27eae26f6d70800e7869d8db4be38b741eb31af9bcbe9e4c4b39a95987583a2d

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260720-c8jbysfw7x
SHA256 27eae26f6d70800e7869d8db4be38b741eb31af9bcbe9e4c4b39a95987583a2d
MD5 a3e5c423ca60217c7618f9236d442164
SHA1 8dd74b85e2749f4f59e02e270e715fb5a00be5f2
SHA512 e873ad299492e5facd029e153f7edf0914daef641767c09ca491929dad78567f1d095ba87803c95d860607e5433ffe6ffbe3cfdf4a54aa19f3ff7ebe2cbfcc17
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3a:CebAjOKn3wRKRJ3a
TLSH
T1A8D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_945199361\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_600378381\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_600378381\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_945199361\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_600378381\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_600378381\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_600378381\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289890929953499"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{B67EE2D6-2F55-458A-96F0-AC80F8E7FA1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1860	wmic.exe
1860	wmic.exe
1860	wmic.exe
1860	wmic.exe
1276	msedge.exe
1276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6432	2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1860	wmic.exe
Token: SeSecurityPrivilege	1860	wmic.exe
Token: SeTakeOwnershipPrivilege	1860	wmic.exe
Token: SeLoadDriverPrivilege	1860	wmic.exe
Token: SeSystemProfilePrivilege	1860	wmic.exe
Token: SeSystemtimePrivilege	1860	wmic.exe
Token: SeProfSingleProcessPrivilege	1860	wmic.exe
Token: SeIncBasePriorityPrivilege	1860	wmic.exe
Token: SeCreatePagefilePrivilege	1860	wmic.exe
Token: SeBackupPrivilege	1860	wmic.exe
Token: SeRestorePrivilege	1860	wmic.exe
Token: SeShutdownPrivilege	1860	wmic.exe
Token: SeDebugPrivilege	1860	wmic.exe
Token: SeSystemEnvironmentPrivilege	1860	wmic.exe
Token: SeRemoteShutdownPrivilege	1860	wmic.exe
Token: SeUndockPrivilege	1860	wmic.exe
Token: SeManageVolumePrivilege	1860	wmic.exe
Token: 33	1860	wmic.exe
Token: 34	1860	wmic.exe
Token: 35	1860	wmic.exe
Token: 36	1860	wmic.exe
Token: SeIncreaseQuotaPrivilege	1860	wmic.exe
Token: SeSecurityPrivilege	1860	wmic.exe
Token: SeTakeOwnershipPrivilege	1860	wmic.exe
Token: SeLoadDriverPrivilege	1860	wmic.exe
Token: SeSystemProfilePrivilege	1860	wmic.exe
Token: SeSystemtimePrivilege	1860	wmic.exe
Token: SeProfSingleProcessPrivilege	1860	wmic.exe
Token: SeIncBasePriorityPrivilege	1860	wmic.exe
Token: SeCreatePagefilePrivilege	1860	wmic.exe
Token: SeBackupPrivilege	1860	wmic.exe
Token: SeRestorePrivilege	1860	wmic.exe
Token: SeShutdownPrivilege	1860	wmic.exe
Token: SeDebugPrivilege	1860	wmic.exe
Token: SeSystemEnvironmentPrivilege	1860	wmic.exe
Token: SeRemoteShutdownPrivilege	1860	wmic.exe
Token: SeUndockPrivilege	1860	wmic.exe
Token: SeManageVolumePrivilege	1860	wmic.exe
Token: 33	1860	wmic.exe
Token: 34	1860	wmic.exe
Token: 35	1860	wmic.exe
Token: 36	1860	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
844	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 6432 wrote to memory of 2280	6432	2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe	91
PID 6432 wrote to memory of 844	6432	2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe	93
PID 844 wrote to memory of 5636	844	msedge.exe	94
PID 844 wrote to memory of 6264	844	msedge.exe	95
PID 844 wrote to memory of 4616	844	msedge.exe	97
PID 844 wrote to memory of 6264	844	msedge.exe	95
PID 844 wrote to memory of 6264	844	msedge.exe	95
PID 844 wrote to memory of 800	844	msedge.exe	98
PID 844 wrote to memory of 800	844	msedge.exe	98
PID 844 wrote to memory of 6536	844	msedge.exe	100
PID 844 wrote to memory of 6460	844	msedge.exe	99
PID 844 wrote to memory of 6536	844	msedge.exe	100
PID 844 wrote to memory of 6536	844	msedge.exe	100
PID 844 wrote to memory of 6460	844	msedge.exe	99
PID 844 wrote to memory of 6460	844	msedge.exe	99
PID 844 wrote to memory of 3040	844	msedge.exe	101
PID 844 wrote to memory of 3040	844	msedge.exe	101
PID 844 wrote to memory of 3040	844	msedge.exe	101
PID 844 wrote to memory of 3992	844	msedge.exe	102
PID 844 wrote to memory of 3992	844	msedge.exe	102
PID 844 wrote to memory of 3992	844	msedge.exe	102
PID 844 wrote to memory of 4848	844	msedge.exe	104
PID 844 wrote to memory of 2760	844	msedge.exe	103
PID 844 wrote to memory of 4848	844	msedge.exe	104
PID 844 wrote to memory of 2760	844	msedge.exe	103
PID 844 wrote to memory of 1968	844	msedge.exe	106
PID 6432 wrote to memory of 1860	6432	2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe	109
PID 844 wrote to memory of 6304	844	msedge.exe	112
PID 844 wrote to memory of 6032	844	msedge.exe	113
PID 844 wrote to memory of 7016	844	msedge.exe	114
PID 6432 wrote to memory of 4760	6432	2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe	115
PID 844 wrote to memory of 6224	844	msedge.exe	117
PID 844 wrote to memory of 6224	844	msedge.exe	117
PID 844 wrote to memory of 2800	844	msedge.exe	120
PID 844 wrote to memory of 2800	844	msedge.exe	120
PID 844 wrote to memory of 2056	844	msedge.exe	121
PID 844 wrote to memory of 2056	844	msedge.exe	121
PID 6432 wrote to memory of 2972	6432	2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe	122
PID 844 wrote to memory of 1276	844	msedge.exe	124
PID 844 wrote to memory of 2464	844	msedge.exe	125
PID 844 wrote to memory of 2464	844	msedge.exe	125

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2280	attrib.exe
4760	attrib.exe
2972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6432
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.old_1784515488
  2⤵
  - Views/modifies file attributes
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffbbb94c188,0x7ffbbb94c194,0x7ffbbb94c1a0
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,15955364859313077601,17527979091355276264,262144 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,7185960287690584517,10591129761109295740,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,6064111736003417483,5649243356107759180,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,14011304174743311450,4761389046966266223,2097152 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,13721417155337644078,14074629254568492803,2097152 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:6536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,13884496465418037857,655689015761664525,2097152 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:9
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5332,i,10748261279550377838,15938442896480850763,2097152 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:15
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,12650107679805142248,2822603184625478354,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,17037075401174836402,8665160749574568287,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5133774478414883509,1024266707313761164,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5133774478414883509,1024266707313761164,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,16148617710993583187,1659734799386704587,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13283673997826041929,17219557791487992052,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13551679242324266719,9817194747497911552,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,17483611863613396095,18239813125041790262,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11641022740416154339,5101416673310310408,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:14
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2528737535700904394,13499225978601439200,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6424,i,15008793886238485031,10017830987157093609,262144 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,1624036733749383999,10424515346213662461,524288 --field-trial-handle=2280,i,16500596734824378725,4548856687509653643,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
    3⤵
    PID:2464
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.old_1784515548
  2⤵
  - Views/modifies file attributes
  PID:4760
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.old_1784515609
  2⤵
  - Views/modifies file attributes
  PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8466cfcfbf5248cb6629a0a73438829cfcff4e8622979a31df12d9d549c2d827
MD5 3f97e3e3b5c274a3040715e7488672ca
SHA1 404973c91ec23ddf1b846fe1209eb9c4e9077730
SHA512 817be3dc8c3a3eebae0d79e517bd1c1a1f697c921bcd5eaed82ede610f74e5d7dbd6a10871e607445f355a35bc71a995e8a6b32a90fb5b058ec27cb00fda466e
TLSH
T195F0F9A6D821AC3B29FD1B1D70580A4BEB90135B3B41984B3B3C821C4FB063B464AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8a2c074f41733fc9b17cd15c1b781fb89a0b0a0c8b9e3f98bce635426507a3fa
MD5 0c846d10df2eb867b8239cc99c7db50a
SHA1 5af4a0d4b38f3fb41db23cb62a5b0ac0f6b4671b
SHA512 83c2f2ae6794b3ba2390334381688354a7d518f6ba58ec9f06ae9374737784b6254cddde2b1373c3b9d60af76a93ed5e6e58aa49f726b3a1a5b20d8cf333f073
TLSH
T1CF614E046F1589A2D723F37350A2D4A8F6E487650607AA23B1B49FF0FA02F5560E07F3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d4fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d4fa.TMP
Size 3KB
SHA256 31833b72bce4093c66e770ce205f99fc9f841456ea73cb9ab6c4829f6a171742
MD5 6a7c63cf9542c691881c43ba664464e2
SHA1 f15d1831c22491656fef7f776ef478e66d057b30
SHA512 8a508b5e91c7e46acb96d92a47a4b823452166cb46d70bb41cecc6213c8b1df04f5adc156695c021fe220e98e90493eea0863a8e08bff2133c855271d389a2dd
TLSH
T1AF612B147F2589A1D323F7B390A2D4A9F6E887250603AA23B0749FF4FA56E1451E07F3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

61912dc9-d70e-48c6-8ba8-4f9f3a02e756.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\61912dc9-d70e-48c6-8ba8-4f9f3a02e756.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e25a7e2f0ac967c0220cc4c26fbea4d044be148fcaedf30ff17b2a0a59052cb2
MD5 dd83c6db50d2cfa041aa703375f30c42
SHA1 f185b6d48679bc25dcf74da096751ac73007ffa4
SHA512 724c8403995d158a2760329cd97f0abd2eed93f107f69e00b7d88a558e43908e211dc8681027c5e36763bea37b15d0554c7a5a57a09efec71ea7fdd2aa53735b
TLSH
T17441AFF783F4856EC91196F0AB18BE2BCE1D0915832C3D5AC9E4AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d6696317db2b71a8170991c9f72f5490eba73b9d0bfe4aa4f7ebf9b5ff21fabf
MD5 03655c9e50fe6999997ec5e4caea5b8d
SHA1 86917d19675fcac1536f01aabad310a53463c9d4
SHA512 62da6cc6c4dad34a39f88f5f2c4d0f7cd0d4892ffc7f093b35d3a7ae7604e0d84d10f75ffd6cc7fabd580b66cc1aa6c624f408dd246b68f9d22d3e7f1ebbcf8c
SSDEEP 384:sxRHD8K/fGspnTN/RI5Id/5IW4NOksGQejl:s7gK/fb5Wk/5IW4dsGQe
TLSH
T1F872E9166A289D3B9CCBD61DFA557F93D6F9113392501E44AAFC8B0C04E66ED2103C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e0654bb9fcb50109372f188ec0103ca055d9c1452d3202b6e99f113af7b11a11
MD5 10eb37e6b3b00867ab5f1ae088a8d88a
SHA1 f2c806cd65b8816326a882dd4f62fcf7b3056129
SHA512 0168303e95d5f24fec1243186a373e647bba4fb3a3308e2ead5d58fc08663410b83a73c82283299998674281de5b81911a158788e9fa850681c31b922d5699a6
SSDEEP 384:sxRHDqcK/fGsJnGN/RI5Id/5IW4wOksGQeAW:s7+cK/fPkWk/5IW4WsGQO
TLSH
T17E72D816A9288D3B9CCBD61DFA957F93D6F9117392501E44AAFC8B0C04E66ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6bfec28e0e230fab781d15e38f5660866c008a08e857c07acff345388b723cb1
MD5 49ab788ff4cf3e3d6a5d3ed95ec0f50a
SHA1 b1786552a2c8677a52e54cc594524a0915af0d7a
SHA512 b9f812fa3dab0cd50d64100ae009d8ee791ce8ee184f9e64ba8a46e3037788af2f83002f9a37d7bdd8f7136e920c60e985e2d62d273b9ee863b775bd9d019895
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOobbDwzro840:Ob4YZnE7yTWg1NfwBu1jatobHwAD0
TLSH
T1CFE2FB3B680CCB7E4F804ADDEC29BD8B6DA801CF5AD8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 614e399c0f37c2734272d03cfac0a56db9ea583171d0fbe2c7671e3e6dab27a3
MD5 ad899072d7c2c3c2f463c2aaf7b254bf
SHA1 606607273f6eb2d9b4d6dbc1888ed16189cbdc8d
SHA512 c82b975fa7ef85d63e91d1091dd063742281cd3f24d1e212eb5e49591aa78cbdf09e75936d7fbefc246b6153899085dc4268aeafb1d47e2896f2be9041982486
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9l2n6b3xdZ4d0z/TB75oX3Ux0pWK:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR/
TLSH
T142B25B11713F4680387EB90C81B8982F96C2B4637519E56F7BAC01A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4f04a286cbe32d0358c0272eb768de287cef8f4ba4f2625ffa47d22cc25e0f15
MD5 f234f1e6983368122c1de2247a6f9f3a
SHA1 d07c4334315e52302ad17a9c454547c018f82561
SHA512 20fed324ff3b3ea713b832c397a12c9a3c5bed80356f4a483a501574be89d77ecf6300b95ef04b424e1719cf59abfe73920cb5bb16131e28dbdc5e81e09f56a3
SSDEEP 384:nJiF1tNn/s3n9Sn8Ng+8TUNTUlIRiPvuTuhRESVfbzGjwTDG1LbqOObjI9G6w7KJ:gF1j+9SX+wgUui1tGCaBbq29MI
TLSH
T1B8C24A36E855CEB7ECE68FD8B34E7A5AEEE0116385AC5AC4EAD95D0C00D719D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a0f8925a667e59a71fa26e48be1b4c5773f748361beb8e9df278e41802b822d3
MD5 42242aebbd04031411ef34f6beb6b774
SHA1 6a64f5a315dce10c6a2b2bac986ff4f21c96cb7e
SHA512 ac7333c77b191ba874ab4cc2d2716e751a5766668cea0190fc5eca5df00a5b5181e964540a8e8f7f25f38bce29b7a20968b1ed9f2d6adeb4c2fde7f500b16a35
SSDEEP 384:n3iF1tNn/s3n9Ss8NL58TUNTUlIRdPvuTWhLluESVfbzGjwTDGGL2nknQ7rp8LEK:yF1j+9pQ5wgDu6lQtGCaJkne8
TLSH
T163B24B32EC65CEA7ECE74FD9A70A7696DEE00163888C9AD4EAD55E4C00D729D0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4b5acab2ee46901e59352310ed91650d7619afa8568e49439f325d5255659ca6
MD5 5c47cc55767c3f3b3368c14907cadfea
SHA1 1dcdeb82b4d8e69f3d20a6854cc23f659d8b7901
SHA512 f78ff48355d4655c72632087cf27fe1a18ab9c0b6df54dd846b3a2f794a97ca3183022a60d8dd0ba083e7984401b046617526ff14aff2ed47338d6aa287bbfca
SSDEEP 384:nliF1tNn/s3n9Sw8NL58TUNTUlIR1PvuTWALluESVfbzGjwTDGGL2nOnOObjI9Go:sF1j+9JQ5wgru6qQtGCaJOn29Mrg
TLSH
T116D25B32EC65CEA7ECE74F99B34E3696DEE01163898C9AC4E6D56E4C00D729D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 485af6761da0f8919d668a11e91ea90a46f5691f1fe6fe30e4c4b794660e8c4b
MD5 ea5d0ff46681f69834b5679be4f41894
SHA1 2e31400a7202bf8fa46abb81ea01c1502b58d0b5
SHA512 d40c410f1c7569c2867b42dfe3cc17708db0c3b1ec824e31f776d1879d5e0fc0450b0c7e3d4127cbdf9770cd5b086e4ea5caa5a723170602cee8559b791085ca
SSDEEP 384:nQiF1tNn/s3n9ST8NL58TUNTUlIR1PvuTWALluESVfbzGjwTDGGL292nOObjI9Go:rF1j+9qQ5wgru6qQtGCaJIn29Mrg
TLSH
T138D26C32EC65CEA7ECE74F99B34E3696DEE01163898C9AC4E6D56E4C00C729D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0ef1f5883f1761d20ddc8d43dcee8f8d3bb93ddf9f1e7a0f1f67bad455473b0e
MD5 c4c85f62be0612a3897833e1b92938db
SHA1 a2067a71af126141a16dd03e4e0d28802e0eada9
SHA512 0f87b10ae704c8f8b2e3a64d088e8af8d207adf8c060c16336a435125567aa2139fdf747498e6063cfb832b402540c87b2ffa73414e70a8456c7c29a1c789b4b
TLSH
T1F7513FE08C381AD5D4BD0A7FB08B34EC81ECC726F49034397858EA985A7975D318083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0d345b7068780d1b70004ac670596aba0db8d8ecf034578654891ddaa8d22fa6
MD5 378833eb694fead430081cb827677f02
SHA1 2d38d095b86cea4bb844ea2bfe24d70081d9f593
SHA512 a1131b2c59499b7a62d50eb3e8aa04c5c3276fabba94590370f87d0cd929e3a95e6a39eafdf1140074b6a8e76eaadfcbc158f2e8baacd955a1f664894238a675
TLSH
T1B65130E18C381AD5D4BD0A7FB05B38EC85ECC726F89034396894EA885A79B5D218487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6df8483901e89dca10a12e16f12b660cef53f74a909d3c8fa4781daf2f780d28
MD5 38043582db7dccd4c7899204e6602c24
SHA1 368fb0b45161b76408578ab2b35e0d23f3b7ea72
SHA512 8754add82d2dfb4b5a9db71d3e81533085059f37789b300c9faa1fad6baf1ebbc8c442616b190240f1494655e3069a64adefd1f75c2911c40b5ffff036ec37b9
TLSH
T13D513FE08C381AD1D4BD1A7EB05B38EC81ECD726F490343D6858EA985A7A65D308083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 7737d3ba8fadd95245f4dc45f663af993542e285425dd7272dbac5815f1f7652
MD5 71fb434d64c8e1e01a80effdee8051a5
SHA1 78ce9f17f4b2a259916bdde2198db0d569fb155d
SHA512 278c5c571655c259db345351eb0d26cac523b6de7e8cbdd5be01a379853006be6148b0dd9088dcb99084bc4fd4d48d4c8167dee5cf67ccab9db1da63db226b89
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3X:CebAjOKn3wRKRJ3X
TLSH
T198D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.old_1784515548

Path C:\Users\Admin\AppData\Local\Temp\2026-07-20_a3e5c423ca60217c7618f9236d442164_akira_glassworm_rusty-stealer.old_1784515548
Size 2.7MB
SHA256 29e71771132707e4e1df7470ba0b6f77727f0710a32e886b7ca6b386e9e1d910
MD5 60826016d3566edfb7f00346f75bfb98
SHA1 969f78191c5bda5252ea5925adbe8e4a36d49d65
SHA512 7bf89267ac1395296df63d03632c1b29daf8e5f1683187f07a2747ebf0c0e6bf534985db406c02a6b2d160f9e250a2af9abd22c3a3194039b74dc414b41f61bd
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3d:CebAjOKn3wRKRJ3d
TLSH
T1E9D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1242595694\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6432-197-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-253-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-232-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-268-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-229-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-300-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-225-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-317-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-323-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-342-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-180-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-166-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download

memory/6432-367-0x00007FF631080000-0x00007FF631341000-memory.dmp

Download