70f945c3adca0fb5b249354049659d9be37963787c4931711dbbe54821d87dac

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260723-vbvylaca47
SHA256 70f945c3adca0fb5b249354049659d9be37963787c4931711dbbe54821d87dac
MD5 9f7b841c763a46575367f9d02454a531
SHA1 da4366aa1aaa2700819b8e61b7e4e62e8104e4c6
SHA512 01bf04695b9a7602f9f1578235b044a6ff592ca1e44ead695fa1ca78c71ac74292ec43358a7dccd43631755d6d0eb27d40cfcf0466c145a8f7378b8a1d514829
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3A:CebAjOKn3wRKRJ3A
TLSH
T125D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3740	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292989752565448"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{7F149440-A7C5-40FF-9A02-4C44C1AA6030}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6020	wmic.exe
6020	wmic.exe
6020	wmic.exe
6020	wmic.exe
4240	msedge.exe
4240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3136	2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6020	wmic.exe
Token: SeSecurityPrivilege	6020	wmic.exe
Token: SeTakeOwnershipPrivilege	6020	wmic.exe
Token: SeLoadDriverPrivilege	6020	wmic.exe
Token: SeSystemProfilePrivilege	6020	wmic.exe
Token: SeSystemtimePrivilege	6020	wmic.exe
Token: SeProfSingleProcessPrivilege	6020	wmic.exe
Token: SeIncBasePriorityPrivilege	6020	wmic.exe
Token: SeCreatePagefilePrivilege	6020	wmic.exe
Token: SeBackupPrivilege	6020	wmic.exe
Token: SeRestorePrivilege	6020	wmic.exe
Token: SeShutdownPrivilege	6020	wmic.exe
Token: SeDebugPrivilege	6020	wmic.exe
Token: SeSystemEnvironmentPrivilege	6020	wmic.exe
Token: SeRemoteShutdownPrivilege	6020	wmic.exe
Token: SeUndockPrivilege	6020	wmic.exe
Token: SeManageVolumePrivilege	6020	wmic.exe
Token: 33	6020	wmic.exe
Token: 34	6020	wmic.exe
Token: 35	6020	wmic.exe
Token: 36	6020	wmic.exe
Token: SeIncreaseQuotaPrivilege	6020	wmic.exe
Token: SeSecurityPrivilege	6020	wmic.exe
Token: SeTakeOwnershipPrivilege	6020	wmic.exe
Token: SeLoadDriverPrivilege	6020	wmic.exe
Token: SeSystemProfilePrivilege	6020	wmic.exe
Token: SeSystemtimePrivilege	6020	wmic.exe
Token: SeProfSingleProcessPrivilege	6020	wmic.exe
Token: SeIncBasePriorityPrivilege	6020	wmic.exe
Token: SeCreatePagefilePrivilege	6020	wmic.exe
Token: SeBackupPrivilege	6020	wmic.exe
Token: SeRestorePrivilege	6020	wmic.exe
Token: SeShutdownPrivilege	6020	wmic.exe
Token: SeDebugPrivilege	6020	wmic.exe
Token: SeSystemEnvironmentPrivilege	6020	wmic.exe
Token: SeRemoteShutdownPrivilege	6020	wmic.exe
Token: SeUndockPrivilege	6020	wmic.exe
Token: SeManageVolumePrivilege	6020	wmic.exe
Token: 33	6020	wmic.exe
Token: 34	6020	wmic.exe
Token: 35	6020	wmic.exe
Token: 36	6020	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4636	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4112	3136	2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe	89
PID 3136 wrote to memory of 4636	3136	2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe	91
PID 4636 wrote to memory of 4100	4636	msedge.exe	92
PID 4636 wrote to memory of 3560	4636	msedge.exe	93
PID 4636 wrote to memory of 3740	4636	msedge.exe	94
PID 4636 wrote to memory of 3560	4636	msedge.exe	93
PID 4636 wrote to memory of 3560	4636	msedge.exe	93
PID 4636 wrote to memory of 4688	4636	msedge.exe	95
PID 4636 wrote to memory of 4688	4636	msedge.exe	95
PID 4636 wrote to memory of 6068	4636	msedge.exe	97
PID 4636 wrote to memory of 6068	4636	msedge.exe	97
PID 4636 wrote to memory of 6068	4636	msedge.exe	97
PID 4636 wrote to memory of 3236	4636	msedge.exe	98
PID 4636 wrote to memory of 3236	4636	msedge.exe	98
PID 4636 wrote to memory of 3236	4636	msedge.exe	98
PID 4636 wrote to memory of 5984	4636	msedge.exe	99
PID 4636 wrote to memory of 5984	4636	msedge.exe	99
PID 4636 wrote to memory of 5984	4636	msedge.exe	99
PID 4636 wrote to memory of 1472	4636	msedge.exe	100
PID 4636 wrote to memory of 1472	4636	msedge.exe	100
PID 4636 wrote to memory of 1472	4636	msedge.exe	100
PID 4636 wrote to memory of 5268	4636	msedge.exe	101
PID 4636 wrote to memory of 5268	4636	msedge.exe	101
PID 4636 wrote to memory of 5268	4636	msedge.exe	101
PID 4636 wrote to memory of 1100	4636	msedge.exe	102
PID 4636 wrote to memory of 1100	4636	msedge.exe	102
PID 4636 wrote to memory of 1100	4636	msedge.exe	102
PID 4636 wrote to memory of 3044	4636	msedge.exe	105
PID 4636 wrote to memory of 4708	4636	msedge.exe	104
PID 4636 wrote to memory of 3044	4636	msedge.exe	105
PID 4636 wrote to memory of 4708	4636	msedge.exe	104
PID 4636 wrote to memory of 5048	4636	msedge.exe	107
PID 3136 wrote to memory of 6020	3136	2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe	110
PID 4636 wrote to memory of 3096	4636	msedge.exe	114
PID 4636 wrote to memory of 3780	4636	msedge.exe	115
PID 4636 wrote to memory of 3492	4636	msedge.exe	116
PID 3136 wrote to memory of 5488	3136	2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe	117
PID 4636 wrote to memory of 1468	4636	msedge.exe	119
PID 4636 wrote to memory of 1468	4636	msedge.exe	119
PID 3136 wrote to memory of 5576	3136	2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe	123
PID 4636 wrote to memory of 4240	4636	msedge.exe	125

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4112	attrib.exe
5488	attrib.exe
5576	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.old_1784825370
  2⤵
  - Views/modifies file attributes
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff95e0fc188,0x7ff95e0fc194,0x7ff95e0fc1a0
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,4482403061288120358,8864098941046495020,262144 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4189853751658268578,12219498982798940789,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,8320987335792962945,6522451417031992175,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,6233494841359207268,16078428282815762513,2097152 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,8719733249867893599,12452698843541518483,2097152 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,5070461922228708387,16800512822712930953,2097152 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,5766072385233270674,7542912928683220849,2097152 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5324,i,17189885717493059802,14070898896617861409,2097152 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:9
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3756,i,8665483534200439291,13573987024923139084,2097152 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:15
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,1944688358311454724,10196989659663526475,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,8897893845207788463,1609197118433627355,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,7894161739433413454,9941610790171374090,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,7894161739433413454,9941610790171374090,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,14307546136777620553,17210288853331426992,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10740889018767025440,7742695226500793690,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,1541415989577968978,5663558078717259749,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16987259964417709695,2646350086400190379,524288 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6472,i,1323861153299459525,15728610449811612929,262144 --field-trial-handle=2648,i,9444299073034827635,11247150987242366302,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4240
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6020
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.old_1784825431
  2⤵
  - Views/modifies file attributes
  PID:5488
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.old_1784825491
  2⤵
  - Views/modifies file attributes
  PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 52a25d5a952e0053ff662bbe2379f97ec910e29546f3a8fb8e2823dde42d5b74
MD5 554d4a1e8e6a7156de129976e1a7ad79
SHA1 e60a014d9282935230034a2996edcb74f4b372ba
SHA512 f8ceca32dd2e81bc43a28931b06538f333d8137c0d8cc8b4a1c677cee649f208e2c18fe4082f6e3600099025a923aa99d989d01a5cfd41d77acdb6f16ac13f50
TLSH
T1E95150B02B234BF2FFE865B573EE84C9B67680590163EE2B005163344C8B77E50DB068
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bda9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bda9.TMP
Size 2KB
SHA256 11b4c3a50b6a1b95908ec24fea3672c9dde2ff921c18b81407c2290eaff10477
MD5 6f13ae3873ee8ac6f6e5698c15da434f
SHA1 daa14506b19d8501cc22539c4b67933f46cc063a
SHA512 3583f0c96e2c401798eb6f924bb37b955c2fadf603855a95d6854af512dc85f7f8a707d8697a4abb0dc39186cd453aa933486362e2f72d4674182942dfee851b
TLSH
T1CC512FB46B231BB1FFE894B573DE80C8B27685594063EA2E405063744DCB73E50DB058
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f19643d796fcd684bbf26a56885aab7f2b80fc6c5e67106c7608b93a86b68a66
MD5 30bef450e2c918e262d010e5e12a72dc
SHA1 9cf8c527d539df66c544c50e6af2535ebb159df3
SHA512 c0c6b2a3a2d4a639b4a173dec92f913bf08d21c2aed28d791f213427c46a2f887879a1dcb0793247e4c06aa129e0d881b0d82fecc5b7e6c8b7dc7841beda8b16
TLSH
T14D41ABF3C3E8856D890156F0AB14BE2BCE2D0915832C3D5AC8E4AE2B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e8e728a53dc9534f513f1b24934377b38c7215beb7a59cb74e57331643cace37
MD5 43da6519dd8c0bcdd224996ab431032f
SHA1 a41d2b6671513943ca83190914c4d0d61992d5a1
SHA512 2a26cbf0ad6acc90a203c71a61830b8727df8dcfb99c57b5daca3850b0264b761c97bc43d04a136ca4d8b8ac970fb491e077bec41b596f885e5eb5e056cf0395
SSDEEP 192:sxRIRQCA/fvsYjHm2Sm7a4wzoD8p4//g6+WNIY3B2Oww2GiIgVoJ:sxRI9A/fvsYj2rK/5IA2Oiy
TLSH
T11C42B7166A28993B9CC7D21DBA55BF53D6F95032A1D16E88F7FC860C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 223d64f6af1f411a1b6af7ab44f7a5e06e82ecb11c694baf44dde8279a5b85b8
MD5 552cd563712a0789a7a6a205d9d9f19b
SHA1 cf4163376e025c8673314c53849cfb5ea1f58593
SHA512 cf261aabaa93472542c4814a42c8f22962fe47bfcef2f324b4254acd79b85f51a82e4b2f1fd24aadf20b077b3821306499aa7f0bd66a2b1c5eb39b611ce8d632
SSDEEP 192:sxRDRQCA/fvscjHm2Sm7a4wzoD8p4//g6+WNIY3B2Oww2GiIgDBoJ:sxRD9A/fvscj2rK/5IA2Oii
TLSH
T1EE42B716AA28993B9CC7D21DBA55BF53D6F95032A1D12E88F7FC870C04E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ca961a57aecf1ae45076d2306c042550fef1e621c134fc22ecd8af94d4e33d64
MD5 4d512db58dfc97fbe481714edaf2013e
SHA1 9519b98e7d61a953116f2a5302c93236618c95ba
SHA512 476162fee135b18bb6c1fb26f0bbda0413956d09090db08e8e993f8c4252abcdba699ff73dab89dad96bb4cc8b13ad1c36a29b4c542adb1c0dd8eb0817fadfee
SSDEEP 192:sxRDRQCA/fvscyHm2Sm7a4wzoD8p4//g6+WNIY3uOww2GiIgDroJ:sxRD9A/fvscy2rK/5I7OiU
TLSH
T19042B816A928993BACC7D21DBA55BF53D6F95032A1D12E88F7FC870C04E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5f164fbae40a77b29ed44ff2f80e0ab0dded2d96cfd9fb38f1219f00faa17335
MD5 c59f94212d3e9856c1f1aadd9a7ba6de
SHA1 d554cf1b2d04c804a5c909e208bfe2aa9bd49633
SHA512 c71a3b299338b5d2b6fbd1ce3a4ba31611c40b424dccbfe80d1388d62845af30238fc81fb81b933f3cf2a10b79d739f0b0da89358ea4469368a47865defd40d7
SSDEEP 768:GTEbto7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKMWc1roAGJis:GTEbtUE7lkWg0CfKsu1jaDFcOjQs
TLSH
T1A0C2EA7B740DCB7E4F804ADDA819BF9B6D6802CB9698CD8047FE851C02C6BFE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f162d6cc3f5022b93474498fcd559738fb2001df39ba0c7a6fb6853f49ac5082
MD5 cc8f018598f02e6c6631646f6f1cebe7
SHA1 ee1b5503a9696b39469117435f70b8ed6cb1e964
SHA512 2ac69f3ce48768c48ed0e85ec01ea81646b92a65f699066963e7729d95cad185222f4e3c826b7a27c106552e4112cb8a4d26c31993d0bc81e5a36788a08ca53a
SSDEEP 768:lJ3nsMc+wfZOLf/66RfI66HvShCQRgb9Md5:lJ3nZwfkfC6Rfb6HvScb+3
TLSH
T111F2CF71EC701A73AEE68B5876463F13BEE19233C6CC4A88D9DD5B0D05C36AE1717825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26666bec6bbd0cd00303bc3f673e91b08b70e1ef193ec3cb795afb9234bcedfa
MD5 8823ffde144fe8eba16d0ab5224b109a
SHA1 4adee2bb1dd6ca8d3918323f0fd40d06aaaf4703
SHA512 ebaae8209d2caa36afbc7082cfe32a9b241905628e67c8903a1099d992905fd8b0fc2380e083d94687708eebdc8c670f692af275ca796b5c37561d5bd3c49fb2
SSDEEP 768:K6FQKL3+wgDuYktfZOLf/66RfI66zvShCQRgb9Md5:KhKL38yfkfC6Rfb6zvScb+3
TLSH
T128039D76DC609A77FEE28B95B7057A17AEE15263C6CC99C4EADD5E0C00C31AE070BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e99f940c1a0c087d2bf6807c65c4680c9fb9d20372a6ab94d54bf1ecfdf7331f
MD5 4001d16f5d584fa8e24fe9f8b626d795
SHA1 0d00d1d9bbf6f9dd1c09006f6153a99e36b22211
SHA512 7cfaa5c7dd701769f25769370a6630ea40b1e514dc22bc0e0a1a25477a5d6452060d8a948752ee22f25cf11fc971859fd19274e8e25556a4d5faeb1b938a1b31
SSDEEP 768:loL3nuMc+wfZOLf/66RfI66qvShCQRgb9Md5:loL3nzwfkfC6Rfb6qvScb+3
TLSH
T18EF2CF71DC701A73AEE68B5876463F13BEE19233C6CC4A88D9DD5B0D05C36AE1717825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 815c21dd92611ba9aaa41cf25027350aedc55304b5ff3abf1357dcb50aa5353d
MD5 073e5f448bfc81d3f1338576d299ac02
SHA1 a5fce67db8255b13498baeae90d2bf36966d1259
SHA512 d2dc8d376d92b2eb37ff81a032e6ec9c71cb327b4bf0f6fbffd1b9d6491788028ff087aa1d361faa634d7413822dbb0e63b449c59498dd7b3d69ba1bfca3be20
SSDEEP 768:Rrv+4UNbd43lykc+wfZOLf/66evShCQtD2bwWV:RbsbO3l3wfkfC6evS30wO
TLSH
T16803CF72E86899339DE782487646BB637EB86273C9C54784D6CD1B0D018369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 26369d98ac4d0af16c4f0387e47d74483590fb544cc263f9712e917d5d6397ec
MD5 4c7054e335096cfbda55d5b6df95b88b
SHA1 bd6168f7a5358d69bce25f0cf8b7c99bed0fe95d
SHA512 5a42f46c4426b9b832e2ad551e3a7426320f05bed28f399343ad9eb5e020977ee16f490eb9859b2736a99b0e1f801cc0c0d14ea76aa4e09d82029f0f2e3b0a96
SSDEEP 768:boL3GuMc+wfZOLf/66RfI66qvShCQRgb9Md5:boL3GzwfkfC6Rfb6qvScb+3
TLSH
T108F2BF71EC701A73AEE68B5876463F13BEE19233C6CC4A88D9DD5B0D05C36AE1717829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48734019-c1b5-4c07-876b-a44eb64f9091.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\48734019-c1b5-4c07-876b-a44eb64f9091.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 e3fc0d7cea4714de32fd1d37d4736cb877ca18b46be0086e815f45128af3f5f4
MD5 7c61470ec18ef9513f7d36856def8aee
SHA1 15010b93ac6bdbbe113fb8309b9c8c86516813a6
SHA512 4506c4d68870d121520373b1c9365309e7cc8f1725aaa709687798828dd1fc8909221b466edaa70d26fa438b1ce9d9f5966bce6b6e49b0867f83b97aa26b9418
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ39:CebAjOKn3wRKRJ39
TLSH
T11AD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.old_1784825431

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_9f7b841c763a46575367f9d02454a531_akira_glassworm_rusty-stealer.old_1784825431
Size 2.7MB
SHA256 34452223f6f9d4a723175b8e7d664b2b5a7e49b019f4c33dc5d6850737f45176
MD5 8527e36ebf5391f7a3ff6b19cdea5c1f
SHA1 5e00cdb51109a23d95b43c34c362cc650fd2ef57
SHA512 b96525625f0e64f968274aa72edcc54b92247c590b503680af9b2592015e325752bae7b531142a6a4500223103709a34935bacc6c3d81b3bf781004475069364
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3t:CebAjOKn3wRKRJ3t
TLSH
T1A7D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3136-243-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-234-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-235-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-198-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-215-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-161-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-217-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-265-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-274-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-291-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-294-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/3136-295-0x00007FF72B1B0000-0x00007FF72B471000-memory.dmp

Download

memory/5048-189-0x000001D1F1000000-0x000001D1F13BB000-memory.dmp

Download