004302
SHA1 034ad2de962846b9aa28e89ef7a171c88006777d
SHA512 5f34e34090a26209ca3a895a1e368f3f72c403e4aa5ed1f1af0e36c37d886a8aa1a33774626f12d6c6949d275e1659ff56998b86ad7846b959810fb40bc03cbd
SSDEEP 192:sxRlR0yM/jK1Ml8UQ7CI/fGsrNenZ6CzzoA8pef/g6+WNIYn8SOwth1GCIgDSJ:sxRlGqOI/fGsheZ6DI/5ITSOqhy
TLSH
T1ED62D716AA245D7B9CDBD219F641BF93D6F81522A2941E44BAFC8B0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

743f2d8d-7b91-4972-bf39-d0ebf228e0c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\743f2d8d-7b91-4972-bf39-d0ebf228e0c8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b857742e0acf7914edb26bd498cda7b5605c926ab15b005c92cddbf9792539b0
MD5 a99f4c1aa953f854e9cd6d00f5e66ec4
SHA1 8da263e9d04e2804d0a43169cf26d7a4cc8c8347
SHA512 24140dfb32b7040994d55b362a306b8d0ca8340ca92908e7bb3a76b0e57999d5534c68f6eac664acd1f8cb1e3070546d147eb754096a4dce01d4b224400bc23c
SSDEEP 384:ndtNn/s3n9SB38Nnl1io++bIJDZNfNoXOVSUUd2GMX6zETRzcoXfK86sfxEZxxsa:dj+9W3oZqDZIO0oGEXNzc4ReyIsP4Mje
TLSH
T14EF2C032FC25CD679CE9528AB50776D2BEF8116780C41E88DAED9F0C05832EC075B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 343e7b0badac6e189e7600ffbeaba9c49f4c2c42221620dbfbb492e3a7fe9d9e
MD5 92721f1fcb4edf572ff854f8248b8a2d
SHA1 b086e8b9a5c4480f20d60a77ff45d29410417b52
SHA512 8374a7c51dfd90dadd0c968193649d60b2a71f08145f681952ce394b7afcbf4cb361c8811bbc56ea2110898aea85ca29729f5a4fdee3a3116cc6e11bbdb87303
SSDEEP 384:n2tNn/s3n9SJ38Nne1in+bIJDZNfNoXOVSUUd2GMX6fETRzcoXfK86sfxEZxxsIT:2j+9m3LqDZIO0oGEpNzc4ReyIsP4Mje
TLSH
T13BF2C032FC25CD679CE9528AB50776D2BEF8116781C81E88DAED9F0C05832EC075B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8b7d1465825f880d18a234822f9ba8ffda56b9686aabf3075b6a3b2271e5bf8b
MD5 9c1f0aed2790814ec0ba3a2f8d5ef21d
SHA1 5253280d3992b6af51a546c9195fde52348ba5d4
SHA512 911986777a58e13bebc426217728379145e6cb1d988562cb7b3b2daffb7edff9c23f54cc26fdbb71806b8b8345b19e22642f425fdbdcb37fa27697fa131ab5c9
SSDEEP 768:IF1j+9X3mwgyTZw5O0oGEeNzc4ReyIsP4Mje:l9X3zG/tc44bswB
TLSH
T159038D36EC65CE6BACE647C6B7067696EEF411A781C85DC4DAD95E4C00C32ED074BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5fb445b748c2d91c5ad38e14116623bc71132d7682304faf12c49ef654057bd5
MD5 c334f66e25d89d9d32a8f3aaf61486de
SHA1 f15d796fe4247e834fa2530950331e84bb017158
SHA512 8bf0c11e0f1897f6475753ba009d54cd7e28fa97fbd98a9f8a01eea5514e2791d577525a9047f886701e4a962c424014fca1b121b7409ba3bfa55cb9747ac690
SSDEEP 384:ndtNn/s3n9SJ38Nnl1in+bIJDZNfNoXOVSUUd2GMX6fETRzcoXfK86sfxEZxxsIT:dj+9m3+qDZIO0oGEpNzc4ReyIsP4Mje
TLSH
T166F2B032FC25DD679CE9528AB50776D2BEF8116781C41E88DAED9F0C05832EC075B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

5fe5d908-80b5-49be-828d-135dae052d1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5fe5d908-80b5-49be-828d-135dae052d1e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 64a6583b9e55c6bf8e4f6e991baf9f697459cd559fc41dde96d17baeddfd2fe9
MD5 3b89100533c5c9712263824835cb7a3d
SHA1 e0956ab29617c24beedf2ee8c2016cc2e6fd90f1
SHA512 f59d6967900536ab0731a0acf32b45e13cdcaab98c4c48fc4fa5c52264e3c6aa7d77d4fd99ccd080b85fd24e5fb932b00a4038d506a9467b33311331bd450d1f
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3A:CebAjOKn3wRKRJ3A
TLSH
T177D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.old_1784115086

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4c7ae29eb47a622651ce49397dfb6d9_akira_glassworm_rusty-stealer.old_1784115086
Size 2.7MB
SHA256 6a88b71b063cb4fbdbff351669ddfb94a56aa94bc15335ad30d270c3a9d58aad
MD5 04c2f272c548d451a6b7abca082b4498
SHA1 cd01534ec03088f5dbbaecaad64e02a5effa86e1
SHA512 06d6dfbf382c312f749a4b75b02a320d8ae90f1342c3ab7fe66cb8bf97fa6dd3b5a763e3a29107036c0a7d48a5522c75a961fc87615325466e03ac9927bb0859
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3l:CebAjOKn3wRKRJ3l
TLSH
T1A5D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3756_13507939\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-350-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-255-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-316-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-290-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-272-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-244-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-367-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-375-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-235-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-398-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-278-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-420-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download

memory/708-193-0x00007FF6A7EB0000-0x00007FF6A8171000-memory.dmp

Download