01525f0904d04bc28e07f0ef4e51fb407175e8fa2847d5393bd6734648025fe0

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260716-b72apsax8q
SHA256 01525f0904d04bc28e07f0ef4e51fb407175e8fa2847d5393bd6734648025fe0
MD5 70ffd06615cdedd0b5f013873d5b6526
SHA1 35a1370c818c84d005ed125c5423e8490614958f
SHA512 029b7b3e21652b470ec65d61869c5f4eda6ad31d9f9844d2a42eb094f445759f8be5abcbadd5dbd99773d37a565ab8d649304089e30503374dd3f766fa15ca10
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3g:CebAjOKn3wRKRJ3g
TLSH
T16AD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4664	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286400870989079"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{E16ACE2E-A16B-4170-B1AE-4DBB9278896C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1064	wmic.exe
1064	wmic.exe
1064	wmic.exe
1064	wmic.exe
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4752	2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1064	wmic.exe
Token: SeSecurityPrivilege	1064	wmic.exe
Token: SeTakeOwnershipPrivilege	1064	wmic.exe
Token: SeLoadDriverPrivilege	1064	wmic.exe
Token: SeSystemProfilePrivilege	1064	wmic.exe
Token: SeSystemtimePrivilege	1064	wmic.exe
Token: SeProfSingleProcessPrivilege	1064	wmic.exe
Token: SeIncBasePriorityPrivilege	1064	wmic.exe
Token: SeCreatePagefilePrivilege	1064	wmic.exe
Token: SeBackupPrivilege	1064	wmic.exe
Token: SeRestorePrivilege	1064	wmic.exe
Token: SeShutdownPrivilege	1064	wmic.exe
Token: SeDebugPrivilege	1064	wmic.exe
Token: SeSystemEnvironmentPrivilege	1064	wmic.exe
Token: SeRemoteShutdownPrivilege	1064	wmic.exe
Token: SeUndockPrivilege	1064	wmic.exe
Token: SeManageVolumePrivilege	1064	wmic.exe
Token: 33	1064	wmic.exe
Token: 34	1064	wmic.exe
Token: 35	1064	wmic.exe
Token: 36	1064	wmic.exe
Token: SeIncreaseQuotaPrivilege	1064	wmic.exe
Token: SeSecurityPrivilege	1064	wmic.exe
Token: SeTakeOwnershipPrivilege	1064	wmic.exe
Token: SeLoadDriverPrivilege	1064	wmic.exe
Token: SeSystemProfilePrivilege	1064	wmic.exe
Token: SeSystemtimePrivilege	1064	wmic.exe
Token: SeProfSingleProcessPrivilege	1064	wmic.exe
Token: SeIncBasePriorityPrivilege	1064	wmic.exe
Token: SeCreatePagefilePrivilege	1064	wmic.exe
Token: SeBackupPrivilege	1064	wmic.exe
Token: SeRestorePrivilege	1064	wmic.exe
Token: SeShutdownPrivilege	1064	wmic.exe
Token: SeDebugPrivilege	1064	wmic.exe
Token: SeSystemEnvironmentPrivilege	1064	wmic.exe
Token: SeRemoteShutdownPrivilege	1064	wmic.exe
Token: SeUndockPrivilege	1064	wmic.exe
Token: SeManageVolumePrivilege	1064	wmic.exe
Token: 33	1064	wmic.exe
Token: 34	1064	wmic.exe
Token: 35	1064	wmic.exe
Token: 36	1064	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5836	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4408	4752	2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe	87
PID 4752 wrote to memory of 5836	4752	2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe	89
PID 5836 wrote to memory of 416	5836	msedge.exe	90
PID 5836 wrote to memory of 4664	5836	msedge.exe	92
PID 5836 wrote to memory of 5448	5836	msedge.exe	93
PID 5836 wrote to memory of 5448	5836	msedge.exe	93
PID 5836 wrote to memory of 5448	5836	msedge.exe	93
PID 5836 wrote to memory of 2364	5836	msedge.exe	94
PID 5836 wrote to memory of 2364	5836	msedge.exe	94
PID 5836 wrote to memory of 5936	5836	msedge.exe	95
PID 5836 wrote to memory of 5936	5836	msedge.exe	95
PID 5836 wrote to memory of 5936	5836	msedge.exe	95
PID 5836 wrote to memory of 5644	5836	msedge.exe	96
PID 5836 wrote to memory of 5644	5836	msedge.exe	96
PID 5836 wrote to memory of 5644	5836	msedge.exe	96
PID 5836 wrote to memory of 1784	5836	msedge.exe	97
PID 5836 wrote to memory of 1784	5836	msedge.exe	97
PID 5836 wrote to memory of 1784	5836	msedge.exe	97
PID 5836 wrote to memory of 740	5836	msedge.exe	98
PID 5836 wrote to memory of 740	5836	msedge.exe	98
PID 5836 wrote to memory of 740	5836	msedge.exe	98
PID 5836 wrote to memory of 2000	5836	msedge.exe	99
PID 5836 wrote to memory of 2000	5836	msedge.exe	99
PID 5836 wrote to memory of 2000	5836	msedge.exe	99
PID 5836 wrote to memory of 5544	5836	msedge.exe	100
PID 5836 wrote to memory of 5544	5836	msedge.exe	100
PID 5836 wrote to memory of 5544	5836	msedge.exe	100
PID 5836 wrote to memory of 5828	5836	msedge.exe	101
PID 5836 wrote to memory of 5828	5836	msedge.exe	101
PID 5836 wrote to memory of 2676	5836	msedge.exe	104
PID 5836 wrote to memory of 2288	5836	msedge.exe	103
PID 5836 wrote to memory of 2676	5836	msedge.exe	104
PID 5836 wrote to memory of 2288	5836	msedge.exe	103
PID 5836 wrote to memory of 3576	5836	msedge.exe	106
PID 5836 wrote to memory of 2864	5836	msedge.exe	107
PID 5836 wrote to memory of 2864	5836	msedge.exe	107
PID 5836 wrote to memory of 2840	5836	msedge.exe	108
PID 5836 wrote to memory of 2840	5836	msedge.exe	108
PID 4752 wrote to memory of 1064	4752	2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe	111
PID 5836 wrote to memory of 2504	5836	msedge.exe	115
PID 5836 wrote to memory of 2848	5836	msedge.exe	116
PID 5836 wrote to memory of 2404	5836	msedge.exe	117
PID 4752 wrote to memory of 4564	4752	2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe	118
PID 5836 wrote to memory of 2400	5836	msedge.exe	120
PID 5836 wrote to memory of 2400	5836	msedge.exe	120
PID 4752 wrote to memory of 3280	4752	2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe	122
PID 5836 wrote to memory of 2200	5836	msedge.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4408	attrib.exe
4564	attrib.exe
3280	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.old_1784166482
  2⤵
  - Views/modifies file attributes
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff8c55bc188,0x7ff8c55bc194,0x7ff8c55bc1a0
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,357865493191074415,8197625155158925193,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,1681660683396430378,17741103516281659104,262144 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:2
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,545307863491710421,3029356526066898954,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,761894566046157968,205562117707168426,2097152 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,6830046517186657182,1385134406985312291,2097152 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,2451744753973419275,226065726375200162,2097152 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,13216155207057373934,9291722223810985540,2097152 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4468,i,6264088138246698540,14154902311943897804,2097152 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:9
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5472,i,16869530903907944305,6657836163473001525,2097152 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:15
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,13939609339680532646,8261928769068733025,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,10494197446712073550,4513474595299437260,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,15292873928509871010,11015157112140416001,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14474357920795892066,16666528564050912215,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14474357920795892066,16666528564050912215,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,12303374953789883985,10723640968888317162,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,16646282082372419917,17487909940232576728,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8974311037616649050,3585958670052363264,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,3970759083395217212,9457834274469362374,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,14771195665922257054,6505161472413108344,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3128,i,5772190748713498814,5008806226378967209,524288 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,16571088154798113243,9232132448522966921,262144 --field-trial-handle=2656,i,13453251755385206694,17580237816266147395,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2200
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.old_1784166542
  2⤵
  - Views/modifies file attributes
  PID:4564
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.old_1784166602
  2⤵
  - Views/modifies file attributes
  PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2acb9d0ae7308ea9eae6e41c732c0b834d8a888320d6e6316bd25f53d0365a1c
MD5 e6bf03ff83320715a6c60d7064ffca2f
SHA1 b989a98507ea425470a79698aaa466d5d32d1aa0
SHA512 9876398f71fc308c04a7000583c1cda6bbec1a1edc76a86c6e81c6bdaeab14f698bfe6296eba331f198d97a2550027678a7d59f2724ba136dcf3bb15c3a0685f
TLSH
T1BE612E4F037679C1FB698DB358E1B989B2F2B15906131FA140931FB089C6F85A2DF093
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599e1b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599e1b.TMP
Size 3KB
SHA256 2c587834ad709a467afcffab8ac63309e6fd40938387ef63cb3e73ad5b25a4c0
MD5 d29513814a1416ba273f47a2241cc8c2
SHA1 f8db606fe203f5cee2ab1428349d671dce56925e
SHA512 2a3888b34ed91560b97247cabe4c6d1a455e59f17c9fc443eece9c8fb090b52aa3d95045cc2cf7b8b7d843a441a4afc36916e15088ca0fe67df1873e63bd0ddf
TLSH
T10C512D4F03727AC1FB698CB318E1B559B2F3B15906131FA040A21FF0CAC6F95A2DA093
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 caa986938e1251fc6bc54592fa4d399c626d07db9be96567ad380416ea19c886
MD5 519fa9deba6779d106ee4213f80976f8
SHA1 695b1e43220f05042bd56164ffb5967e6bc0a5fa
SHA512 2d2316b95e86ef84207b3baf9ffa3963db0cd6abef333aff236447a625f2cf4552d63329e3d9cffea2dbeff0793738e49a34f11d68929a89f36964f2d4184188
TLSH
T13A41CEF3C3E8866E890156F0AA187E2FDE1D0915832C3D5AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4113869070b1f78ce222a636193c476a2061a5b7d78f3ae6c953983bca3b74f5
MD5 2062bc163daec51323be533e2a7a1640
SHA1 0f2f438a29fd99f85177a62b2478449b7c19cbf7
SHA512 3886fa8af345b2dc825d619ee833bbc337a3c62bcaaf406276b825a8df065507f656bdb2c04ec5dacad6b4deb0588df0c74791e385b59954a1f3d23de1f61594
SSDEEP 192:sxRQROyM/jK1Ml8wCI/fQsBg14Z/zoA8p4B/g6+WNIYD9rOwq6SBGg9IgtJ:sxRQc8I/fQsi1GWY/5I0OeSB3
TLSH
T15562D9066A246D77DCDBD219FA517F93D6F91533A2901E44AAFC9A0C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cdf5787fabf35182b702d5689593cde92f62535f8ac395c6ebfec0da4b8bca3e
MD5 a11088ee304c75d50860d4468119da60
SHA1 44f703b8c4c172c8a0b295189ef9ddfc176fa38d
SHA512 e6d936e4da183ca6cf2bdbaf6e263cec2a2c9f6adfd46776edbb884e36389780663765b7c81a7dafb0a167c6c697811f186f8dad7eb6a29bda048c4e7694ad97
SSDEEP 192:sxRfROyM/jK1Ml8UQyCI/fQszgo4Z/zoA8peB/g6+WNIYD9YOwq6SBGg9IgD/J:sxRfcqFI/fQs0oGWW/5IVOeSBd
TLSH
T1A562E916AA245D77DCDBD219FA417F93D6F91533A2901E44AAFCCA0C01E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6893b1b2f768566542881475f0686c1e49fc736c4806e27c73c6724678e4434f
MD5 ce48714419da37876539b0362e053981
SHA1 4e870262c47ab93539f85f211aa697e8cae435dc
SHA512 d7926cad4d3dbc14f34bacfc2cd801deb022eb6d4ed024aee796abd92113be0b5aa3e213352c86e0eae9453f02eddcd1e6b15e21c54898c714d0bd87640ae138
SSDEEP 192:sxRfROyM/jK1Ml8wCI/fQszg14Z/zoA8p4B/g6+WNIYD9rOwq6SBGg9IgDdJ:sxRfc8I/fQs01GWY/5I0OeSBz
TLSH
T19E62EB06AA345D77DCDBD219FA417F93D6F9153392901E44AAFC9A0C01E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e4eaf1d603aad3b93755cc6190bb215bdaa2cfe7b6b92266ee130aee0c225d23
MD5 f0df9ff341c40101694bec1d524c0185
SHA1 2a8f8e7e641831aaa560c56fe017ecc72f683e6d
SHA512 dde1acb76e5a2a025c0a1af5114eef5b221919e06ee13be75ba272e008d95a9e941cb23c64d6e59079a06a65084a455a928cb9a1ad40b0ad135713b094e6f113
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuYHc1s9ro/lSXL:aW5WFdE710Wg/XfCfu1jadYHys2/lY
TLSH
T15DE2EB3B280CCB7E4F444A9CED297D9BADA801CB96DCCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2b3ab95cfe3df3cac61e5477bdb88bf92346704cc4ecf01c836aacf46b1aa4d0
MD5 5e4ee900477eefd254d8c88179d308e7
SHA1 7e1fa15a27479ddca76e3237c8dbbcdb62ec931a
SHA512 59cf7e9dcc89527c1a28d121287e34d45a2b47ad3c6b413e08f32a74bdde96f661c0999a271c19e5b994c7bae6063b93d5204c7e87006891b9a8f477f4f037ff
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHc9oMmqesWa33gUsK45gesc8M32c8X8A8p:C3gFB31lERe1JDggH2vHG5FaHc9oMmqQ
TLSH
T11DB13B40717A029538BF6A0980BE8C1F82C174667315E52B3FA902E64F67E339DFC5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65ac0088-69a9-4471-8a62-66c34fb2895e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65ac0088-69a9-4471-8a62-66c34fb2895e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 340f3e91257c339dea0cf8d917cd674ed1e5ff48ad639f0712b58f2c619c259e
MD5 0bfa5ab18c476a3a8ebad79fd3a5d900
SHA1 984b2e4d4802a51ce82d5bf4e1401061cbf64c08
SHA512 23965d63e9bd0a23699f86e450caf3b270eb091fe9998e7a70f8125ec3c07404357d954fa31add5d95adc6605b4d3948182245f031fc16c54dea9a3fdea06d40
SSDEEP 384:nytNn/s3n9SA38Nst99SgEuWZlf8hyEGojF4QFny2rEoajo4cdR8eHhVODjYPNDC:yj+9f3R6i0MrEnjN3Gac1FBb9M5
TLSH
T16EF2BF3569658E738CE7D395B1873B83AEE007A745C50F98DAD9AB0D05C36EC230B52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 405aebbf39bf874645ac2866a5c8df3e4f4b2eb11d36b979c6c7b3cf86114474
MD5 8eec3df307ce21be8c1c9bc0fecb97f0
SHA1 a36174e8db7862adfee3c9d32592b2c15cdc79c7
SHA512 057dae72f713f7d1928033553ba740564502092afde64ae3ab337877909269cc519a060179edcc78a5c89f8e4fcf79ff0d2f9407d8cf0f9368b3d1a851e6ee64
SSDEEP 768:DF1j+9X3fwgondkbhrEnjN3Gac1FBb9M5:S9X3IQhQnjMayb+5
TLSH
T14E03AF766C95CE73DCFBD7C5B6473682EEE003A785D50A94DBC9AA0C15836EC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ea6fb20b19fd926cbda4b4fd2dd804f24a53be592c06dfd93db136a88c95c4e2
MD5 6ccc895523ba68576db88a81d1c08e83
SHA1 7cc598e3340b030c7baeddbf5d10d7ab2707da0a
SHA512 b9ba0d8e470dc7aee13044307e6f11fd39348903c6a4df301976daefb920025957ee2886f675ef8c5d44983362addd9e3cfaa8bc03425b86e232b806d43b4be9
SSDEEP 384:nwtNn/s3n9SA38NsU99SgEuWZlf8hyEGojF4QFny2rEoajo4cdR8eHhVODjYPNDC:wj+9f3o6i0MrEnjN3Gac1FBb9M5
TLSH
T11CF2BF3568658E738CE7D395B1873B83BEE007A745C50E98DAD9AB0D05C36EC230B527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aaf122ab9cd63ec762496c0c4c69cc08926e95a3ea8abd2dca4bef6b216e9fdb
MD5 83befe207105054c350a9a8bf89ced5c
SHA1 7c46390238781f881bb3a7b6903f24cd051fe41c
SHA512 b483f57d6b75df7a33b65ee0424db41008909852da363481c0dfd0425ae0f73bb01fc6a1aef3bed25109881ac1c269c53e22e5ae6fbaa8ee47f2ba91c20820f3
SSDEEP 768:rrv+4UNbdS3Jmi00rEnjN3Gac1ZbeVH1SCz:rbsbg3u0QnjMaEEH1V
TLSH
T18303CF3269B88A738CE7E38571877A037EF4525386D40BE4CACD6B0D46975EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7269adf95143cefa45073e564370e9813a2ab2ea96217cc7b113cd93d8592c3f
MD5 217bdcaa01971ba4a85a82d94673acb6
SHA1 f27e8bdeac45542a9d91e03f1bbf189d76aeddb9
SHA512 d2325c47e4b5f37c7d971a1eafa3f6a0e717180df4cf376dad094cd61a8815ac927290c0e685332109f195f5933278bfe59d07b3eb129e71eb29dda0998dd234
SSDEEP 384:n+srv+89zHqlDNP9oidS38Nsf99KogEuWZlf8hyEGojF4QFGy2rEoajo4cdR8eHl:prv+4UNbdS3I6i0NrEnjN3Gac1FBb9Mi
TLSH
T10913C03178788E738CF7D295B1877A83BFE416A345D50B98DAC5A70C0A875EC230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

021c8f9a-4377-43c6-adc6-7ec523a9bb80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\021c8f9a-4377-43c6-adc6-7ec523a9bb80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 68b01f48310fe828635a8cf3e0b4a5a777094a1583fbe3879b65813c8f5a0791
MD5 496123c50c0cf234d00d63444c8069d6
SHA1 5aaf2b8791833ce57845469da0de11aceff9bd1b
SHA512 422e2a38b51295360d7ec2967cc55a2a0af2367c20f3e070a0d9d229bd385c0e88d9acaa778134bc3fd253d7633f0fb37523c95a9296ff6b02b0e78343224cec
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3e:CebAjOKn3wRKRJ3e
TLSH
T182D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.old_1784166542

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_70ffd06615cdedd0b5f013873d5b6526_akira_glassworm_rusty-stealer.old_1784166542
Size 2.7MB
SHA256 ac9baebe734103599e32e091d341eb333c8d52b9ab61c60bf2943bbf90647780
MD5 07371010efcf828343f7516440a8f300
SHA1 423ab9236eac939268c817da8d1d3684ad1a4788
SHA512 beb2f393e6ca87c8f5026e636d02afdc188ceb920e1c88d096ae6509d3eeb89cf8ffb24d6ca5c56ad9155f2a9750851cb67dd272e915787b758aa3346e69bfbd
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3t:CebAjOKn3wRKRJ3t
TLSH
T129D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5836_1470109408\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4752-269-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-275-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-252-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-250-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-295-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-233-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-309-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-318-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-338-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-348-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-197-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download

memory/4752-357-0x00007FF7C9910000-0x00007FF7C9BD1000-memory.dmp

Download