0ab8d7f74f783bbdfab3c98632bde8929603a3c4e4c8df73a3c5220c978f0bb9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260803-cw8fbaba38
SHA256 0ab8d7f74f783bbdfab3c98632bde8929603a3c4e4c8df73a3c5220c978f0bb9
MD5 9159a0df58b0e72a986f8b56b6b83a64
SHA1 720a25fb50d386c1a994827f15e87cb67f1b8073
SHA512 2ff4e28efdca404ef2d12901e7941107f493b911d34c3b0dd4b4eac7504f7593eb67cf8ca115adbcb9155b67c95cf5e239d569a6ae43ca6dc67e5d111af84064
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3c:CebAjOKn3wRKRJ3c
TLSH
T169D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_642799965\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_267844138\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_642799965\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4604_589834163\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_642799965\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1202956064\_locales\kn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301976425863910"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{1EEEA2FC-842A-4FD1-A390-B377FE1480F4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4056	wmic.exe
4056	wmic.exe
4056	wmic.exe
4056	wmic.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3692	2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4056	wmic.exe
Token: SeSecurityPrivilege	4056	wmic.exe
Token: SeTakeOwnershipPrivilege	4056	wmic.exe
Token: SeLoadDriverPrivilege	4056	wmic.exe
Token: SeSystemProfilePrivilege	4056	wmic.exe
Token: SeSystemtimePrivilege	4056	wmic.exe
Token: SeProfSingleProcessPrivilege	4056	wmic.exe
Token: SeIncBasePriorityPrivilege	4056	wmic.exe
Token: SeCreatePagefilePrivilege	4056	wmic.exe
Token: SeBackupPrivilege	4056	wmic.exe
Token: SeRestorePrivilege	4056	wmic.exe
Token: SeShutdownPrivilege	4056	wmic.exe
Token: SeDebugPrivilege	4056	wmic.exe
Token: SeSystemEnvironmentPrivilege	4056	wmic.exe
Token: SeRemoteShutdownPrivilege	4056	wmic.exe
Token: SeUndockPrivilege	4056	wmic.exe
Token: SeManageVolumePrivilege	4056	wmic.exe
Token: 33	4056	wmic.exe
Token: 34	4056	wmic.exe
Token: 35	4056	wmic.exe
Token: 36	4056	wmic.exe
Token: SeIncreaseQuotaPrivilege	4056	wmic.exe
Token: SeSecurityPrivilege	4056	wmic.exe
Token: SeTakeOwnershipPrivilege	4056	wmic.exe
Token: SeLoadDriverPrivilege	4056	wmic.exe
Token: SeSystemProfilePrivilege	4056	wmic.exe
Token: SeSystemtimePrivilege	4056	wmic.exe
Token: SeProfSingleProcessPrivilege	4056	wmic.exe
Token: SeIncBasePriorityPrivilege	4056	wmic.exe
Token: SeCreatePagefilePrivilege	4056	wmic.exe
Token: SeBackupPrivilege	4056	wmic.exe
Token: SeRestorePrivilege	4056	wmic.exe
Token: SeShutdownPrivilege	4056	wmic.exe
Token: SeDebugPrivilege	4056	wmic.exe
Token: SeSystemEnvironmentPrivilege	4056	wmic.exe
Token: SeRemoteShutdownPrivilege	4056	wmic.exe
Token: SeUndockPrivilege	4056	wmic.exe
Token: SeManageVolumePrivilege	4056	wmic.exe
Token: 33	4056	wmic.exe
Token: 34	4056	wmic.exe
Token: 35	4056	wmic.exe
Token: 36	4056	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4604	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 940	3692	2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe	88
PID 3692 wrote to memory of 4604	3692	2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe	90
PID 4604 wrote to memory of 1188	4604	msedge.exe	91
PID 4604 wrote to memory of 52	4604	msedge.exe	94
PID 4604 wrote to memory of 3580	4604	msedge.exe	95
PID 4604 wrote to memory of 52	4604	msedge.exe	94
PID 4604 wrote to memory of 52	4604	msedge.exe	94
PID 4604 wrote to memory of 3724	4604	msedge.exe	96
PID 4604 wrote to memory of 3724	4604	msedge.exe	96
PID 4604 wrote to memory of 1496	4604	msedge.exe	97
PID 4604 wrote to memory of 5824	4604	msedge.exe	98
PID 4604 wrote to memory of 1496	4604	msedge.exe	97
PID 4604 wrote to memory of 1496	4604	msedge.exe	97
PID 4604 wrote to memory of 5824	4604	msedge.exe	98
PID 4604 wrote to memory of 5824	4604	msedge.exe	98
PID 4604 wrote to memory of 1708	4604	msedge.exe	99
PID 4604 wrote to memory of 4584	4604	msedge.exe	100
PID 4604 wrote to memory of 1708	4604	msedge.exe	99
PID 4604 wrote to memory of 1708	4604	msedge.exe	99
PID 4604 wrote to memory of 4584	4604	msedge.exe	100
PID 4604 wrote to memory of 4584	4604	msedge.exe	100
PID 4604 wrote to memory of 4240	4604	msedge.exe	101
PID 4604 wrote to memory of 4240	4604	msedge.exe	101
PID 4604 wrote to memory of 4240	4604	msedge.exe	101
PID 4604 wrote to memory of 5724	4604	msedge.exe	102
PID 4604 wrote to memory of 5724	4604	msedge.exe	102
PID 4604 wrote to memory of 5724	4604	msedge.exe	102
PID 4604 wrote to memory of 3048	4604	msedge.exe	103
PID 4604 wrote to memory of 3048	4604	msedge.exe	103
PID 4604 wrote to memory of 2056	4604	msedge.exe	105
PID 4604 wrote to memory of 2056	4604	msedge.exe	105
PID 4604 wrote to memory of 5104	4604	msedge.exe	106
PID 4604 wrote to memory of 5104	4604	msedge.exe	106
PID 4604 wrote to memory of 1300	4604	msedge.exe	108
PID 4604 wrote to memory of 5060	4604	msedge.exe	111
PID 4604 wrote to memory of 5060	4604	msedge.exe	111
PID 4604 wrote to memory of 120	4604	msedge.exe	112
PID 4604 wrote to memory of 120	4604	msedge.exe	112
PID 4604 wrote to memory of 5740	4604	msedge.exe	113
PID 4604 wrote to memory of 5740	4604	msedge.exe	113
PID 4604 wrote to memory of 2108	4604	msedge.exe	114
PID 4604 wrote to memory of 2108	4604	msedge.exe	114
PID 3692 wrote to memory of 4056	3692	2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe	115
PID 4604 wrote to memory of 5108	4604	msedge.exe	119
PID 4604 wrote to memory of 1268	4604	msedge.exe	120
PID 4604 wrote to memory of 3488	4604	msedge.exe	121
PID 3692 wrote to memory of 4920	3692	2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe	122
PID 4604 wrote to memory of 1148	4604	msedge.exe	124
PID 4604 wrote to memory of 1148	4604	msedge.exe	124
PID 4604 wrote to memory of 4756	4604	msedge.exe	128
PID 4604 wrote to memory of 4756	4604	msedge.exe	128
PID 4604 wrote to memory of 4216	4604	msedge.exe	129
PID 4604 wrote to memory of 4216	4604	msedge.exe	129
PID 4604 wrote to memory of 2816	4604	msedge.exe	130
PID 4604 wrote to memory of 2816	4604	msedge.exe	130
PID 3692 wrote to memory of 4476	3692	2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe	131
PID 4604 wrote to memory of 3000	4604	msedge.exe	133
PID 4604 wrote to memory of 3368	4604	msedge.exe	134
PID 4604 wrote to memory of 3368	4604	msedge.exe	134

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
940	attrib.exe
4920	attrib.exe
4476	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.old_1785724037
  2⤵
  - Views/modifies file attributes
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2ec,0x314,0x7ffa7ae7c188,0x7ffa7ae7c194,0x7ffa7ae7c1a0
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,17770926887757774911,4507663410506593288,262144 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,5260817915782777906,14347714818987900285,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,12975644759320255760,10145219337444432302,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,11837155257983824513,5382220725602898610,2097152 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,17934321357625968253,6600449440444391742,2097152 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,16944708020871027795,16858563952478881717,2097152 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,2537028796523254955,6125375393729510491,2097152 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4560,i,851691685776450113,1650549740268149466,2097152 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:9
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5500,i,13123378328292555774,4990773837364102513,2097152 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:15
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,6807747346260764303,17586487521772580046,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7416211450810802531,14315215868467001699,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,15958975345747208897,13313341287622440273,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,3077188696734286113,8120441898983216233,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,3077188696734286113,8120441898983216233,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,14910122997176578577,15127513759606030549,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,18272573467701872128,9166749171894384172,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,2756206712216423534,13305337460911464190,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,10727832069741662769,13750915176781783789,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,2766181653231426517,13217467710198660827,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,8403485512551812800,13107601319554065160,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,1151737135781930335,266092462269989406,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,8995952851173192273,3033965088939761583,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,12528046978122614658,15406579353351736943,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,7528945895920120397,7782354413774888002,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,5993193009960131763,14514236536554075167,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,4995464408201795963,8259923047570090028,262144 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,13357851180438152320,14505114507720158660,524288 --field-trial-handle=2144,i,4364647636715154294,12154290783005809694,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:3368
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.old_1785724097
  2⤵
  - Views/modifies file attributes
  PID:4920
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.old_1785724157
  2⤵
  - Views/modifies file attributes
  PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 00a9281b55881e1ffb31252cb20c5dfd9ee044e2ffd37ed6f8bfe807f59194bf
MD5 4dde12aaa0bb6799d7b63c7b19dae15d
SHA1 3a5ec6ac9cce23651ec69859d7fc5b394ff745a0
SHA512 08680b0eb1b8002f29c5b670865cd1c425cfd937ce7ab1048fcad389b8a7cbc9170936edd0861b92b6749465e1e92fb90b19d12c5e8dd77d6a4a316df687b2ae
TLSH
T19F51C86D233F36CDCB7541B994E4598933F0A45B8AA3EF22C1441D7A89D2F24EDC9893
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b58b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b58b.TMP
Size 2KB
SHA256 161ba73cc4c4110f82f301d4cb59dd2a908e394ecaa4a377c05628f83e8ad991
MD5 cff7781561b9becfc284bf72931fb3be
SHA1 69251988d51b04f5dbe5155cc310ca4396bf33db
SHA512 9d4a716fa265b8efd5daa130f7afa6ad50b311e2b97569ff528aa72f205f7d3faa089d2114d8b4b476b5e0c3c4d65fc301b1a3d85d3b3f391bd1094729f7194d
TLSH
T1BC51C66D233F36CECB7480B994E4618932F0A45B8AA7EF22C0001D7A49D2F10ECCA853
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f1ca99dc7c7b3eaebec24d4c487ff528caf45cfcfbb1093d725dd22b6295e8f7
MD5 11722aa623fe3e9f8c8d58a2841d3def
SHA1 7bab1f382e86389be0bf3d6c950fc76550cdc902
SHA512 3a0fb8fdb45a7af837c5f44bf660f4d3618e0b834e2ea13aaf319ccc9b9f0b2c0b5cbd48bcf992356653a5e3e67a76298741b4be9fc1a1ace6d83dd329081ec9
TLSH
T1C2519DF7C2E8866EC91156F4AB147E2BCE2D0914832C3D5AC9E4AF2B93E3471D14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5e5ca1e52d36a67074863c3363d97dafb58c0bc33230431730413842918282f3
MD5 d58080701cda3913eb315df47412e5ad
SHA1 909a8f2eb184b0edcba91c6ddec4b30a5c98c30a
SHA512 40b2c305d6472c645594662779e0aec28172360cb16abdeb8bc5cf876dce7e533066298ef628c5d288f39b35d28a0dd32f8115fbb0b27a1d475487d9cbfedbd3
SSDEEP 192:sxR2RVCz/fDskXFZ9zoD8p4V/g6+WNIYC7OwhuOCGiIgDJ3T+J:sxR26z/fDskXrZA/5IBOYEg
TLSH
T1A142D916A928A93B9CCBD21DBB55BF63D2F9503261901E58F7FC961C04EB6DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dd6a38e66cb709ecccfdb26a35c37fae51fb418f6a40e34fa8dfefe9cfe4e2cd
MD5 c72030f6be57528bf86c1742fbdb0a6d
SHA1 c26bf70b8e7e69b61bd21a5c114312bcaf735f8a
SHA512 c8e6e2a954041437c9441f0cf5b831c8aaf3c896b168414c73b8546a1b11a3ad34ee3ae4b4e580b74c5c5c087c329c14e4bf91ac634749d659d25d21a528b3c6
SSDEEP 192:sxRdRVCz/fDsusFZ9zoD8p4V/g6+WNIYCAOwhuOCGiIgV3T+J:sxRd6z/fDsusrZA/5ICOYEo
TLSH
T18442C8166928A93B9CCBD21DBB55BF63D2F9503261901A58F6FC961C04EB6DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4bb20cb1d7bf64dfa278ef58d1c32a21dc9b264e6f90962ecf204729068ed410
MD5 84079a70fc4b7cf82f1b3e69ca0405fd
SHA1 5aecf547f2db56eef5fca015af57600a8cda2c37
SHA512 8c0bd4a193441c8270d61c2d051698f4cb6442a4e231b54f3c076ba9a0afe8c303da7bfaf51bdbcdcd94d875b09ca25c4e0cdd65c9942529604f59f725da57fb
SSDEEP 192:sxR2RVCz/fDsksFZ9zoD8p4V/g6+WNIYCAOwhuOCGiIgD73T+J:sxR26z/fDsksrZA/5ICOYEO
TLSH
T1A342D8166928A93B9CCBD21DBB55BF63D2F9503261902E58F6FC961C04EB6DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 faf3875808bfc18fb1a26c59a337f6da4c3448c7f2b268816cfa1c95e6cf77f2
MD5 b4c4d2669a40c643e17d42216e657fdd
SHA1 5f404cd3226489860d14d25e25ebee79f6cdfb48
SHA512 938405c096d422ad0b55d0191889ce5fc4076c96a95da6f87b13337d031dd63299031444decc702cf912e7f8d9d88fe6471b2e7a808bc50c380643fe14120c5a
SSDEEP 768:jC+vbk7pLuLfDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjt0QqcIroZYE:jC+vboEfDQWgQ+f4+u1jakt0VczN
TLSH
T1EDD2EA7B640DCB7F4F804A9DAC197E9B6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 22a437dd308823e1ba7d6b640317a7e51eb9683479b401a0737321cd265c3816
MD5 451e03e0e998794717c39af0ac7d207c
SHA1 bcd240ad29dfa93c234e988f70e6b642ff974a48
SHA512 986893a996df6fd3ebf2f477ec4261fc6d3c57b7c1e789721abc2051d5c13989d599f18fcd40d060708dd7abf360c510d7c52bc95dabf8a1b5d90a1152bbc135
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrzKtZ+qQ4Kb:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpk
TLSH
T195916410347E13407C7E691DA4BD882E8A8274F3341AA96B7BA841A70F67E435DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3903.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3903.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2ea7eb1cc40a80bca2abd6196f9db44b0976e327cc182e487bd7713fde24dec6
MD5 1031d27e39ecf1409f7bdda4d9bd0988
SHA1 c671008f521e195ab90001f571f8968ddb26adf6
SHA512 1298ae5a125961eb8dffae4781ce209a713cd533a9d85ffb03f84e9f34027b1cf4ffd44580384739f19614b9d26e5df10c7622d626163da215ddb284fb9e9b35
SSDEEP 768:h/32GpptEGp8+p3bd66j+4BRv86aLIWJhy6DqaD:h/3yw8+p3Z6n4ynTPD
TLSH
T126F2BF71E8A99D339CF6D648F2863B436EF4506396D00DD8E5ED6B1D04872AE270B43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 557c1d7adc3519cc9b5b165c4ca477d6e745b7e21edd6072255a54d580150b23
MD5 d0f42a477da58e3b0cf03987e37076b6
SHA1 1e6542eeb9b4697e75e3fc72926070c124b020a5
SHA512 5ebaed633a41fc53140bc39633b87d1fea4f4e358ae38db6cbab4c10c866fe7abcea522a9c9b01fd92393c368bbc2d6c07c65620611f67a754ce47b422f917e2
SSDEEP 768:fFQo3TwgCg4ptKp8+p3bd66j+4BRv86aLIWJhy6DqaD:io3X8+p3Z6n4ynTPD
TLSH
T1E3039E72D8A8CE37ACF6C785F7463A43AEF4106385D45DD4E9D96E1D00871AE170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ee2061e2e38ada43577d03d5884147f6d27119c5e82a4d9931eca06d540ac476
MD5 590631c4122f57bb8aeb54462fd48291
SHA1 66d57f9eadb1718729107b2395b3e1b5b64d166a
SHA512 81926d13baa34d72a2c96cf64d7b4c4b27969246f5dfb3adb941521bb31ca96d1df244eee9848218b103ad58a73481ffd5ff7ebeb5c20a43b77bd82ae301005b
SSDEEP 768:A/3dGpptEGp8+p3bd66j+4BRv86aLIWJhy6DqaD:A/3fw8+p3Z6n4ynTPD
TLSH
T1AFF2B071E8A99D339CF6D648F2863B436EF4506396D00DD8E5ED6B1D04862AE270B43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 424a898c375a2a98a4f11a46a9d9cd39c70b9c2ffa41d8cc676bb2da988cfba2
MD5 14b9ab6eb2d2872c9feab96e27d97547
SHA1 861634ef804ad24cb09b77408325b2c9daf9142a
SHA512 207462f20ce61b705c7a15a148373cd3368413f83c484bbe1339a77d794d7410ca00133f2421c9a1f797df22537bb7eb1e415b8fe8adf6fa965c801c9cc2cb5e
SSDEEP 768:Irv+4UNbdD3/cpoNp8+p3bd66j+4BRv86aLIiu2bwCl1:Ibsbp3rL8+p3Z6n4yo0ww
TLSH
T18403BE33F9A899739CF6C648B2467B433FF851A396C10AC0D4DD2B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 66d802ce60cc4595252f3dc43c8fe50c84fec766285371a9d5afc8a52c3cffd5
MD5 e07f44eb4e670c6ea16f43b684d58f74
SHA1 a6b5e16e969537481c4f7adda7f603eae33e29b9
SHA512 7d732f79c17a5c66ec6423c59dd0072f2538f5eb090fd1ed1c6982dab23fbac6c4e5c402455c5c395496006fb070ffa79b7dc4bd51d4ec5818f878ae9a6ade29
SSDEEP 768:krv+4UNbdJ3gYGpptETp8+p3bd66j+4BRv86aLIWJR3K:kbsbf3gIl8+p3Z6n4yn8
TLSH
T16F03AE72E86DDE339CF6C648B1863B837FB810A395C00D94D9D96B5D45862AE270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ebf5157-ea25-4551-9bb2-df74b7c13248.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3ebf5157-ea25-4551-9bb2-df74b7c13248.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5975a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5975a3.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 ee5458e1e17de480219c3ad714dbd4e13a6dcabff66204aaf6989e8703067580
MD5 72541acaf1e64fcc576003956a063de2
SHA1 de952fc1ec5e4b3e54b8d76e2f86971ac2995278
SHA512 c94e0205af4c27e2186223be0c114af91d95889888b69676e99d7c41bcd3e69f0b0297f8e51406eb68582637f7da982063607b3852d836bbd6189fa5da37adfa
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3A:CebAjOKn3wRKRJ3A
TLSH
T100D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.old_1785724097

Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_9159a0df58b0e72a986f8b56b6b83a64_akira_glassworm_rusty-stealer.old_1785724097
Size 2.7MB
SHA256 db9c2858f4efc25454da954da7389e11a4d315fceb3758f856e18c8f801ea3bc
MD5 41ef259ddc3ee9c58db84783cc0ea10a
SHA1 7dba93db259aa8e2f58eb52f8072998c5050b349
SHA512 73e1f90baea81991436a0bb79becd025e5f9c0c55fd9d189040f92df4b86af39bc6d78d63263a474e4d954d0bd6dfc98b82975358b5d70d66c545780679d7aec
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3I:CebAjOKn3wRKRJ3I
TLSH
T1A3D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

593f5767-6d2e-43db-a1ea-44a735e4873f.tmp

Path C:\Users\Admin\AppData\Local\Temp\593f5767-6d2e-43db-a1ea-44a735e4873f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4604_731355495\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3692-515-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-541-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-461-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-565-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-425-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-584-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-592-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-480-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-616-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-630-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download

memory/3692-478-0x00007FF656300000-0x00007FF6565C1000-memory.dmp

Download