e056edc7e1f6fc90627be0f25cc8b60079e66152fccf627e3768a7d7f1c36c45

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260719-a2vejaa181
SHA256 e056edc7e1f6fc90627be0f25cc8b60079e66152fccf627e3768a7d7f1c36c45
MD5 a51a9297d9a146b2ffb9151cf925cf66
SHA1 49b9d6670cdff9ec6ae99768f2ac9c2d716e8bd1
SHA512 5ca2401b8aa4ad1c08601e7f235d6b6df28311bde42319df0136621c32f71c504f9ccb98860cdda96be7757783fb4bd6ebd467ad7c2a0a4d0d93b5f7be087fdd
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3V:CebAjOKn3wRKRJ3V
TLSH
T151D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1870822071\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1628531363\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1330062500\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1330062500\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1870822071\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1870822071\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_259511217\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_259511217\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1870822071\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288953864046764"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{BF2A74D9-916A-4F96-A59F-E8F6D849EB09}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3448	wmic.exe
3448	wmic.exe
3448	wmic.exe
3448	wmic.exe
5584	msedge.exe
5584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2664	2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3448	wmic.exe
Token: SeSecurityPrivilege	3448	wmic.exe
Token: SeTakeOwnershipPrivilege	3448	wmic.exe
Token: SeLoadDriverPrivilege	3448	wmic.exe
Token: SeSystemProfilePrivilege	3448	wmic.exe
Token: SeSystemtimePrivilege	3448	wmic.exe
Token: SeProfSingleProcessPrivilege	3448	wmic.exe
Token: SeIncBasePriorityPrivilege	3448	wmic.exe
Token: SeCreatePagefilePrivilege	3448	wmic.exe
Token: SeBackupPrivilege	3448	wmic.exe
Token: SeRestorePrivilege	3448	wmic.exe
Token: SeShutdownPrivilege	3448	wmic.exe
Token: SeDebugPrivilege	3448	wmic.exe
Token: SeSystemEnvironmentPrivilege	3448	wmic.exe
Token: SeRemoteShutdownPrivilege	3448	wmic.exe
Token: SeUndockPrivilege	3448	wmic.exe
Token: SeManageVolumePrivilege	3448	wmic.exe
Token: 33	3448	wmic.exe
Token: 34	3448	wmic.exe
Token: 35	3448	wmic.exe
Token: 36	3448	wmic.exe
Token: SeIncreaseQuotaPrivilege	3448	wmic.exe
Token: SeSecurityPrivilege	3448	wmic.exe
Token: SeTakeOwnershipPrivilege	3448	wmic.exe
Token: SeLoadDriverPrivilege	3448	wmic.exe
Token: SeSystemProfilePrivilege	3448	wmic.exe
Token: SeSystemtimePrivilege	3448	wmic.exe
Token: SeProfSingleProcessPrivilege	3448	wmic.exe
Token: SeIncBasePriorityPrivilege	3448	wmic.exe
Token: SeCreatePagefilePrivilege	3448	wmic.exe
Token: SeBackupPrivilege	3448	wmic.exe
Token: SeRestorePrivilege	3448	wmic.exe
Token: SeShutdownPrivilege	3448	wmic.exe
Token: SeDebugPrivilege	3448	wmic.exe
Token: SeSystemEnvironmentPrivilege	3448	wmic.exe
Token: SeRemoteShutdownPrivilege	3448	wmic.exe
Token: SeUndockPrivilege	3448	wmic.exe
Token: SeManageVolumePrivilege	3448	wmic.exe
Token: 33	3448	wmic.exe
Token: 34	3448	wmic.exe
Token: 35	3448	wmic.exe
Token: 36	3448	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4420	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 6100	2664	2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe	89
PID 2664 wrote to memory of 4420	2664	2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe	91
PID 4420 wrote to memory of 5900	4420	msedge.exe	92
PID 4420 wrote to memory of 4736	4420	msedge.exe	94
PID 4420 wrote to memory of 5264	4420	msedge.exe	95
PID 4420 wrote to memory of 4736	4420	msedge.exe	94
PID 4420 wrote to memory of 4736	4420	msedge.exe	94
PID 4420 wrote to memory of 1324	4420	msedge.exe	96
PID 4420 wrote to memory of 1324	4420	msedge.exe	96
PID 4420 wrote to memory of 5564	4420	msedge.exe	97
PID 4420 wrote to memory of 5564	4420	msedge.exe	97
PID 4420 wrote to memory of 4384	4420	msedge.exe	98
PID 4420 wrote to memory of 5564	4420	msedge.exe	97
PID 4420 wrote to memory of 4384	4420	msedge.exe	98
PID 4420 wrote to memory of 4384	4420	msedge.exe	98
PID 4420 wrote to memory of 2056	4420	msedge.exe	99
PID 4420 wrote to memory of 2056	4420	msedge.exe	99
PID 4420 wrote to memory of 2056	4420	msedge.exe	99
PID 4420 wrote to memory of 3780	4420	msedge.exe	100
PID 4420 wrote to memory of 3780	4420	msedge.exe	100
PID 4420 wrote to memory of 3780	4420	msedge.exe	100
PID 4420 wrote to memory of 3604	4420	msedge.exe	101
PID 4420 wrote to memory of 3604	4420	msedge.exe	101
PID 4420 wrote to memory of 3604	4420	msedge.exe	101
PID 4420 wrote to memory of 3724	4420	msedge.exe	102
PID 4420 wrote to memory of 2908	4420	msedge.exe	103
PID 4420 wrote to memory of 3724	4420	msedge.exe	102
PID 4420 wrote to memory of 3724	4420	msedge.exe	102
PID 4420 wrote to memory of 2908	4420	msedge.exe	103
PID 4420 wrote to memory of 1868	4420	msedge.exe	105
PID 4420 wrote to memory of 3896	4420	msedge.exe	106
PID 4420 wrote to memory of 1868	4420	msedge.exe	105
PID 4420 wrote to memory of 3896	4420	msedge.exe	106
PID 4420 wrote to memory of 6132	4420	msedge.exe	108
PID 4420 wrote to memory of 6128	4420	msedge.exe	109
PID 4420 wrote to memory of 6128	4420	msedge.exe	109
PID 4420 wrote to memory of 5852	4420	msedge.exe	112
PID 4420 wrote to memory of 5852	4420	msedge.exe	112
PID 2664 wrote to memory of 3448	2664	2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe	113
PID 4420 wrote to memory of 2428	4420	msedge.exe	117
PID 4420 wrote to memory of 1808	4420	msedge.exe	118
PID 4420 wrote to memory of 4324	4420	msedge.exe	119
PID 2664 wrote to memory of 5544	2664	2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe	120
PID 4420 wrote to memory of 5284	4420	msedge.exe	122
PID 4420 wrote to memory of 5284	4420	msedge.exe	122
PID 4420 wrote to memory of 5384	4420	msedge.exe	126
PID 4420 wrote to memory of 5384	4420	msedge.exe	126
PID 4420 wrote to memory of 4320	4420	msedge.exe	127
PID 4420 wrote to memory of 4320	4420	msedge.exe	127
PID 4420 wrote to memory of 2164	4420	msedge.exe	128
PID 4420 wrote to memory of 2164	4420	msedge.exe	128
PID 2664 wrote to memory of 5884	2664	2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe	129
PID 4420 wrote to memory of 5584	4420	msedge.exe	131
PID 4420 wrote to memory of 5660	4420	msedge.exe	132
PID 4420 wrote to memory of 5660	4420	msedge.exe	132

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6100	attrib.exe
5544	attrib.exe
5884	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.old_1784421781
  2⤵
  - Views/modifies file attributes
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffae0f8c188,0x7ffae0f8c194,0x7ffae0f8c1a0
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,15148161750590674392,15272387493749664552,262144 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,13754860539573705858,10177670873003246681,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,17108525869675558304,6783634677139188986,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:13
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,310710584362573269,17934639872583836097,2097152 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,3863593042949957649,7054297430483354622,2097152 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,11551218093074301207,14478488024586775000,2097152 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,11300394509503390062,2393782124672495782,2097152 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5248,i,2354494397748666112,4435618697436526159,2097152 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:9
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5392,i,955433091097860026,14986398983396571875,2097152 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:15
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,9662914646664752781,14028161088261983807,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,1259127579670269370,9538689972390360346,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10467871308246164255,16334930388486121954,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6996759990660893358,13748835172327647705,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6996759990660893358,13748835172327647705,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,15886040056553426759,12241484854966512541,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,13139682378413063629,8571166969165241641,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,13558297921737611187,7848808869147246152,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,13262336080697501033,11022167111120713009,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,17214791510315654702,4321242357836040753,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7016828203478640565,17070041253637171077,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,15832453693902579446,13911772664868724897,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,1940706222589718344,12287498312218877020,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,18219579463844717429,12132001803034502180,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7052,i,14515064968146914141,11140155879100579955,262144 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,14338914119026827688,15435356983839947931,524288 --field-trial-handle=2484,i,16160750361809518339,12286433691055182727,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:5660
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.old_1784421842
  2⤵
  - Views/modifies file attributes
  PID:5544
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.old_1784421902
  2⤵
  - Views/modifies file attributes
  PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e3410aa09c90c91406c4d4e28dc2c14dbb553456a2e7c4894aa4485d487b4d28
MD5 19f11a66e6bcbb195dc35e5079f67dde
SHA1 f108ed9a238b9035c51cdaedb0f8e5a2de2c95e2
SHA512 56588351dd8721848d340ba98dcf966e6072a12a569bad5500a197719cd9755898ab69ab7494fb18619ed1231b023dfc1861be16caa339ebe54c2caabcd5a9a8
TLSH
T10A5164C4872FEBD2E72452BE65E24CCA36705E5729076B3153BA52B28CC6F4D34F0214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cfba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cfba.TMP
Size 2KB
SHA256 ccde04104f049a3207ecf1d6427042d0349e7e9c1f65640acc650a6979093ff8
MD5 fd49a88897059d12c428eb9cb9172874
SHA1 a530ab23174fb65af04519f646f8e099ac8de71e
SHA512 41b855f51fb679b0f4c6b110adab817981f49e9c1d9dea6cd770d9401f62de55de42ee2e7647e411c2c7b62deccbe24ea3b2ef842302d9821cb20e5120bf2f0c
TLSH
T1D35163D4872FDBE2E72456BE65E148CA36709E572907AB3113BA52B65CC2F0D34F0214
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 71abff57506ee49cb07f27e985fb2adfd0df3325a85d1b0fd5ed103f68f80b99
MD5 e5cf7187f35ab0138d4d31f338ae49d1
SHA1 8779d9689993b633ca217674591eafd60e291737
SHA512 9dabf093536671d1f86a925f1904a8d9ffacb9eb151940e516ab3d994d1fdb2a0caa930b9bfe290dc40c8da235380b9bc9dfc5aa8fd8faf2bc91ac7e4a0f2e67
TLSH
T18641B0F3C3F8862E891195F4AB186E2BCE2D0915432C7D5AC9E4AF1BA3E2871D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 edea70b2f4ea4a0979f301aec2e231521cabf5fc43bae1c13e68f0690525b925
MD5 dd52e68c49cdc69f7a76466f5e1330dd
SHA1 6119fffcbe754322c0bddfc5654b35f514b68b8f
SHA512 2a0ffbb9c35c1a32ec06e2a82b1019da35fddcd856bc5b2cb9a9b2597c9b2c33c4f1d8d25fea9c163a04f8bb962d8aed54eef39a0ed2839e4eaee2d7f708b948
SSDEEP 192:sxRDRjCY/fUsLj+W4ZhyJzoA8p4i/g6+WNIYZ7P0OwjsOG7IgV5J:sxRDsY/fUsLj+WGhyUv/5InOB5p
TLSH
T1764285167A28A93B9CCBD25DFB557F53E6F92032A1901E48ABFC960C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 448a1ffc07258bdc965ea2fed0049e03bb3b72f75362e9a25d07ba34bf04576f
MD5 b6adcbfa35cc3d1315746c2d73ff5025
SHA1 12fc2ccc43374a0b94dc35327810335a17a6b233
SHA512 142106d772772239885a63f5eebb4c3f59f86bcb51791b3d4be9c9620c1c040f64504fdc099ba7fa37b4c6d92be65ccf0c8596fd2d163a3292491a269d32be33
SSDEEP 192:sxRARjCY/fUsoj+/4ZhyJzoA8p4i/g6+WNIYZ7PKOwjsOG7IgDI5J:sxRAsY/fUsoj+/GhyUv/5IPOB5W
TLSH
T1C6428616B928993B9CCBE21DBB557F53E6F92032A1901E48ABFC970C05E76CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2f0504803c22c6558cab46712a456ebe14c08b3f7365f71d79e1480606111120
MD5 1d0947cc83800a45fa1373700980a04f
SHA1 0ccd897e7fcfa19b647376785df07d5403126b8f
SHA512 c1de1daadb6d21c9d132d40ba37403f0f220eda71c29e0aad823277f74596be7ddf7c9c3a15cc3555f12303264bc5ec2ee12232c74b09f1944ea417ea541bdeb
SSDEEP 192:sxRARjCY/fUsoj+W4ZhyJzoA8p4i/g6+WNIYZ7P0OwjsOG7IgDy5J:sxRAsY/fUsoj+WGhyUv/5InOB5g
TLSH
T146428516BA28993B9CCBD25DFB557F53E6F92032A1901E48ABFC960C04E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 90665338b08a77054ff9e69ad659e46aff20285702e267949e039710689fd49d
MD5 0b3732b8773bbb267f9bf00480c0c1dc
SHA1 31d51e7fb49bff62851bda0f25dd8c81d08ef92a
SHA512 8b942dd30e1bfde17a6369ae2f251cae2b52f31e969e4709a5cacf1656ff59200550d83a6a4af0b6d1118a424910b44182e05f2fc41bb3d9dad93f8f59dec886
SSDEEP 768:ky2S6S7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaQuSV4ZroyM+q:ky2S6qE7evWgd5f/bu1jadQuU4Saq
TLSH
T137D2DA7B640CCB7F4F804ADDAC197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5238.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5238.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 5ae7da9e900a1b94e08cb47e95dba9071e1a269c26dbb0a0b9c0392249c86a6a
MD5 3b65effacc2b6258b4e1c5ee15a89806
SHA1 29e8b8321fc986482a651f6df7569e1ebbce8638
SHA512 46e0f91998a5ec1d73c32a064c3e199f439ae6fdf896c78b6817dc4b828fa4ac47a1ed6e93b6194bf5b86219b1c7394d32a2b8287de319faaa7bdbac5273393b
SSDEEP 768:Sj+9s3+avq2zAam6aQMGdjWca4Ghf9ZDP:h9s3+qVmaME6pZb
TLSH
T180E29E315879DD779CAB9695F32B27C3BDF016B384C81E44D9E9AB0D02C728D270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 02a5f8e9cbc8a362a5b176b434332e50e4d856374693339b738e69598ee8cf18
MD5 f6645a4147e034f9d4154dec546e7823
SHA1 78e50916860073f41e9363978576adce8e687688
SHA512 af07e3a135d10c2ce8354e0851bf8531f8a66d2412e10b1f7f3d45df5c43a97d16ac5f013306cf3dba6b2f41f06c53b252ad02f453b622c72b3a0decf4971286
SSDEEP 768:Sj+9p3+Svq2BAam6aQMGdjWca4Ghf9ZDP:h9p3+iDmaME6pZb
TLSH
T1FED29E315875DD779CAB9699F72B27C3BDF012B384C41E44D9E9AB0D02C728D270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b9d95a53601a2d4d7dd664035ecd7138bfb2c738a7816345107ccd7917fd1701
MD5 fcaaeeb1b29d03469b1ec48161e8505c
SHA1 4ec7376a7c902eab4b9c678f8f1d7dbf988465aa
SHA512 263e2d5ce14d4bd39ea3744c2b85a4dbe915be6e943a80eefc271ac21612b39d50c0e4f5786795124bdd42281a160ea4979e80767db4227fe449f5f1ae4b86c2
SSDEEP 768:/rv+4UNbdq3L3q8AAam6aQMGdjWca4GhfBePeU/:/bsbc3vKmaME6pWH
TLSH
T1E1F2BE31A87C9973DDB79A99F21B6687BEF021A385D40E80DAD91B0D439708E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 632319e746ae12d0d4488eacfdeb7668a72cbe0241ad2b062148545a2d04a8ff
MD5 b698b36ef2bd196e28bbf6dab5fbee6c
SHA1 7c0f7b30c32aae66b41f64d84ccb3edd30dee17c
SHA512 88e06e82a24fcaaeb04a38ca2905c078d5298c3d8af3d5084893c035bfc731d19aa0b2f9cf7ffa6761c76c3cd96bc5f27c5f703997855147d479fe093943224f
SSDEEP 768:Pj+9s3xavq2zAam6aQMGdjWca4Ghf9ZDP:i9s3xqVmaME6pZb
TLSH
T12CE29E3158799D779CAB9695F32B37C3BDF016B384C81E44D9E9AB0D02C728D270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1d381c623ecb01bcdf75fd2d84b1f606356e8dd77855604b1bba77f3e73b2ce6
MD5 d7bdef85959053ca5c446c8054d03f68
SHA1 39a2505d5521bf3958848a30688aa1a4885cb01b
SHA512 3041823302a7529a1908d0b86dc9d3a6b8d360346145041af5dd36f7119bfc09a285b357a49b7232e1b423181864def27ed04bc6baec591c49430bfce59e96fc
SSDEEP 768:dnF1j+9H3cwgwaLhAam6aQMGdjWca4Ghf9ZDP:Y9H33WmaME6pZb
TLSH
T1DEF26B329865CE6BACE79BC5F71A3687EDF011A384C85DC4DAD9AE0D01C718E130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

522e4dbb-e598-4a05-8e5f-cfd84a900465.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\522e4dbb-e598-4a05-8e5f-cfd84a900465.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 b4c959831dc04befba6ac1b50482738a6acb1bcb4f94c240f2e4cf566965e93c
MD5 ded4f4aa8d69a538af4864dd135e5837
SHA1 fbd7a9e2bb83d60c482b0481216be766d214769e
SHA512 6796983120a8aaf1924b5a6fe2bfcdca7ff46c65384997c2d92472524d5ac5e9eeb94e9df2ef2f1f262a6a2da573aec0dd84f4c40e584984b72fc07ff3bf0f8a
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ30:CebAjOKn3wRKRJ30
TLSH
T1C7D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.old_1784421842

Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_a51a9297d9a146b2ffb9151cf925cf66_akira_glassworm_rusty-stealer.old_1784421842
Size 2.7MB
SHA256 728a0d0608da49578f6cc52a914934d092d836d26201842b5b580e434124d163
MD5 24bf42eacaada9941c9356c50df3ceaf
SHA1 c796fd50f71739e9dc17645344bf90e24d4deb36
SHA512 dd95aba16e6f5888d8f2f800fffcd172bc5d9347b878c162dd28969e1a4c614a0c00f807c55fa03729c3d00a601cb0d8fe2bc6258072516f869d9a575a3b9ce1
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ32:CebAjOKn3wRKRJ32
TLSH
T1A7D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4420_4753652\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2664-194-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-310-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-284-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-327-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-344-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-267-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-361-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-373-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-247-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-392-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-406-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download

memory/2664-230-0x00007FF7CDC50000-0x00007FF7CDF11000-memory.dmp

Download