96652b71bf1d46bf71671eb6a7bd65d204cb94d44d6302932920033f115079b7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260727-fa747sgr6x
SHA256 96652b71bf1d46bf71671eb6a7bd65d204cb94d44d6302932920033f115079b7
MD5 ebb81d0820d0f11f10ea61a86d1d9c38
SHA1 93166625d4cb4cf3a2b70b28e0af800ca9df6660
SHA512 6336f09cd93b2d50726106bce425f4f009da5f683157b4042b1fe08918ea4ffa0349703bc33b1d081934b4b701bb3420b2bae2f376d6d7819a55238ca95f3ed0
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3C:CebAjOKn3wRKRJ3C
TLSH
T17CD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1623925921\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1389724621\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1389724621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1389724621\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1389724621\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_497188302\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_497188302\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_333021876\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1724627028\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1724627028\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_1623925921\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_497188302\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1020_497188302\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
700	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296008849915342"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{F6DD21A6-B5E8-494F-9D06-2B5EFAF695E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5192	wmic.exe
5192	wmic.exe
5192	wmic.exe
5192	wmic.exe
4172	msedge.exe
4172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1920	2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5192	wmic.exe
Token: SeSecurityPrivilege	5192	wmic.exe
Token: SeTakeOwnershipPrivilege	5192	wmic.exe
Token: SeLoadDriverPrivilege	5192	wmic.exe
Token: SeSystemProfilePrivilege	5192	wmic.exe
Token: SeSystemtimePrivilege	5192	wmic.exe
Token: SeProfSingleProcessPrivilege	5192	wmic.exe
Token: SeIncBasePriorityPrivilege	5192	wmic.exe
Token: SeCreatePagefilePrivilege	5192	wmic.exe
Token: SeBackupPrivilege	5192	wmic.exe
Token: SeRestorePrivilege	5192	wmic.exe
Token: SeShutdownPrivilege	5192	wmic.exe
Token: SeDebugPrivilege	5192	wmic.exe
Token: SeSystemEnvironmentPrivilege	5192	wmic.exe
Token: SeRemoteShutdownPrivilege	5192	wmic.exe
Token: SeUndockPrivilege	5192	wmic.exe
Token: SeManageVolumePrivilege	5192	wmic.exe
Token: 33	5192	wmic.exe
Token: 34	5192	wmic.exe
Token: 35	5192	wmic.exe
Token: 36	5192	wmic.exe
Token: SeIncreaseQuotaPrivilege	5192	wmic.exe
Token: SeSecurityPrivilege	5192	wmic.exe
Token: SeTakeOwnershipPrivilege	5192	wmic.exe
Token: SeLoadDriverPrivilege	5192	wmic.exe
Token: SeSystemProfilePrivilege	5192	wmic.exe
Token: SeSystemtimePrivilege	5192	wmic.exe
Token: SeProfSingleProcessPrivilege	5192	wmic.exe
Token: SeIncBasePriorityPrivilege	5192	wmic.exe
Token: SeCreatePagefilePrivilege	5192	wmic.exe
Token: SeBackupPrivilege	5192	wmic.exe
Token: SeRestorePrivilege	5192	wmic.exe
Token: SeShutdownPrivilege	5192	wmic.exe
Token: SeDebugPrivilege	5192	wmic.exe
Token: SeSystemEnvironmentPrivilege	5192	wmic.exe
Token: SeRemoteShutdownPrivilege	5192	wmic.exe
Token: SeUndockPrivilege	5192	wmic.exe
Token: SeManageVolumePrivilege	5192	wmic.exe
Token: 33	5192	wmic.exe
Token: 34	5192	wmic.exe
Token: 35	5192	wmic.exe
Token: 36	5192	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1020	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 5848	1920	2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe	89
PID 1920 wrote to memory of 1020	1920	2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe	91
PID 1020 wrote to memory of 3340	1020	msedge.exe	92
PID 1020 wrote to memory of 700	1020	msedge.exe	93
PID 1020 wrote to memory of 2316	1020	msedge.exe	94
PID 1020 wrote to memory of 4148	1020	msedge.exe	95
PID 1020 wrote to memory of 2316	1020	msedge.exe	94
PID 1020 wrote to memory of 2316	1020	msedge.exe	94
PID 1020 wrote to memory of 4148	1020	msedge.exe	95
PID 1020 wrote to memory of 2056	1020	msedge.exe	96
PID 1020 wrote to memory of 5944	1020	msedge.exe	97
PID 1020 wrote to memory of 2056	1020	msedge.exe	96
PID 1020 wrote to memory of 2056	1020	msedge.exe	96
PID 1020 wrote to memory of 5944	1020	msedge.exe	97
PID 1020 wrote to memory of 5944	1020	msedge.exe	97
PID 1020 wrote to memory of 4692	1020	msedge.exe	99
PID 1020 wrote to memory of 3060	1020	msedge.exe	100
PID 1020 wrote to memory of 4692	1020	msedge.exe	99
PID 1020 wrote to memory of 4692	1020	msedge.exe	99
PID 1020 wrote to memory of 3060	1020	msedge.exe	100
PID 1020 wrote to memory of 3060	1020	msedge.exe	100
PID 1020 wrote to memory of 5236	1020	msedge.exe	101
PID 1020 wrote to memory of 5236	1020	msedge.exe	101
PID 1020 wrote to memory of 5236	1020	msedge.exe	101
PID 1020 wrote to memory of 4916	1020	msedge.exe	102
PID 1020 wrote to memory of 4916	1020	msedge.exe	102
PID 1020 wrote to memory of 4916	1020	msedge.exe	102
PID 1020 wrote to memory of 3564	1020	msedge.exe	103
PID 1020 wrote to memory of 3564	1020	msedge.exe	103
PID 1020 wrote to memory of 1100	1020	msedge.exe	105
PID 1020 wrote to memory of 3512	1020	msedge.exe	106
PID 1020 wrote to memory of 1100	1020	msedge.exe	105
PID 1020 wrote to memory of 3512	1020	msedge.exe	106
PID 1020 wrote to memory of 1568	1020	msedge.exe	108
PID 1920 wrote to memory of 5192	1920	2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe	111
PID 1020 wrote to memory of 5624	1020	msedge.exe	114
PID 1020 wrote to memory of 5624	1020	msedge.exe	114
PID 1020 wrote to memory of 5848	1020	msedge.exe	115
PID 1020 wrote to memory of 5848	1020	msedge.exe	115
PID 1020 wrote to memory of 2968	1020	msedge.exe	117
PID 1020 wrote to memory of 3716	1020	msedge.exe	118
PID 1020 wrote to memory of 2748	1020	msedge.exe	119
PID 1920 wrote to memory of 548	1920	2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe	120
PID 1020 wrote to memory of 3312	1020	msedge.exe	122
PID 1020 wrote to memory of 3312	1020	msedge.exe	122
PID 1020 wrote to memory of 4304	1020	msedge.exe	126
PID 1020 wrote to memory of 4304	1020	msedge.exe	126
PID 1020 wrote to memory of 4772	1020	msedge.exe	127
PID 1020 wrote to memory of 4772	1020	msedge.exe	127
PID 1020 wrote to memory of 5880	1020	msedge.exe	128
PID 1020 wrote to memory of 5880	1020	msedge.exe	128
PID 1920 wrote to memory of 3132	1920	2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe	129
PID 1020 wrote to memory of 4172	1020	msedge.exe	131
PID 1020 wrote to memory of 5448	1020	msedge.exe	132
PID 1020 wrote to memory of 5448	1020	msedge.exe	132
PID 1020 wrote to memory of 6140	1020	msedge.exe	133
PID 1020 wrote to memory of 6140	1020	msedge.exe	133

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5848	attrib.exe
548	attrib.exe
3132	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.old_1785127280
  2⤵
  - Views/modifies file attributes
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fffb98fc188,0x7fffb98fc194,0x7fffb98fc1a0
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,10230465814347423002,1494060834324658776,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
    3⤵
    - System Time Discovery
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,5947544907251671417,11592149747032153601,262144 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,9803301735267635527,3422647808272426341,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,3916826329605149503,12869589428266923276,2097152 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,14257442889375325761,12929188619965407485,2097152 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,1081218912285701200,301507158287794108,2097152 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,3292915945466133387,2356000397295665272,2097152 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3908,i,948536569260360762,38118670168115226,2097152 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:9
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5488,i,11340847355217054878,16168412177501876095,2097152 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:15
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,6543589255006842137,16432610272047994953,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,3135172946668606090,241716547719308182,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,7423824711021730475,14953770592876596706,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,15217852310842562880,4463623556199550160,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,15217852310842562880,4463623556199550160,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,14602158817454986393,11753951375249718371,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,606751669249379525,14979461943171729880,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,13933686623647328432,315860764744632785,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,15819069665805086345,8637010380757881793,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,9305258375870981547,16729317238572666201,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,18239021468531861481,2897719689227605662,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12461997864794644067,2507053707139830298,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,2656426955950328000,8698501072486727595,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,18155035859852553980,14332595422452698488,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:14
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3512,i,9061376982047297475,5624410678118531305,262144 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,3814761193213913194,17622933344355880097,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,173389830433960286,289701091005839178,524288 --field-trial-handle=2656,i,560072683329626762,1477330246466861575,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:6140
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.old_1785127340
  2⤵
  - Views/modifies file attributes
  PID:548
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.old_1785127401
  2⤵
  - Views/modifies file attributes
  PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68e3009d-9390-473b-81ca-fb5f6ee29b94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68e3009d-9390-473b-81ca-fb5f6ee29b94.tmp
Size 38KB
SHA256 ddb418a96963eac2adaed1364768e8601c4a8fa4d0a40fa77e78510685cce809
MD5 a281c2ac41ab9d764350982e99c87406
SHA1 68cd8c79959e25737c46cd1cc52fd2ba03a8b125
SHA512 fdba68c2cca2d734eb0ef614c135651ad14aac77ec860b3073b51bb0410e2fbcaaee5273d8779fe105ca8950f964b3c17e048b5aefc4d700694f3331d6f8ad6e
SSDEEP 768:Rrv+4UNbd43XQkc+wfZO9fkuvShCQtW2bwWV:RbsbO3XFwfWfvvSS0wO
TLSH
T1AA03CF36E86899339DE69248764ABB637EB96173C8C54744DACC4F0D028269F370FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68e33ac4aa2e456ecadc75bb30e4f5fa8ad522042b96390251c948e0c4192090
MD5 e97e97ee93418b9f46e1448fb6a55b7b
SHA1 85bc3b81dd4370b2cd4db1bc6917264763ad3540
SHA512 beacc162d51f58184667637847b08a64cb0cf6ece5c6d0603a03bb429aad1b4236278a8f5022cebcdfd5d53979af5bca87ecc0402b494b862a857fe83e2342c0
TLSH
T194D02370BD79A7E1DE1C51388410DE14623643773AD767C69151680E89B004557D7DEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 19c4b2d052562dc5705de85fc4478148ee4c34f8de160bea554d0776efd370fd
MD5 0566aa7904a507b7111a7fa4ba7978d9
SHA1 3396b7748508bec3c7b85715297564389293d4e9
SHA512 bb1d114749b73fdb75344c58c9b09c0c7507c4ffff21d0d3b7d4146541b589ecac2e388d5b2fde10273d47bcfc8a18011989c30d05f27b892dc6e4206a025b7e
TLSH
T184512D85C7232DE2DB17CD7AD4F0641932F3848E21031A96B5885FB4875EF1899C8A9B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fae1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fae1.TMP
Size 2KB
SHA256 1a361634d57cca67ab0d2083fd0f0f78592e3dfa7251b5cbe261d5c15c85cef7
MD5 d695da8a76aa6194c620c713eef8f26b
SHA1 cf5848248e581206411e30f564e2de976e2d42cf
SHA512 1fc064f99c4bad732467b7c8c536af53e88b0e3fe6876492919ed9f195e82f58b502bc157bf1b280a2cca66699fb459d6c97cabbe46e1a03c4fa5a6a4f8ea3e3
TLSH
T1B5512C86C3232DE2DB16CC7AD4F0641932F3848E61071ED3B0985FB4875EF1499C8A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8c12e8c95cb2745fc4fdd147a9940cd50a9bfc2a3b3ea57f737285b0b733fc1b
MD5 f5e6796ec70941d80a9a55b33673a736
SHA1 e07e932488b3eae8d205e5cfb5cf7fa2277159c5
SHA512 b73c30b0016d0d26363b4d88ed04d0e538aaf686ede9aa501abdf8c0210f9f43e66e062c9e499d27e054a92bd97a3907475827b0aaf104475f42d3616ae25df0
TLSH
T13D519EF3C6E8966E890196F0AB147E1BCE2D0914432C3D9AC8E4EF5B97E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dd441e8ec960631e3e55f0ce306df2ea4602770169c08805f211766f567459fb
MD5 6bf3d0d0f7205a725376b8ffbb3df425
SHA1 ded602f6d5dc4a41a44446b6cbbf5ece66adf8f8
SHA512 3d3cf1769715cb71c307790f00a35d02935d2eed22e38ca6a34cd04c3f12f229321da05e441a0ac02d59df5713e21d6a096f0c939f85b3aadbd0fe1685005236
SSDEEP 192:sxRbRYCG/fw+sozpZGtDGzoD8p4R/g6+WNIY3mOwzjGdIgDGOJ:sxRbVG/fLsozn/o/5IlOvJ
TLSH
T1E942B81A6928597B9CC7D21DFA56BF53D6F96033A1901E44A7FC870C04EAADD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 12e60c472b3bbe54f112398feb2af9c0108db21ce8c20d55b57e199872eae072
MD5 1b5191f39a8f0abb145cc4255bb9a0d3
SHA1 e7dc4f52fd604293679479c7f4a2fb183c469156
SHA512 0c63fa9cba793057d83960381bbdb19024cb26e9dc58d750439d867ebae512a5375043216a7af2492bf5130e3befcefc5a8895d177d01cc03649c210ea465518
SSDEEP 192:sxRoRYCG/fw+slbHm2Sm7aKGzoD8p4R/g6+WNIY3B2OwzjGdIgVOJ:sxRoVG/fLslb2vo/5IA2Ovg
TLSH
T15742B9166E28A93B9CC7D21DBA567F53D6F95033A1D01E54F7FC860C04E6ADD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 65b82f60d121d89ff557c3fb708567b82c06f617d05eac69189e426d1cfc7343
MD5 9955f7a2137e7a5b8ae1866aa5149604
SHA1 368b8836f48fdd405e8cf19f7f1e30a8a77df684
SHA512 54a57d541c729efe1dbc8b6c3ebce38cbcd56e521f24b519c77e1ee1955732abe1f310b82556cb9c511ef1be7f5e36e245cdbc1ce3ca940a1a072dbe532eea8d
SSDEEP 192:sxRbRYCG/fw+sobHm2Sm7aKGzoD8p4R/g6+WNIY3B2OwzjGdIgDkOJ:sxRbVG/fLsob2vo/5IA2Ov/
TLSH
T10C42B8166E38993B9CC7D219BA567F53D6FA1033A1D01E44B6FC860C04EAADD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9ff2b5d265e5b6076b9bb2d2fc21d125b626212ea8356259e93242ec6ee66fae
MD5 2e2837c286e2fea37343c5945c5c8953
SHA1 076dd4b7d1257a72b9f0e158c2411dfb1427d3ff
SHA512 6d0831984024f18df144cdd550bb440b57e9056dc843bb4adf48c38d35b725ddeb213702f869825aec300b0c4a4385a2ecbf8fca7e38d786c27e60c9f45d7771
SSDEEP 768:GTEbGo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKMWc6roSYi0:GTEbGUE7lkWg0CfKsu1jaDFcxSX0
TLSH
T19FC2EA7B640CCB7E4F804ADDA819BF9B6D6802CB9A98CD4047FE951C02C6BFE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 528ea012ea78c9f0b22bedaa583d7ba6e0a3d92455a86e659bccc207a56eeacb
MD5 864571e442d778749cd623ac122d85a5
SHA1 9fa07463ff75e07bdae04e16a8175879004798db
SHA512 7843092de0b37081e7c9255ae6831e9ba414b97125fe04eb7104faaf4df384a9485a82b1244c6ed423fe150e2352e54e7c9a97fa68b328250000d33bcf085854
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHlyLf1vz3W7gugn3K4Wg53cdF4LDcuHWKX:C1i7PF/DWrwfX9mgpct1o7zsHlyLf1v1
TLSH
T175918442357F0240383E694CD1E8986ADAC274A73158B53B7BE806E11F67E039DFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a04a7f42-9d2e-43f7-81ba-c7b2328a6a86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a04a7f42-9d2e-43f7-81ba-c7b2328a6a86.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ceeb067476eaba61d5474dc77e84c8637bf33e5c2660d365b11c16cf305953bc
MD5 ce9361a60d428b153a2bc2c4ac671ea7
SHA1 685f8158d7360dcf612f64bc4d8d7b3c8fbc5dd6
SHA512 73ebcafa5374554fda172f747214e780270f2b4e4e8dae3d6e9563637daf87bf8f3728b8301929a9883f91d2689bd2ce01b61d99df6c8dfbbea7bbdeec0976b0
SSDEEP 768:xrrv+4UNbdl3Psac+wfZO9fkhfk066pvShCQR3cqn:ZbsbH3P/wfWfQfq6pvSLcqn
TLSH
T18803BF75E8786A739EF29684B64B7B137EA96123C5C50B44DEDD0F0C02C359E271B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6d12986adce97011ab41808d5abf9b9d9f59533fc9b38a8e8f3c754b2420b94a
MD5 6ca9868156a67315faf91b6406781b98
SHA1 2ef5632af40878d5a6f182381d205ee58960c957
SHA512 c43b84df92863a24b7663c5c38078ac06a2d42b4a9d09ce6eb2631df091b0a3eded0b329f8be8770ba4008b4c7b033dac21b0dc8f4b0d827375a90ef3183d421
SSDEEP 768:pBP3Myac+wfZO9fkhfk066IvShCQR3cq/:HP3MRwfWfQfq6IvSLcq/
TLSH
T19BE2AE71ECB069738DE6968977067B13BEE6A123D5C81B44CADC4F0C01C36AE171B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 54ede260d6a5561153af1fce8da9baa60df2e5d2bb30a90ced97deebb4b03178
MD5 e2d37b9b93b294aa618af0d8fbff51bc
SHA1 09b0294d9523532487e4b2e2d7dd5cdd68601df7
SHA512 dff0da6b7833bb75f913e15fb4ca704340b8c8cf8073e44ed3af6971bd2c8d09cc7f055a8cadad795244b67d9823382aa67aa0b37e156a2964ecf74a6e687f5f
SSDEEP 768:9rrv+4UNbdQ3Pyac+wfZO9fkhfk066IvShCQR3cqn:9bsbC3PRwfWfQfq6IvSLcqn
TLSH
T18003BF72E8786A739EF29684B60B7B13BFE56123C5C40B44DADD0F0C02C759E271B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 59ff83399b514ffc76ff4db38a26f4f348ee9194f33c8fa6de6f75d35201af4f
MD5 4df95e647224282b035f75a7c675979f
SHA1 f927a7aa5bb363ce5bcf056d6c75deacd9a8337f
SHA512 999a45872297a604d2de567704cf5e70d9a8e67fc4e683cd8ebc20654d507f3f2becc8b691ac2f96ff4f26f02d265f96081161b0e2c38d97fbe726fe4c798612
SSDEEP 768:HRFQL32wgNyuZtfZO9fkhfk066rvShCQR3cq/:AL3OHfWfQfq6rvSLcq/
TLSH
T1C1F27C76DCB4DA77ADE29B85B7097613EEE56163C5C89AC4DAD84E0C00C36AE070BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

bbd1b86d-a10b-446b-ac7a-0d334a27533f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bbd1b86d-a10b-446b-ac7a-0d334a27533f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 852d4d90e332b2a1eceb07129846c0f0618bae8ab09dfd556109ba3c1ad4313b
MD5 32a2ffb00d12b789b8ad38e85ff48c36
SHA1 379f2d8b650bad08104b600e41773393e1427d0f
SHA512 0cf404b68ea87d5e72d99565fb987024b11bd4abc153b9ac83175a773cff9c707f7bf18a955629d4d219f190d56e08536a160d30f5b01db1c5067c6a753d60e2
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3A:CebAjOKn3wRKRJ3A
TLSH
T108D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.old_1785127340

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_ebb81d0820d0f11f10ea61a86d1d9c38_akira_glassworm_rusty-stealer.old_1785127340
Size 2.7MB
SHA256 c2064223a9ff33637498b1c8a3d8bc44d5f93f24a5ac708b07d04d9a084e5756
MD5 be591e40c34cdfa9df77cbcb5f3d3d60
SHA1 14fa7d0d193c5a3a3d20559193a15c1860872f37
SHA512 44f2e5f6cb16a188fd7b696246a9f41d05739cbed3b3722df35714364752894cfb8f52350a1890d18cdafbfe0fc3c7ca845b51fcae830093a5466228498abc7c
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3F:CebAjOKn3wRKRJ3F
TLSH
T130D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1020_1438307761\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1920-274-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-366-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-295-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-193-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-325-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-342-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-246-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-169-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-273-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-383-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-389-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-405-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-272-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download

memory/1920-422-0x00007FF61C9A0000-0x00007FF61CC61000-memory.dmp

Download