8f493ef4a1c272f5cbc4b4be11b79b205f26fe28b895a8a7101e614d15e77772

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260723-vfmssatalg
SHA256 8f493ef4a1c272f5cbc4b4be11b79b205f26fe28b895a8a7101e614d15e77772
MD5 55423496fc910220640c86e179b65ec0
SHA1 762f51546e2526b5bc45c36573aca6332deec8d1
SHA512 f590bc2a5a826cdf1a9cdbcb2f09b0927dcd765f2beacbd7dd808c7bc7601b8b87b41cb4684ae5c0b15ea4e23350e906ba9f7b852e9c8850f94266150f315410
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3q:CebAjOKn3wRKRJ3q
TLSH
T11CD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_1491094440\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_1535908770\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_1491094440\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_1535908770\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\product_page.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5308	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292993711591920"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{A7A200E4-AB3D-4454-9CC7-3F8AFA316747}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2700	wmic.exe
2700	wmic.exe
2700	wmic.exe
2700	wmic.exe
6496	msedge.exe
6496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5740	2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2700	wmic.exe
Token: SeSecurityPrivilege	2700	wmic.exe
Token: SeTakeOwnershipPrivilege	2700	wmic.exe
Token: SeLoadDriverPrivilege	2700	wmic.exe
Token: SeSystemProfilePrivilege	2700	wmic.exe
Token: SeSystemtimePrivilege	2700	wmic.exe
Token: SeProfSingleProcessPrivilege	2700	wmic.exe
Token: SeIncBasePriorityPrivilege	2700	wmic.exe
Token: SeCreatePagefilePrivilege	2700	wmic.exe
Token: SeBackupPrivilege	2700	wmic.exe
Token: SeRestorePrivilege	2700	wmic.exe
Token: SeShutdownPrivilege	2700	wmic.exe
Token: SeDebugPrivilege	2700	wmic.exe
Token: SeSystemEnvironmentPrivilege	2700	wmic.exe
Token: SeRemoteShutdownPrivilege	2700	wmic.exe
Token: SeUndockPrivilege	2700	wmic.exe
Token: SeManageVolumePrivilege	2700	wmic.exe
Token: 33	2700	wmic.exe
Token: 34	2700	wmic.exe
Token: 35	2700	wmic.exe
Token: 36	2700	wmic.exe
Token: SeIncreaseQuotaPrivilege	2700	wmic.exe
Token: SeSecurityPrivilege	2700	wmic.exe
Token: SeTakeOwnershipPrivilege	2700	wmic.exe
Token: SeLoadDriverPrivilege	2700	wmic.exe
Token: SeSystemProfilePrivilege	2700	wmic.exe
Token: SeSystemtimePrivilege	2700	wmic.exe
Token: SeProfSingleProcessPrivilege	2700	wmic.exe
Token: SeIncBasePriorityPrivilege	2700	wmic.exe
Token: SeCreatePagefilePrivilege	2700	wmic.exe
Token: SeBackupPrivilege	2700	wmic.exe
Token: SeRestorePrivilege	2700	wmic.exe
Token: SeShutdownPrivilege	2700	wmic.exe
Token: SeDebugPrivilege	2700	wmic.exe
Token: SeSystemEnvironmentPrivilege	2700	wmic.exe
Token: SeRemoteShutdownPrivilege	2700	wmic.exe
Token: SeUndockPrivilege	2700	wmic.exe
Token: SeManageVolumePrivilege	2700	wmic.exe
Token: 33	2700	wmic.exe
Token: 34	2700	wmic.exe
Token: 35	2700	wmic.exe
Token: 36	2700	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 5328	5740	2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe	88
PID 5740 wrote to memory of 2988	5740	2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe	90
PID 2988 wrote to memory of 2300	2988	msedge.exe	91
PID 2988 wrote to memory of 4300	2988	msedge.exe	92
PID 2988 wrote to memory of 5308	2988	msedge.exe	93
PID 2988 wrote to memory of 4300	2988	msedge.exe	92
PID 2988 wrote to memory of 4300	2988	msedge.exe	92
PID 2988 wrote to memory of 3752	2988	msedge.exe	94
PID 2988 wrote to memory of 3752	2988	msedge.exe	94
PID 2988 wrote to memory of 6904	2988	msedge.exe	95
PID 2988 wrote to memory of 6904	2988	msedge.exe	95
PID 2988 wrote to memory of 6904	2988	msedge.exe	95
PID 2988 wrote to memory of 6900	2988	msedge.exe	96
PID 2988 wrote to memory of 6900	2988	msedge.exe	96
PID 2988 wrote to memory of 6900	2988	msedge.exe	96
PID 2988 wrote to memory of 2444	2988	msedge.exe	98
PID 2988 wrote to memory of 2444	2988	msedge.exe	98
PID 2988 wrote to memory of 2444	2988	msedge.exe	98
PID 2988 wrote to memory of 4792	2988	msedge.exe	99
PID 2988 wrote to memory of 4792	2988	msedge.exe	99
PID 2988 wrote to memory of 4792	2988	msedge.exe	99
PID 2988 wrote to memory of 6516	2988	msedge.exe	100
PID 2988 wrote to memory of 6004	2988	msedge.exe	101
PID 2988 wrote to memory of 6516	2988	msedge.exe	100
PID 2988 wrote to memory of 6004	2988	msedge.exe	101
PID 2988 wrote to memory of 6168	2988	msedge.exe	103
PID 5740 wrote to memory of 2700	5740	2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe	107
PID 2988 wrote to memory of 5228	2988	msedge.exe	111
PID 2988 wrote to memory of 2228	2988	msedge.exe	112
PID 2988 wrote to memory of 5212	2988	msedge.exe	113
PID 5740 wrote to memory of 1768	5740	2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe	114
PID 2988 wrote to memory of 2132	2988	msedge.exe	116
PID 2988 wrote to memory of 2132	2988	msedge.exe	116
PID 2988 wrote to memory of 5700	2988	msedge.exe	119
PID 2988 wrote to memory of 5700	2988	msedge.exe	119
PID 2988 wrote to memory of 3248	2988	msedge.exe	120
PID 2988 wrote to memory of 3248	2988	msedge.exe	120
PID 5740 wrote to memory of 5156	5740	2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe	121
PID 2988 wrote to memory of 6496	2988	msedge.exe	123
PID 2988 wrote to memory of 6284	2988	msedge.exe	124
PID 2988 wrote to memory of 6284	2988	msedge.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5328	attrib.exe
1768	attrib.exe
5156	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.old_1784825766
  2⤵
  - Views/modifies file attributes
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffb861cc188,0x7ffb861cc194,0x7ffb861cc1a0
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,8255446105399458142,11324443455589818943,262144 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,6279519525334551052,7774111749725692179,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,10818719855377457390,10543291300109279326,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,1662639020523553421,17721071667838635258,2097152 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,17756780970795126738,17849178004606523264,2097152 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5032,i,13752825906816944672,2944471854723013047,2097152 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:9
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5300,i,12545594927235561001,9362038557659041632,2097152 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:15
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,12749011545625514591,15792424920267991238,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,10831047394616057696,13255707949181985005,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1233111385997660054,15597463715611551101,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1233111385997660054,15597463715611551101,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,11892072752551046286,16977108803710075917,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4046799916821024809,15261150637300318356,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,1210429622003058504,15283228242753768443,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,6500872550071886263,13992298843532586175,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,13135446095780751157,2779114652817019334,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,5134835555836861850,6595130153845682593,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3292,i,8266867467447220128,3904774580009903183,262144 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,10836084308469923509,4489126210814280489,524288 --field-trial-handle=2336,i,9337637176450322363,9638877457767071581,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14
    3⤵
    PID:6284
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.old_1784825827
  2⤵
  - Views/modifies file attributes
  PID:1768
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.old_1784825887
  2⤵
  - Views/modifies file attributes
  PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 77f2e90588156379450a218823121808774c9007dff2bda754d3d1fea9cd9a9e
MD5 47a101eb7947ccd0b5879d955a9fe716
SHA1 12c59352c344e96cc8d205f10560f4d675363d48
SHA512 10b53d91c2527127756d3936c346507fa82d94105ce584242135a8b5f811042380ba2f8c46e16f715a17fbedb14da45f3ce1df4e5432b4a1367126a1a0ee5317
TLSH
T154F0A9AAD921AC3719FC1B1870554A47E750136B3B41984B7B3D921D8FB463B475681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aefb9d6b8b9c53cc7288a56fccc9e97f348293dd96d5d5b64db69df5ff4ad608
MD5 583c534ed24c058d990e44e83a8b44b1
SHA1 4acc3d995f24a5f988adcead466c1244044388cb
SHA512 f23ae86d33dbeff3d41a3e9d43a5e2707c6dc7263b058dafd55b60628f57574bb38422d73bfd6a25b0d95afc020184c8fe4314826618c68025a2e7e0a887a607
TLSH
T1D36181F3171B0AC9CF254D72E2ECB0A83375865701332F628D6776748C827AE1C68C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2e35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2e35.TMP
Size 3KB
SHA256 d9ff6705d547b3b4c4030833c8327a7334c1b420630981670920a571f3fde69b
MD5 e948074d2988bb297c3267d9062e93ff
SHA1 2a11ba09fd41d69fdef58d0f71c51da9f8ecaa1d
SHA512 915fe7fe9b9c5a4aa11fa19e2c0e845f25688febc7b3d61172fd860a279c9b9c42ca5035493a2a6cb6492f7012f5a0784a828712d0ef0a0d86b47cad59015ad5
TLSH
T12D616CF7171B0AD9CF204DB2E2ECB0A83374862741332F629D6339B44C9279E1C68C10
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c6a808efc1ce0d1fcde3f400f1a25c2c893f9d0cb2edd9e9a3f11f833b9aa77e
MD5 453ba7d4eb0edb48d744a67c4e59efa0
SHA1 40a44e5b9309b4aa080a40fff9e5ef57663967a8
SHA512 6f5878413d07339974fd7463e445302e210bc5c852b8b67ae8ab231249314da5682a587e3df83e53e69d504ed60710439fce31685e2387a4654b9457c971b553
TLSH
T18551AEF783E8856DC91195F4AB187E2BCE2D0954432C3D5AC9E0AE1B93E2471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 965595efbe407bbda831462186f82b377bba9740f07942ac893f66cd34ec4260
MD5 f124c8114a22ab6f275b5eeefa586f15
SHA1 ed1c4ad7fd2d9e3e14db1aa61fe5d177e394df31
SHA512 083adf808e1467e13b0930886f51c2308389038630fbb868c55e30c1cb26d724a753e32df267f740d27e23e6472300f0c20b69da5561db9cb6ec7ba7f24ec9dc
SSDEEP 384:sxRtL8Y/fYsWGN/RIi7e/5IW4NOxsGQOjQ:s5oY/fakW3/5IW4+sGQD
TLSH
T13B72FA1A6A349D37DDCBD609FA567F53D6F81173A1505E44AAFC8B0C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1f47dc77eb628c9057abef80aebdd5559abe09851b3732b0423df4d019e11d32
MD5 8d95add0c87a15e60fe76d36fa8688b4
SHA1 9b6ec5c82c43c082bf4b1c8ee09e2a548b4618b6
SHA512 e73103d1f93b7462adb78e942b46775ef024f613125d224b4115d63de309fc8810f03d7393546d70667b1d11474cc71f4355f2bae4794e2b8e78ec55edfc9ada
SSDEEP 384:sxRtLq8Y/fYsspN/RIi7e/5IW4dOxsGQObS:s5m8Y/f4rW3/5IW4usGQd
TLSH
T19672E91AA9245D77DCCBD619F6867F53D2F81173A1511E44AAFCCB0C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72d99b90d9eae481e1e2da2749eb154370d7ea74e67d45f468d2b26f93206c3c
MD5 124e92aa1658506c1cb8f41edd19bffc
SHA1 64b5902d669411c45271027f6f262e6728ccb7d3
SHA512 c6787caf1ee18bdf0a089398f8adb1f920e8503d79ec657882d58c30d744cbbbfc7311f9350be0e792f773205bcc6d09bc3cfa366d679ede54cab7ce4cb99403
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroi4w:Ob4YZnE7yTWg1NfwBu1jasobHwANw
TLSH
T11CE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5646af95adc5746ff13568fbb039e533f9fb599cbdc0baea762a8ad72d78b434
MD5 6b7812db3fec99e55f251c8b52044c20
SHA1 5931238021a516704b670481bcb32abaf680637f
SHA512 85d7825913daf1297bcb4ed403393683230aa27a8853352e19d972d7de83e6b4f80af4cc8c8fb302aa1da78899fff41a88ea0c9bd68f993559b9058f7ff4fb04
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9h7U:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRT
TLSH
T155B24A11713F4280383EB91C9179981ED6C2B4A37519E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6672e7437140d20ada2e6ebb1bf071b21740699c282a6c5a36614880b2be97ac
MD5 da5601e93a3eda0cf7a6b3536db2746d
SHA1 b6bee84b74888f041adbaa52badd54e00ac0572c
SHA512 c42816fbbae359726d7df6a923d00f2d8ac2f0d8d7b6a1a5e61de9b70cb6a4ea92b52c89cbb08f31fc264fc111416f2164f4a609747b232d2799457ab7cb808f
SSDEEP 384:ndiFiZcII8NLC8TUNTUlIR/PvuTrBDEqfbYG8oqGqrT58OObjI9G6w7mEq8LEEIT:UFQIQCwgRuZSG8DGUd829MQ
TLSH
T12FD25C36D864CDB7FCEA4F95B64A7656DEE05173C59C8AC8E6D94E0C00871EE070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 71f87756bbb29134cbed545ac519ffe306c33645c5a7e0e454b309f146a9a821
MD5 86217beedfea74967afb7066ef14ddaa
SHA1 7632fce0e9e5db54bc57d62d0b27911333727f76
SHA512 532255c757ef4d50ee5160ca4c184a802ec81aa08e715288760ce07243fe4d3a981df2105da4e5754f2d05a0381b8cbb77e1923f41cd818c5367aa64f4c39689
SSDEEP 384:nhiF1tNn/s3n9Sn8Ngc8TUNTUlIRiPvuTuCREqfbYG8oqHLPOObjI9G6w7aijh83:IF1j+9SXcwgUu/UG8DrP29MaWa
TLSH
T1E6C25936DC55CEB7EDE64F98B70A7A56EEE0126385D85AC4DAC81E4C00872ED4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6e55c67b191f28b5c42652f2a1c40e466d01a757660888d91d6d128ae4339bcd
MD5 447a0a0dae93a612e5ef952b9ebbbfef
SHA1 bfd847378f059a956e550b7dd0c0dcec6b1605d8
SHA512 01821105245b2e2bd5c1185e75fea155c2b3b57e60879903de986f5c9d33724331bba427d1c0801fabed406f7e2be6deaea25f1e6fbd32f5f4c0fb17332bf766
SSDEEP 384:nriFiZcIu8NLC8TUNTUlIR/PvuTlBDEqfbYG8oqGqrsk8OObjI9G6w7mEq8LEEIT:GFQuQCwgRuzSG8DGUl829MQ
TLSH
T1A0D25B36D864CDB7FCEA8F95B64A7656DEE05173C59C8AC8E6D94E0C00871EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 206ddc571486c9c9e50ea75230ff9aa40bed4bb1ca3deef6bb0d408068e4573c
MD5 a94d9ccd5de0206efacf025220c55b77
SHA1 f725d432b3726e22f3a192b8337f90a505fb7375
SHA512 19002bee9ac80bccb427b671394c649aef3b53f34e10e96f970b432482c6baec3acae91a701a0715f108ff8909640d389a6366c39a1ef0c37bed56499e7a0e61
SSDEEP 384:nYiFiZcIk8NLC8TUNTUlIR/PvuTrBDEqfbYG8oqGqrsN8OObjI9G6w7mEq8LEEIT:jFQkQCwgRuZSG8DGUy829MQ
TLSH
T1E9D25B36D864CDB7FCEA8F95B64A7656DEE05173C59C8AC8E6D94E0C00871EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6100eed85a1b15cba49c64cbcc9279eea19dbf3e41e7498584a7191d525bd6ba
MD5 72df4633679bf3ba93a0228b9b93c0d0
SHA1 88a3bf57af5293b0c34e9e5c0ead9edc69895fe1
SHA512 f4b8f117f4d8d561efc3c2e2abf0092bcc4c1b4601113718989ce008dc05263b51a1eb4375dd3e93a7bc7ad2e2604472e96ebdc6ca95a6ed4e3c8a9d5b2cfdbd
TLSH
T1684132E04C382AD5D4BD097FB48B34ECC5E8C725F490343A7858EA98597A65D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d54dfdf3d79784a23a343d39eb0fdea824cca82a21de0508a9d4cc34165fd54c
MD5 9dcebc0c3173b5818c30e85bd193c36c
SHA1 00696d45ef8bffaa7136a2b91980a1f940a07ea6
SHA512 2eeaf5011474df9006853dfcb1c89819cee08ff97e02c7a98a2552c5757879b6630aa158f0e83bf62af18d2bacdc1f60153c5b8d98106dd6ec310091f18ff889
TLSH
T1184132E08C382AD2D4BD0A7E748B34FCD5E8C725F490343D6858EE98597A65D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0484cb616c7678b6da0981e49980e1737f37254524067edd19d7c038e8e5cc5e
MD5 f8b273cb599e11191a349360643db954
SHA1 635c0a9df5c48689773edf45428f43b341894e0c
SHA512 ca2f8d827cc6defee667d936c6a763a5e328f848bea9570da0ef7cea33c29335971ac76748b784aebbefe95d6a2ae6cc5e2374850dc1280b068a32e035fb7c97
TLSH
T1EF4130E04C382AD1D4BD0E7EB48B38FC91E8C725F490347D6858EA9859BA25D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 784af2c39e7562f0a6697c00e3ae02be1ac3d648ee6c5010e29094e9cb10738c
MD5 08c1b53b8364aeaea4510c591beada79
SHA1 36fed93417a0d92dabe1694dcf753018460a94de
SHA512 f0c07d2b0d25195704c709e74f7a267853b032b88b7738f6f023817009ae3f99594f8d14d71a38825a586d7dcd9e8b07f33906bd0fc26fd0a0a4f5ff81a0bf0f
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3b:CebAjOKn3wRKRJ3b
TLSH
T1EBD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.old_1784825827

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_55423496fc910220640c86e179b65ec0_akira_glassworm_rusty-stealer.old_1784825827
Size 2.7MB
SHA256 972d0562c2d0f63ca13c1b327e927a93948434e2d188705d91ad2eff27cbe28d
MD5 07bba79940494f5aee09418692d40281
SHA1 8247d5ac6af2d1397d6142f5876c2bea5d118351
SHA512 fdf44d69256ac0fa0c7d2838950bf903db7a260df6e83a01f22af91cbe2c87c7289fa743503f8baa1678b94c627339a1a51a5e5ae773abb81a3b6874060f3519
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3k:CebAjOKn3wRKRJ3k
TLSH
T1A3D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2988_700894796\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5740-199-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-256-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-235-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-270-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-279-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-228-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-296-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-301-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-227-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-338-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-182-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-158-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download

memory/5740-363-0x00007FF635DC0000-0x00007FF636081000-memory.dmp

Download