bdbadc58dc4154520247458f6753183bebbdc998436364e5ccb6e4a48a8067a9

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260723-bc2b8abr2y
SHA256 bdbadc58dc4154520247458f6753183bebbdc998436364e5ccb6e4a48a8067a9
MD5 fbbb590738bf828111e88cbf0a6bcba6
SHA1 4abf64d36d3efaf818db35306b523f35a71d1544
SHA512 2e7b6ab623a5a591139f67f2672d5f4eb5fb7331e0c22c5095cc932f08202ca1767af9f1ca68c3fd866711de68dc2d366c1953b5513be80368500b82e9593198
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ39:CebAjOKn3wRKRJ39
TLSH
T1D0D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_119379509\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_119379509\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_51967161\Part-ES	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292420529393276"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{B2BE777B-1A34-46C9-9FEE-8201159C028B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
7064	wmic.exe
7064	wmic.exe
7064	wmic.exe
7064	wmic.exe
7064	msedge.exe
7064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1808	2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	7064	wmic.exe
Token: SeSecurityPrivilege	7064	wmic.exe
Token: SeTakeOwnershipPrivilege	7064	wmic.exe
Token: SeLoadDriverPrivilege	7064	wmic.exe
Token: SeSystemProfilePrivilege	7064	wmic.exe
Token: SeSystemtimePrivilege	7064	wmic.exe
Token: SeProfSingleProcessPrivilege	7064	wmic.exe
Token: SeIncBasePriorityPrivilege	7064	wmic.exe
Token: SeCreatePagefilePrivilege	7064	wmic.exe
Token: SeBackupPrivilege	7064	wmic.exe
Token: SeRestorePrivilege	7064	wmic.exe
Token: SeShutdownPrivilege	7064	wmic.exe
Token: SeDebugPrivilege	7064	wmic.exe
Token: SeSystemEnvironmentPrivilege	7064	wmic.exe
Token: SeRemoteShutdownPrivilege	7064	wmic.exe
Token: SeUndockPrivilege	7064	wmic.exe
Token: SeManageVolumePrivilege	7064	wmic.exe
Token: 33	7064	wmic.exe
Token: 34	7064	wmic.exe
Token: 35	7064	wmic.exe
Token: 36	7064	wmic.exe
Token: SeIncreaseQuotaPrivilege	7064	wmic.exe
Token: SeSecurityPrivilege	7064	wmic.exe
Token: SeTakeOwnershipPrivilege	7064	wmic.exe
Token: SeLoadDriverPrivilege	7064	wmic.exe
Token: SeSystemProfilePrivilege	7064	wmic.exe
Token: SeSystemtimePrivilege	7064	wmic.exe
Token: SeProfSingleProcessPrivilege	7064	wmic.exe
Token: SeIncBasePriorityPrivilege	7064	wmic.exe
Token: SeCreatePagefilePrivilege	7064	wmic.exe
Token: SeBackupPrivilege	7064	wmic.exe
Token: SeRestorePrivilege	7064	wmic.exe
Token: SeShutdownPrivilege	7064	wmic.exe
Token: SeDebugPrivilege	7064	wmic.exe
Token: SeSystemEnvironmentPrivilege	7064	wmic.exe
Token: SeRemoteShutdownPrivilege	7064	wmic.exe
Token: SeUndockPrivilege	7064	wmic.exe
Token: SeManageVolumePrivilege	7064	wmic.exe
Token: 33	7064	wmic.exe
Token: 34	7064	wmic.exe
Token: 35	7064	wmic.exe
Token: 36	7064	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5836	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3216	1808	2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe	90
PID 1808 wrote to memory of 5836	1808	2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe	92
PID 5836 wrote to memory of 5712	5836	msedge.exe	93
PID 5836 wrote to memory of 3244	5836	msedge.exe	94
PID 5836 wrote to memory of 6812	5836	msedge.exe	95
PID 5836 wrote to memory of 6812	5836	msedge.exe	95
PID 5836 wrote to memory of 1036	5836	msedge.exe	96
PID 5836 wrote to memory of 1036	5836	msedge.exe	96
PID 5836 wrote to memory of 1036	5836	msedge.exe	96
PID 5836 wrote to memory of 6704	5836	msedge.exe	98
PID 5836 wrote to memory of 6704	5836	msedge.exe	98
PID 5836 wrote to memory of 6704	5836	msedge.exe	98
PID 5836 wrote to memory of 4620	5836	msedge.exe	99
PID 5836 wrote to memory of 4620	5836	msedge.exe	99
PID 5836 wrote to memory of 4620	5836	msedge.exe	99
PID 5836 wrote to memory of 7140	5836	msedge.exe	100
PID 5836 wrote to memory of 7140	5836	msedge.exe	100
PID 5836 wrote to memory of 7140	5836	msedge.exe	100
PID 5836 wrote to memory of 1304	5836	msedge.exe	101
PID 5836 wrote to memory of 1304	5836	msedge.exe	101
PID 5836 wrote to memory of 1304	5836	msedge.exe	101
PID 5836 wrote to memory of 7072	5836	msedge.exe	102
PID 5836 wrote to memory of 4340	5836	msedge.exe	103
PID 5836 wrote to memory of 7072	5836	msedge.exe	102
PID 5836 wrote to memory of 4340	5836	msedge.exe	103
PID 5836 wrote to memory of 2876	5836	msedge.exe	105
PID 1808 wrote to memory of 7064	1808	2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe	109
PID 5836 wrote to memory of 6860	5836	msedge.exe	113
PID 5836 wrote to memory of 3488	5836	msedge.exe	114
PID 5836 wrote to memory of 7036	5836	msedge.exe	115
PID 1808 wrote to memory of 6372	1808	2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe	116
PID 5836 wrote to memory of 6564	5836	msedge.exe	118
PID 5836 wrote to memory of 6564	5836	msedge.exe	118
PID 5836 wrote to memory of 1404	5836	msedge.exe	121
PID 5836 wrote to memory of 1404	5836	msedge.exe	121
PID 5836 wrote to memory of 5964	5836	msedge.exe	122
PID 5836 wrote to memory of 5964	5836	msedge.exe	122
PID 1808 wrote to memory of 6976	1808	2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe	123
PID 5836 wrote to memory of 7064	5836	msedge.exe	125
PID 5836 wrote to memory of 2652	5836	msedge.exe	126
PID 5836 wrote to memory of 2652	5836	msedge.exe	126

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3216	attrib.exe
6372	attrib.exe
6976	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.old_1784768448
  2⤵
  - Views/modifies file attributes
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd3afec188,0x7ffd3afec194,0x7ffd3afec1a0
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9855328523896694481,4053057766143678954,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,7839733322605458859,2186071318960909676,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,12850579392011621356,5803929854173064226,262144 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7934907450941259732,14177747747844805416,2097152 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,13872818759200497157,8561982847044137178,2097152 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5024,i,15386345586801968039,7593972237458221693,2097152 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:9
    3⤵
    PID:7140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5340,i,2191704865404936653,4480622674383524231,2097152 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:15
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,16796946962770590763,9029786699030386260,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,7963408059876805854,4065757250310151197,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10776772520151225059,636989700927634253,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10776772520151225059,636989700927634253,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,9189181839381878998,13698538846894670300,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,11644206513854859827,4567305897957999421,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,18198777783358192712,17625482017384873206,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,11350570537634407333,9940897363943358399,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,8446908692014039260,6354692118758964595,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,4972733455834609527,4734181922852004295,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2504,i,16182399290535706168,2683455883213879711,262144 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,4891799753823934970,9433635449030967298,524288 --field-trial-handle=2300,i,4705407597569382849,4304929479996683920,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:14
    3⤵
    PID:2652
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7064
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.old_1784768509
  2⤵
  - Views/modifies file attributes
  PID:6372
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.old_1784768569
  2⤵
  - Views/modifies file attributes
  PID:6976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7e18d5a6459bcae29e84b943644aeaf3f72786d7780378ceec8d7d757b4e408a
MD5 5d5c2cad0c682957c520461765c7547d
SHA1 c39cfd64999defe04601e9c583af64a805e13b75
SHA512 b6d28e68cea9a768f74c9c21c7e1a3ed3fa1439db4b9d60ac81b8017fd0a2fed052068b274ff640e5e8d13f3d7565f649fe10bede4fcb2d4091b4389b289a719
TLSH
T1C4F0CDA6D921AC3B19FC1F1970A44B47EB51136B3B41995B3B3C821D4FB463B474685C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6b22f170368ec14b456d52f84935dcccde1141e5b1e8bc858de480f011aecb24
MD5 7f2ce91647cfa49321c39bd1f9f03110
SHA1 c748b5ed1e2547a994f780232f3c38bfd236f540
SHA512 7b61660c99aa7e7684c9ba08a3505052bf8933161d8735f6fadba631dd2b08f57421c4250aa58020b6583228f5edf4b3339bb6b4a93b80e4daf2f3af8d14d216
TLSH
T1C26181D0432F1EF1E7A507B53DFD8B49363498BD660F5EA1C854D23368E232923B6860
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ecd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ecd7.TMP
Size 3KB
SHA256 9f92ec8cafd773506ab68a428f5e43b11b37fde223bff168eb37d357eab6e70c
MD5 71068ea52dd4cdb65597713c7a70215e
SHA1 ebccad63de639de45e366b21df4855b3f2e59739
SHA512 d25280441d6f1d139a78fb00217e9a3b3105bf874289eaddab41b6db8fd37feaa609a9fff8c7a646b542e33de7b32d8bcaf1987cf6ae5d780666fc798a57b497
TLSH
T15A615FE0432F1AF1E3A447B53DFD8B89763498B9620F5EA1C854D17758E632823B6860
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6719d79f434cc92d246b5cfb6dd0e3d381474571904de0c130362e2529ddbfed
MD5 65a6f44f15c75ce5c31f33dc62ea0c39
SHA1 da51e818c6b73da3513ec9ff1644491918dc6330
SHA512 617cab8ea0f11dee7dbe05b2fc40ac85c8d5bde440d573884f5e629bf8ca0f3056dec79fc9617868136471b138d9c84aa93a22e5a238638e04f5bf5215d94877
TLSH
T1EC51CDF7C3F4852ECA1195F0AB187E2BCE1C0954832C3D9AC9E0AE1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c14ecff3545aa98a99cb462e6c1cb1d3c29f68193e0cfe7fde83a7d662032cc0
MD5 17f8839dcf02538c16c5da9ae97230c3
SHA1 9630ef37ccb4c9cf71cc2ea9a871997aa8a24d81
SHA512 cfb4052656be8a0cffa3c38dfaee0a7c5cbc9928b7158ee82a3d902aef768fcb8757211b21eb487b731dbdff8985506a205a619483feff0ab4debd74636a4bb9
SSDEEP 384:sxRtY8Y/f9sstN/RIHsM/5IW4NOIsGQVjb:sR9Y/frvWf/5IW45sGQ5
TLSH
T17172EA196A389D77CDDBD209FA957F93D6F8117391505E44AAFC8B0C04E66DD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 aaf34a3a78ab609164c9532b589f5853d06bce1513bf563fe2153ef876ae96c9
MD5 4cc7172a40b36b839aa53e0571ee1156
SHA1 15fee4000702322fb9fdbd99c06e99bc2b230a42
SHA512 6c0cc1c8109a35867d1012da7c3da241abfef2ff21924ce08273a90f79929523261aeadd1f2565c5494432923e55b6ef300e70ad7389fea1c0276a067ce23582
SSDEEP 384:sxRtYqmY/f9sjbN/RIHsM/5IW44OIsGQVXUG:sR/mY/fERWf/5IW4qsGQD
TLSH
T13972E819AA289977DCDBD219FA857F93D6F8117391501E44AAFC8B0C04E66ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 872395ee87650a64cf8ab6c563cee15668e692c78e0fc350ba94f96a0bf18a92
MD5 a04bdfd34b2fca1a3abf7d17fbf0cfc6
SHA1 904cc7f9b7c4cbfcdb27ffab2dd4f17ab39c784a
SHA512 77bad33bcdbda128925ef4ba7b3ade132238ccf29371a2ae7ec42310cb30feff37a6ba4045b128d1618deeb09971f058445e2f176f3e1135f76975b13e2ced38
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYobbDwzroB4xS:Ob4YZnE7yTWg1NfwBu1jaHobHwA2xS
TLSH
T148E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9da1159cabd40d4067a9b2d71dafcc15cec7d3e85c1cb45feb051be542e588db
MD5 1e630c8332dce81f924992493feb18ab
SHA1 4837fddcf9a42a76cb3a121fb622d2ea81e5ddd6
SHA512 5a503b6775fe199b3a996d6ce6a49c7477b906465f4cfb9cf410e520a79a312f7b28f29fee2cb225996fffb13e1146e4203fc92388bbbd204f8a4fc514fca742
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9ftp:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRC
TLSH
T11BB25E11713F4680383EA90C91B8981F96C2B4637519E53F7BA802A65F67E139DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1ed3cfdf3193b0c8dc9c5ed6e23489db272ee3c0e9575d47b840b366a7b09543
MD5 fef7a1ba793304bc0853bd4c9fa2963f
SHA1 57f9935804252d2a7ad7a5f7b709e5841f110072
SHA512 67e4cc8ef6e9086fa02624598a98cbfc968256ed1acaaf0d3f4f7a4f0818ce6f95db64b054541d372190227a2e54d274cda15b166ffdffdfc2b395d703004885
SSDEEP 384:nLiFiZcIH8NLw8TUNTUlIRQPvuTynlEqfbGGj6P57ClAcaTey2vAkmOObjI9G6wx:mFQHQwwgKu+uGmLTeywm29M1
TLSH
T1DAD26C32EC64CE77EDEA8E95B64A7646EEE01273C59C9AC8E6D85E0C00871DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a164bd14589d72fc1aca32fb45ba5b5705bb5fac5e646b8d0442c7063ff2f97a
MD5 44dc6179f7a1bd791cdcfb1bd5007722
SHA1 9748d8a2bb3a63ce1a06250d133a38c4fb2daf03
SHA512 b0c55e362ec398cce8f519a7046d5f0df88ebcd5c9010e1e27bbfdb0bc06a9ec55edd2364656cc024af1c04c3d70d50239485e807cee187ea1f3d03dd15b97c2
SSDEEP 384:n7iF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTuQREqfbGGj6P57ClAcaTZLUOObjI9GK:WF1j+9SXmwgUulqGmLT1U29MW
TLSH
T105C26C36EC69CEB7EDE64F99B70A3A46EEE00267849C5AD8D6D85E0C00872DC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5fe25848f6abf440095325d9b971685d2cdbae7bfc050522c8e947ac03cda9cb
MD5 4075f87a7ebed9597801dec1920d1559
SHA1 e15912b47d73b601ddee66c77c16821d21218ddb
SHA512 43de4e0c99ef93b9b6cfa04c22dede054ec92672c4a40b07ecc7b70e50530b1f3e15dcde454e3596bb4c46d0cd5f74cc56ea2702c3b6de6c48a4e2b793949ffd
SSDEEP 384:niiF1tNn/s3n9SZ8NLw8TUNTUlIRkPvuTxnlEqfbGGj6P57ClAcaTey2vAkmOObj:pF1j+9QQwwgiu5uGmLTeyQm29Mn
TLSH
T1B7D26D36E865CE77EDE78F99B74A7A86DEE01263848C5ED8D6D85E0C00872DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 28801590f1c49bb953ffd3935723cc2a50eeef384d91920e9e3d69e4422d6e42
MD5 11f3cf668e15650076a967189130effc
SHA1 102bd99c31362b157f30cd10896c18cb3eb186c7
SHA512 34f5f287d8b38ace361b7ff7cfa3f1297eeb09790024ea88c0fd158807a98b8a5c5024c84ba12c1c15cbf41509a4360ca56d656910f6c884ff2de3f4a5f51976
SSDEEP 384:niiFiZcIH8NLw8TUNTUlIRQPvuTynlEqfbGGj6P57ClAcaTey2vAkmOObjI9G6wx:pFQHQwwgKu+uGmLTeywm29M1
TLSH
T1ACD26C32EC64CE77EDEA8E95B64A7646EEE05273C59C9AC8E6D85E0C00871DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5315c547f9599a6170937fe7350b15e6e7d42bd0e34deb60ed3ec76aa635b1ec
MD5 ea512c08efed8634b87612aeb86671cd
SHA1 fc85098596bb8b4e9a5d52a8f13691a73b8520d1
SHA512 bbe85e6cf04f57efd735790fbd66e5936dc91869fa497f52cac9fd1ea18dd6ea87a9c00a076fb2c6869fb1795629987e43ef027df7d245b7145cc7d849e34642
SSDEEP 384:nriFiZcIp8NLw8TUNTUlIRQPvuTynlEqfbGGj6P57ClAcaTey2v+EmOObjI9G6wx:GFQpQwwgKu+uGmLTeyYm29M1
TLSH
T1B2D26C36EC64CE77EDEA8E95B64A7646EEE01273C59C9EC8E6D84E0C00871DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4b91056f38270d61a63a87787b6fd49431839e8b578e9b2414652d0825e9f8ce
MD5 e1480390151d60f2508e80f4a5979dc0
SHA1 2139b7c0a546c3f8bc64b6638b5fb0c0bc8bbad8
SHA512 b84e338afd610a783e88eacff1ba9cb5eeaeca64a9d4e5d1cae2fa1064b27b488eedf4de962c0be0d9f8b2abe56710ec779bbaa52c0e74bc1f0d60961ded26c5
TLSH
T14F5141E08C381AD1D4BD0A7FB49B34FC85ECD726F89034397859EA985A7975D218087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ab7bb1ab816113b662b05d6c31a31bf4282c0e4f1921853a957b97743d753486
MD5 cc5579abbe785e2f92018e4bf594247e
SHA1 a6cbd5acbf4a5bf203beb06c92ccf3804a6e5627
SHA512 158235f6665477b40e2409f4072cc7dd208703dbfb56a3aa70929c408d47076f803e35d887629ba727122e9bd8afd86aae7d181aaa573c4b21ef598b57f1b763
TLSH
T1AF4141E08C382AD1D4BD0A7FB08B34EC84ECC726F89034396859EA985A7965D218083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5d7ff00a5258a2e70e19d7963351398fc5d1e21bd3eebd38a87e67d13d96e9d3
MD5 b2a21b22374ef9052538509a9d0ecd38
SHA1 281658fdc61c750f109aaa6e77a1ee1c7ebd87f5
SHA512 a26df02653a597a69233ee83a0b43c48b0bc2b341b2b0b427b16bb4ae322fb489486ecba31ca48b724710ac10a42e66eb7fb232391dd78c5dc5f1fa02c4423dc
TLSH
T17F4131E08C382AD2D4BD0A7F749B34FCC4E8D726F890343D6858EA985A7965D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 c988c9b049014c41dcce9c078028b9c182d16b44992124c244b6c78a7bf77529
MD5 a7ad3eab53d6f7900c867ee839402acb
SHA1 28f07cfcbc35a9dd172f2f04605ef42f0692bd6c
SHA512 7351581021daedf6e13e043c8308454c564189d7b35cb1271c915ecba4f6e8f41336b68aa03eca3ee5b2a0a40f431e3f8f26157d0c807217c66ef8f718696b6e
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3t:CebAjOKn3wRKRJ3t
TLSH
T1EBD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.old_1784768509

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_fbbb590738bf828111e88cbf0a6bcba6_akira_glassworm_rusty-stealer.old_1784768509
Size 2.7MB
SHA256 4048fea6f50367ab393b62be9e9247451c2be95feb77eef2f5fd8127a3c0158f
MD5 910cb0f85dbd6c246fe102a22e6b4f3d
SHA1 9c87370a85779856f33f14e27f8f7c7170f4d4ca
SHA512 1868bdcf3ec63744574dbb231b23427ca0c5b254a8c6eea1cadb5481c5969e3b385fcdfcc8bdc3338349b22253e0b83f1fed5faf747fd071fec926f88f7895f1
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ30:CebAjOKn3wRKRJ30
TLSH
T134D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1651664804\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-180-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-200-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-269-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-197-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-302-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-226-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-319-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-320-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-373-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-156-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-225-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download

memory/1808-398-0x00007FF6F65A0000-0x00007FF6F6861000-memory.dmp

Download