10030c7a53cf296ecb2afe27fbe7797c061a8f3ca1f53622098ac749ee559f98

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample261029-zceefscd46
SHA256 10030c7a53cf296ecb2afe27fbe7797c061a8f3ca1f53622098ac749ee559f98
MD5 b4a3694df666f1de2d44296f1af10f1c
SHA1 04176e739445f00bd854fb9e33a1833d3f1efee5
SHA512 d337b84e49dd99bb1b38dacd18015ff8aa0e07dfdcfa0baf2004c74b7b3d7de0b123457f70e40a91d77ec2956824c6c78a9441eb387b4293a74c57ba4e6238c8
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3l:CebAjOKn3wRKRJ3l
TLSH
T12BD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2012_770230456\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
612	wmic.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5724	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{70F2D29F-055F-4D2D-B1E3-398FBC3A5903}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
612	wmic.exe
612	wmic.exe
612	wmic.exe
612	wmic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5628	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	612	wmic.exe
Token: SeSecurityPrivilege	612	wmic.exe
Token: SeTakeOwnershipPrivilege	612	wmic.exe
Token: SeLoadDriverPrivilege	612	wmic.exe
Token: SeSystemProfilePrivilege	612	wmic.exe
Token: SeSystemtimePrivilege	612	wmic.exe
Token: SeProfSingleProcessPrivilege	612	wmic.exe
Token: SeIncBasePriorityPrivilege	612	wmic.exe
Token: SeCreatePagefilePrivilege	612	wmic.exe
Token: SeBackupPrivilege	612	wmic.exe
Token: SeRestorePrivilege	612	wmic.exe
Token: SeShutdownPrivilege	612	wmic.exe
Token: SeDebugPrivilege	612	wmic.exe
Token: SeSystemEnvironmentPrivilege	612	wmic.exe
Token: SeRemoteShutdownPrivilege	612	wmic.exe
Token: SeUndockPrivilege	612	wmic.exe
Token: SeManageVolumePrivilege	612	wmic.exe
Token: 33	612	wmic.exe
Token: 34	612	wmic.exe
Token: 35	612	wmic.exe
Token: 36	612	wmic.exe
Token: SeIncreaseQuotaPrivilege	612	wmic.exe
Token: SeSecurityPrivilege	612	wmic.exe
Token: SeTakeOwnershipPrivilege	612	wmic.exe
Token: SeLoadDriverPrivilege	612	wmic.exe
Token: SeSystemProfilePrivilege	612	wmic.exe
Token: SeSystemtimePrivilege	612	wmic.exe
Token: SeProfSingleProcessPrivilege	612	wmic.exe
Token: SeIncBasePriorityPrivilege	612	wmic.exe
Token: SeCreatePagefilePrivilege	612	wmic.exe
Token: SeBackupPrivilege	612	wmic.exe
Token: SeRestorePrivilege	612	wmic.exe
Token: SeShutdownPrivilege	612	wmic.exe
Token: SeDebugPrivilege	612	wmic.exe
Token: SeSystemEnvironmentPrivilege	612	wmic.exe
Token: SeRemoteShutdownPrivilege	612	wmic.exe
Token: SeUndockPrivilege	612	wmic.exe
Token: SeManageVolumePrivilege	612	wmic.exe
Token: 33	612	wmic.exe
Token: 34	612	wmic.exe
Token: 35	612	wmic.exe
Token: 36	612	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5628 wrote to memory of 3496	5628	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe	91
PID 5628 wrote to memory of 2012	5628	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe	93
PID 2012 wrote to memory of 572	2012	msedge.exe	94
PID 2012 wrote to memory of 3420	2012	msedge.exe	95
PID 2012 wrote to memory of 5724	2012	msedge.exe	96
PID 2012 wrote to memory of 3420	2012	msedge.exe	95
PID 2012 wrote to memory of 3420	2012	msedge.exe	95
PID 2012 wrote to memory of 6068	2012	msedge.exe	97
PID 2012 wrote to memory of 6068	2012	msedge.exe	97
PID 2012 wrote to memory of 3872	2012	msedge.exe	100
PID 2012 wrote to memory of 5104	2012	msedge.exe	99
PID 2012 wrote to memory of 3872	2012	msedge.exe	100
PID 2012 wrote to memory of 3872	2012	msedge.exe	100
PID 2012 wrote to memory of 5104	2012	msedge.exe	99
PID 2012 wrote to memory of 5104	2012	msedge.exe	99
PID 2012 wrote to memory of 5920	2012	msedge.exe	101
PID 2012 wrote to memory of 3024	2012	msedge.exe	102
PID 2012 wrote to memory of 5920	2012	msedge.exe	101
PID 2012 wrote to memory of 5920	2012	msedge.exe	101
PID 2012 wrote to memory of 3024	2012	msedge.exe	102
PID 2012 wrote to memory of 3024	2012	msedge.exe	102
PID 2012 wrote to memory of 1440	2012	msedge.exe	103
PID 2012 wrote to memory of 1440	2012	msedge.exe	103
PID 2012 wrote to memory of 1440	2012	msedge.exe	103
PID 2012 wrote to memory of 4952	2012	msedge.exe	104
PID 2012 wrote to memory of 4952	2012	msedge.exe	104
PID 2012 wrote to memory of 4952	2012	msedge.exe	104
PID 2012 wrote to memory of 3152	2012	msedge.exe	105
PID 2012 wrote to memory of 3152	2012	msedge.exe	105
PID 2012 wrote to memory of 2276	2012	msedge.exe	107
PID 2012 wrote to memory of 4580	2012	msedge.exe	108
PID 2012 wrote to memory of 2276	2012	msedge.exe	107
PID 2012 wrote to memory of 4580	2012	msedge.exe	108
PID 2012 wrote to memory of 5736	2012	msedge.exe	110
PID 2012 wrote to memory of 5156	2012	msedge.exe	113
PID 2012 wrote to memory of 5156	2012	msedge.exe	113
PID 2012 wrote to memory of 2268	2012	msedge.exe	114
PID 2012 wrote to memory of 2268	2012	msedge.exe	114
PID 5628 wrote to memory of 612	5628	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe	115
PID 2012 wrote to memory of 4224	2012	msedge.exe	118
PID 2012 wrote to memory of 5908	2012	msedge.exe	119
PID 2012 wrote to memory of 2968	2012	msedge.exe	120
PID 5628 wrote to memory of 4928	5628	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe	121
PID 2012 wrote to memory of 2380	2012	msedge.exe	123
PID 2012 wrote to memory of 2380	2012	msedge.exe	123
PID 2012 wrote to memory of 1616	2012	msedge.exe	126
PID 2012 wrote to memory of 1616	2012	msedge.exe	126
PID 5628 wrote to memory of 3280	5628	2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe	127
PID 2012 wrote to memory of 5164	2012	msedge.exe	129

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3280	attrib.exe
3496	attrib.exe
4928	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.old_1793306050
  2⤵
  - Views/modifies file attributes
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffac6c8c188,0x7ffac6c8c194,0x7ffac6c8c1a0
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,4586885461976373426,10897156264694248675,262144 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,17782344921236700978,17474976844043248830,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,5348038602223945892,1040001311641815131,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,7159507772427467526,17744187498091097652,2097152 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,12823640611053462526,7520967987854097792,2097152 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,11197895795014171377,14057328695314713376,2097152 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,8067084894255976981,15979631483502083925,2097152 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5332,i,8823309409388054738,1140124215810082859,2097152 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:9
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5416,i,16548336755412607342,8958418714826169923,2097152 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:15
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,16315545095498466439,5603311312257075184,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,6832048524500703899,14721007572574036451,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,6684153124674431246,15670355245162211356,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,926597800247553865,10652402823998396596,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,926597800247553865,10652402823998396596,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,5832935929718136650,17650225380865888129,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,17130282266745938209,10478026689077721781,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,9195296640711621623,16483287589481655754,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,8295332486942292621,7304444414058192271,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,7008293369670459453,8513502458909007792,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,18407700152908335870,12353607695730170002,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7336,i,9743681585839733654,14525210647019332437,524288 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7304,i,3814251310588350401,14762249129913688974,262144 --field-trial-handle=2304,i,10905521122587827587,5426976446383872945,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:10
    3⤵
    PID:5164
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Queries system WMI classes for hardware identifiers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:612
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.old_1793306111
  2⤵
  - Views/modifies file attributes
  PID:4928
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.old_1793306171
  2⤵
  - Views/modifies file attributes
  PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b4b2c0a-7977-43f1-856e-06729a57c6d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b4b2c0a-7977-43f1-856e-06729a57c6d6.tmp
Size 33KB
SHA256 5fc3fae2d10fcee6a7739d2e34d18caea4a49d90b9fea41a9dad8c2bfe273162
MD5 58f98ea93913427317d37d0647a8d737
SHA1 7a842f7ef8c0af25bc7d92b113a6d0523e191337
SHA512 571c6692cf87d30b829308cef1114461bd9db8a59f2219a964aabf1aa722805d79df63ee3299421ab8c322c94078b37e835124a6a81d3e229b4d07004cbdde6d
SSDEEP 768:r33aMPjK3OtCctaAt71h3Yogkl5akl8pbHW0AWD9oaTZc4L3:r33bz1h3Yog05akl4bHW0Ao9N7
TLSH
T19EF29E71F8B5EE334996E284621A2353FFF464679EC84E84D9CD9E1D01872AE174FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e1b1b78-0955-4b14-81ad-63c9d10bc2bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e1b1b78-0955-4b14-81ad-63c9d10bc2bc.tmp
Size 38KB
SHA256 a614e04f4b233c76fbab8cec29b3afaf2b2e8524c630338a82434207b2165bcd
MD5 2b114c0da5082d1c05b45ee2123d6595
SHA1 13e7bc0acaf903023f8e7bdc83eccb7e9c097152
SHA512 2d22167b4fb54860693562366e233ec20239bf216981530cf5b7213f58cda6be98a3d57d53b12d4c10706b0aef6065293bb681489b6a2632c046db657455f453
SSDEEP 768:f/UxvxjgC+CZ3LPxK3OtCctaAtT1h3Yogkl5akl8pbHW0AWi9SHvP0Vv:yZj3+I31r1h3Yog05akl4bHW0ADSCv
TLSH
T19803BF35EC65ED3389E6E284361AA357FFF868735AC45A9489DC9E0D02873AD070BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

776a56e7-010c-4456-ae3a-6f569ded4ed5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\776a56e7-010c-4456-ae3a-6f569ded4ed5.tmp
Size 38KB
SHA256 34d7f706d65234bcf3b9cda08403da17814326b78f0408a47ec61bdc69e2b0c2
MD5 c1ac36a70a5af59ed1f3f6b8109df397
SHA1 a91653afde5955f7b1c09a98de9e782d28108433
SHA512 36e03a2b3437afb32cc4835c8256d053c223399d598c02e1d4a5746f03a5e7df6d84ee1202ce82eafe0ba66da74312012545921922357e05652ec21adaedeb71
SSDEEP 768:2/UxvxjgC+Y37yPjK3OtCctaAtT1h3Yogkl5akl8pbHW0AWD9oB7o:rZj3+Y3kr1h3Yog05akl4bHW0AoC7o
TLSH
T1E803AE35ACB9AD3389E6E244721A6353FFF458735AC45E9489DC9E0D06873AE070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

067a5731-48d3-472f-9967-252bb0718d85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\067a5731-48d3-472f-9967-252bb0718d85.tmp
Size 12KB
SHA256 d015b5cf0202fdd7ae8bdda68049e0afb8add72dc43cfb6db079b6fb34ffcad9
MD5 fb2a0ee8a8a658259ba8bf58e93ca0d8
SHA1 e4849c3babb45f36e634f5531ae7595dd27a5aea
SHA512 7f746856d8cdbcc0b0d3f13469f2cd72e78619f3018261e679c6456cf997edf4044d9eee43f0933afaf02f7ba8692280422312747ad807bd5af4bad1b6036150
SSDEEP 192:sxRLR0Cf/fNsq87qmBSzoA8p4P/g6+WNIYd6UOw36GK1IgDGaJ:sxRLpf/fNsn7HBfO/5IwOP5
TLSH
T18742A515BD28A93B5CCBD30DFA55BF53D2F91032A5915E54B6FC8A2C04EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25db2cd1-edb1-4fe1-b5d7-88ea9f58a023.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25db2cd1-edb1-4fe1-b5d7-88ea9f58a023.tmp
Size 12KB
SHA256 d92db7d16a768a51eb4fd7884fe5bd586a4c5b9f253d6c173ea4dffc9505b9a7
MD5 cd51a7be0a7cd0d9c46958a00f46fe92
SHA1 40683dedac8d63febe29a508154a2049e0053bfb
SHA512 412f3b1e05cd7b1278ac50f6d597d491532f5577f589dd5737f99996ab3f537cca0d6722ff0ef78696d0d4debc866360136d2976099516dcff63572fc5e68cc1
SSDEEP 192:sxRLR0Cf/fNsq8ZqmBSzoA8p4P/g6+WNIYdtYOw36GK1IgD8aJ:sxRLpf/fNsnZHBfO/5I7OPr
TLSH
T10C42A715BD28A93B5CCBE30DBB557F53E2F91032A5911E54B6FC8A1C04EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

494c6fb4-f2d4-445f-9c6a-47010dffe4c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\494c6fb4-f2d4-445f-9c6a-47010dffe4c3.tmp
Size 27KB
SHA256 d92e39d4954bb3a73e84ffaa9161aa78e4eb111d3a2a713bc81d001a0a52af8b
MD5 4809dadb03b556a5098a214aafcd7ddb
SHA1 dd7c5a3f64ab62853dd2b3509451a91bb6360aaf
SHA512 8bdb115f039d588cd74b46fbb779da95a89f6d1a24158b0e88499e80d54e7e23356c97527e58e9a05db5191f00d0525ff6010b737107e5f448f38d48d5c8ba7b
SSDEEP 768:qF+z2U7pLuLb9oWgU6f8S8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6IGUxropR:qF+z2YEb9oWgU6f8Su1ja9xUKD
TLSH
T115C2DA7B740CCB7F4F900ADD98197E9B6DA802CB9698CD4047FE945C02C6BEE62164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73325b67-8611-4d6c-936b-282168baafa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73325b67-8611-4d6c-936b-282168baafa1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 423760195a5ea721ee4d3bf66578bcda01089fc27d29790e71b6d422f42a4af6
MD5 538a5fe043b8addc348b703d02437beb
SHA1 67b78536c32c01c9baec322f795e6846d22c9be2
SHA512 dccfcc08f40d2d5e4aae3896e86bb93aed8a13a61b5bb7bbfa8a081398be51a29156a85baad673a5f2d145d54f84b21c51ce522374cf934476b724bd9b7924f4
TLSH
T12751C94482719B4BF3A4323E4ADC0E5F3676A58C9BEF2E71B756C1F45A0A3A2C19405C
MD5 SHA1 SHA512 TLSH

Submit Download

9f3b7d1f-5c8f-40ad-9f64-c5d2e3d8e715.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9f3b7d1f-5c8f-40ad-9f64-c5d2e3d8e715.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1c71ed7f-111c-4b5e-abb5-d51e38381c29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c71ed7f-111c-4b5e-abb5-d51e38381c29.tmp
Size 2KB
SHA256 aa2b2c191d7f4a10c51277e27451b4dd574d2e5f3169a2b0ab95b3a22f68ae42
MD5 8b21745a22186c268cfc977ab205434f
SHA1 d090bff1878e83e02b00a844f597bcf972defe9c
SHA512 dbe62af37e73a7ccf436e5d0f2fbb67a63574365eb8ab72a078a9568cba68fb8fb70db49f3a218c08f19e0b6d3ebfce96705d8996fd70761f6a72ae4af692425
TLSH
T1CA41DDF387F4857E9A0186F0AA146E1FCE2D0915432C7C5A84E0AF2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

4dde1d82-ece0-4021-9637-0519230b2e58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4dde1d82-ece0-4021-9637-0519230b2e58.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

84978ffd-a0e4-4e33-b359-b965391904b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\84978ffd-a0e4-4e33-b359-b965391904b9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d2333e18371cebc1f0bfa409704b7f0eb7e5bec74265d3add6da96000c120163
MD5 19520461de758cd5ec3da700fcf4a225
SHA1 7a619bda6d57ef259109101e77403789d33ddc88
SHA512 da02e03b28040612e408ccc741b3a759d7673f265a20fc54d65c004fecd26c9ef809959aaf5354c666d735ef12994ddf422f341692c428f3a406ba544a88b344
SSDEEP 192:sxRoR0Cf/fNsJ87qmBSzoA8p4P/g6+WNIYd6UOw36GK1IgVaJ:sxRopf/fNsi7HBfO/5IwOPo
TLSH
T17B42A615BD28A93B9CCBE30DFA557F53D2F91032A1955E54B6FC8A1C04EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a59bb1217c84d26b4a308b1fa6e4e4c0c8be3b15de5ef428fd5b9fc33c963e83
MD5 eaf3fa048f881558fd74476f34ef974f
SHA1 8c5b2704d0e5f257299d2f27d8ba7b0b1cfb08ce
SHA512 8550d5e861d0eb7eed8fe83cbc1efed4fa68dc4e95862ab664362f8f385a4d7637a91750ffd0763eaccccbcec0bb2dfa6af73959e773e816c3469ceda2297deb
SSDEEP 48:K0QIvKN2cryJgIPKR+cZaI/K3Kwby2hUAR:K0QgKN2iKgoKR+CakK3K+J
TLSH
T1E591C71272BA47817D7E374861799B1B824230B37155F52F7BE934A29F2AE019CFD8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4ae0b2a-6a86-4912-ab6a-67eddf06ffad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4ae0b2a-6a86-4912-ab6a-67eddf06ffad.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b7bb0b1f-7c1d-4650-8e83-a07719b182dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b7bb0b1f-7c1d-4650-8e83-a07719b182dc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af751a82-2299-460d-a3b3-499a68d32622.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af751a82-2299-460d-a3b3-499a68d32622.tmp
Size 37KB
SHA256 95fc3a2e309d3a9ea7f1a5c191b0650b02852385cfc301469a66b50f1628a488
MD5 12be689554fb6c2b276dee86fcc968e4
SHA1 051313a4b20e74d2019682f21378fabdc8b3b42d
SHA512 92c0aa1f3d9f312d41e5acc2dadc17de35544d5c1c2e829711301b28be57ac8861e5d37647d88fb4c7c0ccadbf114c83e838fdc189a241987cb45fed27205837
SSDEEP 768:B/UxvxjgC+CZ39mLxK3OtCctY1h3Yogkl5akl8pbHW0AWTXSHvP0Vv:UZj3+I39yW1h3Yog05akl4bHW0A6SCv
TLSH
T1C903BF39EC64AE7789E6E244761AA317FFF894635AC4569445DCAF0D028B3AD030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ce86ec4-fa82-473d-adcb-fb4d448e3e20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6ce86ec4-fa82-473d-adcb-fb4d448e3e20.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

da1759fb-961b-46a5-91a3-39a68e93f80e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da1759fb-961b-46a5-91a3-39a68e93f80e.tmp
Size 34KB
SHA256 f8f05fd67f4e498df2d0f391a6527974d3d28fa59d67c210ef09f913846cc24a
MD5 ecec194385b1dc2ec337ca851c97c157
SHA1 890bb72705b1d34d3791313d629d29f7b5fb98f4
SHA512 56025949e7ab691cd5de3e41a01eb28cd882f468773a754abbe557a93763367599abff4e6fd84b1382a9deef2a12b3250e4473dac6082803d46fa2f6e5448b64
SSDEEP 768:f33DMPjK3OtCctaAt71h3Yogkl5akl8pbHW0AWD9oaTZc4L3:f33mz1h3Yog05akl4bHW0Ao9N7
TLSH
T145F29E71F8B5EE334996E284621A2353FFF464675EC84E84D9CD9E1D01872AE174FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fc67d17-dcab-480a-8a70-d380caa4ed26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8fc67d17-dcab-480a-8a70-d380caa4ed26.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

af4f9c48-0749-43c6-933d-3801a189d3d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af4f9c48-0749-43c6-933d-3801a189d3d2.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

f072f79c-d126-48f2-b9b1-3cc2ffac94cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f072f79c-d126-48f2-b9b1-3cc2ffac94cf.tmp
Size 37KB
SHA256 b6c0c38a74ef4029841abd47563922622c3f00e3e043583947501a1aca7e3171
MD5 43e96a8a3dc56c718bbc3f1baeaff43c
SHA1 ba57563715a1f3b19614cada2461efc403e9ea97
SHA512 abdd5ad877b569c422b8fcf01a097e7015d7d60ab787f327e6c1d40beeb37d62ade7213046044e6f334dd5fb5202c72b56982b3c7c9224ff03960ac2c180ab6d
SSDEEP 768:TFdC3EwgwMPqe3OtCctaAt31h3Yogkl5akl8pbHW0AWD9oaTZc4L3:zC3/v1h3Yog05akl4bHW0Ao9N7
TLSH
T13A037C76E8A5DE7B9DE6D785A31A7347EEE050638AC88DC4D9CD9D0C01872EE074BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.old_1793306111

Path C:\Users\Admin\AppData\Local\Temp\2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.old_1793306111
Size 2.7MB
SHA256 85c209e1edc41e2b499e6b5df659abb05fa70ade4bfa6a00e1831feeb21077ec
MD5 869c778214653d33b571659f04b21fe5
SHA1 f5b7fc434e191d9134edc366d604316f906d7dea
SHA512 123511db699a65f182eda84af3b704d02dfcd2f41d71ad330705d68c8a08a3f3c329a8efdbb5ca2ea4efe3d6c52841eafe355e5d1a3af2d9630e718b812427bd
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3B:CebAjOKn3wRKRJ3B
TLSH
T1D9D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.old_1793306171

Path C:\Users\Admin\AppData\Local\Temp\2026-10-28_b4a3694df666f1de2d44296f1af10f1c_akira_glassworm_rusty-stealer.old_1793306171
Size 2.7MB
SHA256 045cf5313ddfffef4748bb276e0247b6bb51b83d52d4dc296891134ca53e2a25
MD5 9ea9017760610920c3db55767bc53993
SHA1 b0dd874fbd3b3712ec36bda5702bcd934b9c2aae
SHA512 fd57d7e498f9c25977b0b71cc69fdc939ff4bcdd2e3ea870fdaae965639c2fa8f8c75cf5f17cdbcfe99cedacd8416c5ce8f6944c920fa17f2d79f310228dd5cc
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3o:CebAjOKn3wRKRJ3o
TLSH
T1FCD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34a012db-ac34-4496-ad17-53356f44db77.tmp

Path C:\Users\Admin\AppData\Local\Temp\34a012db-ac34-4496-ad17-53356f44db77.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f510f7c9-d0f5-40a8-9ce8-09885734e29f.tmp

Path C:\Users\Admin\AppData\Local\Temp\f510f7c9-d0f5-40a8-9ce8-09885734e29f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

memory/5628-211-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-244-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-264-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-243-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-226-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-225-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-294-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-305-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-314-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-315-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-176-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-322-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-324-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-325-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download

memory/5628-326-0x00007FF67BE30000-0x00007FF67C0F1000-memory.dmp

Download