7edadc8285e42fe895e5d677b16f1a53f994317065aa7076061ae51a739d5e50

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260710-ckq2wsb14q
SHA256 7edadc8285e42fe895e5d677b16f1a53f994317065aa7076061ae51a739d5e50
MD5 478c6e2350ef9be2d5a9ee58657f5c90
SHA1 cd1fad53d92888c1b290455aafb9648071137f09
SHA512 be94b69efa35f8917dace93dfc245b6934632c73f516efedce2886a2f8a3d7ba4d0a475dd503f7a76240c9bdd2616d7cb9e6c195da7fcc435ed985f46b4b27c8
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3i:CebAjOKn3wRKRJ3i
TLSH
T1F0D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_2025310147\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_2025310147\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_2025310147\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-mobile-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-mobile-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_2025310147\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1619635067\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1619635067\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-mobile-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_2025310147\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-ec\de\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{D3DEB398-17A5-4DD8-911B-D7FBDFE47FBA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2872	wmic.exe
2872	wmic.exe
2872	wmic.exe
2872	wmic.exe
692	msedge.exe
692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6080	2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2872	wmic.exe
Token: SeSecurityPrivilege	2872	wmic.exe
Token: SeTakeOwnershipPrivilege	2872	wmic.exe
Token: SeLoadDriverPrivilege	2872	wmic.exe
Token: SeSystemProfilePrivilege	2872	wmic.exe
Token: SeSystemtimePrivilege	2872	wmic.exe
Token: SeProfSingleProcessPrivilege	2872	wmic.exe
Token: SeIncBasePriorityPrivilege	2872	wmic.exe
Token: SeCreatePagefilePrivilege	2872	wmic.exe
Token: SeBackupPrivilege	2872	wmic.exe
Token: SeRestorePrivilege	2872	wmic.exe
Token: SeShutdownPrivilege	2872	wmic.exe
Token: SeDebugPrivilege	2872	wmic.exe
Token: SeSystemEnvironmentPrivilege	2872	wmic.exe
Token: SeRemoteShutdownPrivilege	2872	wmic.exe
Token: SeUndockPrivilege	2872	wmic.exe
Token: SeManageVolumePrivilege	2872	wmic.exe
Token: 33	2872	wmic.exe
Token: 34	2872	wmic.exe
Token: 35	2872	wmic.exe
Token: 36	2872	wmic.exe
Token: SeIncreaseQuotaPrivilege	2872	wmic.exe
Token: SeSecurityPrivilege	2872	wmic.exe
Token: SeTakeOwnershipPrivilege	2872	wmic.exe
Token: SeLoadDriverPrivilege	2872	wmic.exe
Token: SeSystemProfilePrivilege	2872	wmic.exe
Token: SeSystemtimePrivilege	2872	wmic.exe
Token: SeProfSingleProcessPrivilege	2872	wmic.exe
Token: SeIncBasePriorityPrivilege	2872	wmic.exe
Token: SeCreatePagefilePrivilege	2872	wmic.exe
Token: SeBackupPrivilege	2872	wmic.exe
Token: SeRestorePrivilege	2872	wmic.exe
Token: SeShutdownPrivilege	2872	wmic.exe
Token: SeDebugPrivilege	2872	wmic.exe
Token: SeSystemEnvironmentPrivilege	2872	wmic.exe
Token: SeRemoteShutdownPrivilege	2872	wmic.exe
Token: SeUndockPrivilege	2872	wmic.exe
Token: SeManageVolumePrivilege	2872	wmic.exe
Token: 33	2872	wmic.exe
Token: 34	2872	wmic.exe
Token: 35	2872	wmic.exe
Token: 36	2872	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3612	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 2604	6080	2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe	85
PID 6080 wrote to memory of 3612	6080	2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe	87
PID 3612 wrote to memory of 5404	3612	msedge.exe	88
PID 3612 wrote to memory of 3360	3612	msedge.exe	90
PID 3612 wrote to memory of 2420	3612	msedge.exe	91
PID 3612 wrote to memory of 2420	3612	msedge.exe	91
PID 3612 wrote to memory of 708	3612	msedge.exe	92
PID 3612 wrote to memory of 708	3612	msedge.exe	92
PID 3612 wrote to memory of 708	3612	msedge.exe	92
PID 3612 wrote to memory of 4508	3612	msedge.exe	94
PID 3612 wrote to memory of 6420	3612	msedge.exe	93
PID 3612 wrote to memory of 4508	3612	msedge.exe	94
PID 3612 wrote to memory of 4508	3612	msedge.exe	94
PID 3612 wrote to memory of 6420	3612	msedge.exe	93
PID 3612 wrote to memory of 6420	3612	msedge.exe	93
PID 3612 wrote to memory of 748	3612	msedge.exe	95
PID 3612 wrote to memory of 748	3612	msedge.exe	95
PID 3612 wrote to memory of 748	3612	msedge.exe	95
PID 3612 wrote to memory of 1956	3612	msedge.exe	96
PID 3612 wrote to memory of 1956	3612	msedge.exe	96
PID 3612 wrote to memory of 1956	3612	msedge.exe	96
PID 3612 wrote to memory of 360	3612	msedge.exe	97
PID 3612 wrote to memory of 2704	3612	msedge.exe	98
PID 3612 wrote to memory of 360	3612	msedge.exe	97
PID 3612 wrote to memory of 2704	3612	msedge.exe	98
PID 3612 wrote to memory of 4388	3612	msedge.exe	100
PID 6080 wrote to memory of 2872	6080	2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe	104
PID 3612 wrote to memory of 1744	3612	msedge.exe	107
PID 3612 wrote to memory of 460	3612	msedge.exe	108
PID 3612 wrote to memory of 692	3612	msedge.exe	109
PID 6080 wrote to memory of 2688	6080	2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe	110
PID 3612 wrote to memory of 3484	3612	msedge.exe	112
PID 3612 wrote to memory of 3484	3612	msedge.exe	112
PID 3612 wrote to memory of 4712	3612	msedge.exe	115
PID 3612 wrote to memory of 4712	3612	msedge.exe	115
PID 3612 wrote to memory of 2308	3612	msedge.exe	116
PID 3612 wrote to memory of 2308	3612	msedge.exe	116
PID 6080 wrote to memory of 3148	6080	2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe	117
PID 3612 wrote to memory of 692	3612	msedge.exe	119
PID 3612 wrote to memory of 5588	3612	msedge.exe	120
PID 3612 wrote to memory of 5588	3612	msedge.exe	120

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2604	attrib.exe
2688	attrib.exe
3148	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.old_1783649308
  2⤵
  - Views/modifies file attributes
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb861cc188,0x7ffb861cc194,0x7ffb861cc1a0
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,5403928918628607248,5301096813645100103,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,9172555755806854144,9553940127813754018,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,3758913597943480203,10974179043228698924,262144 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2960,i,15004954733430568241,12966091203901424500,2097152 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:6420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,10320390179235076572,5556909234741996122,2097152 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5072,i,12582152329634219713,3444379404079269821,2097152 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:9
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5304,i,15830412996710848363,5136355905966956543,2097152 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:15
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,3084985677309175140,7979387934126966565,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,5701360326598821346,812561011503581664,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2636200857030980366,4586740664610028862,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2636200857030980366,4586740664610028862,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,14538472117535725495,12665816462956662039,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,18172842339759772745,16024306391149273653,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,17047082000699681852,17601056138565333202,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,4112208130118782199,16012674278220892369,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,17561997585637093300,18283228698196794478,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,3747817488160742114,9022497310408671523,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6900,i,2479451344749577767,4317746723358913693,262144 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,13880221266952480364,10901366251215860762,524288 --field-trial-handle=2536,i,9688091351251852089,2388026627365228342,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:5588
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.old_1783649368
  2⤵
  - Views/modifies file attributes
  PID:2688
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.old_1783649428
  2⤵
  - Views/modifies file attributes
  PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 92a973fa8f43e6bbe56af5b1d6fa5d7cdf55bfe802df730198b1f45fdd812bf4
MD5 3be0c11962ee216ef2908c1a909de89d
SHA1 6735c8bfdbf3433111a55484b7523759d3a4efe2
SHA512 20b2f448310d71aed54df599452395c476aa73f812c1412148b715f1a413b7863acba1561219bd93602706064257343b8bc6e84fda74449055e5fc44743b54c8
TLSH
T151E02BA7C961BC376AFD1B1860580687EB50131B3B41984B3B3C835C4FF46374686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a27cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a27cd.TMP
Size 3KB
SHA256 0ff4b3a3114aba3d6286e521c211789148752686b2ed2259dd6113f0db97a692
MD5 bebc006dae03751b2ad7fc7d350072d3
SHA1 41ebc2d0aa17176f026774e20710f28c413ec854
SHA512 7f0f89a4e1f753f4791c2cc9db50ae2eedc1829cec72dde2ef2ea599848f495cd7f6e0fc61d5e85bd89248e00bf65c91150c6ad646fe3bbe6eb3d3f905135880
TLSH
T149615CF7575B0AD9DF214DB2E1ECB0A83374862741332F629D677AB44C9279E1C69C10
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 53414d0da211513a220710d684c80ad8ebc0401ae8500ef3c7496527c2a5e716
MD5 86fdea8d69d865efa9d7c322ba8717a8
SHA1 3dde899cb4eac3b2e16ab65836482988e1763e7c
SHA512 d43819a1893a63e46f5039fd64aa2626274559a188a64295bdef187d0192d174904ce5775db44e346dc0282e9a9ded28b95ccad919ac75c0496316185868a71d
TLSH
T12141C1F783F4856ED91195F0AA18BE2FCE1C0515832C3D5AC5E0AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 816c832639de16fabead4727fb2445041c484e8fc333ca44e7f574dc77b8787b
MD5 fb2c629abbe44dbe1306aecd1f3bb34c
SHA1 7079bd32ce2f40276abe16aabde5acec15bc5b1e
SHA512 4cdc025e5b2b5ba37506b56c6e9acf11eb56e3f245c9b429df3006fe3096a1fb7f7cd5330d319dbbacb124d67aa56ddba55f76ff30e4913f5b3c864257cb6191
SSDEEP 384:sxRQ38N/fqszlN/RIybY/5IW4NOBsGQmjQ:s8MN/fZXWl/5IW4osGQr
TLSH
T1A772E916AA289D3B9CDBD219FA557F93D6F91173A1505E44ABFC8B0C04E66EC210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 64d8b720df296864f50c6f5b753c97481ed10e68c9b42b66c24845c8c08ddca0
MD5 f921d25bf2ce3218b05e314b3704b447
SHA1 973a0f56a0e669d6b463b4eec837328f0813d32b
SHA512 09bc6a5d860c5628ab2903588b93ed394dbb55c4d59c577617c468877025ebd9a75d07f4565bc5e33d5baca48ea94a9d2daa445846870e299f6fdb78f5647a75
SSDEEP 384:sxRQ3qBN/fqszlN/RIybY/5IW4NOBsGQmuh:s8aBN/fZXWl/5IW4osGQv
TLSH
T12472E916AA289D7B9CDBD219FA857F93D6F91173A1501E44ABFC8B0C04E66EC210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72d99b90d9eae481e1e2da2749eb154370d7ea74e67d45f468d2b26f93206c3c
MD5 124e92aa1658506c1cb8f41edd19bffc
SHA1 64b5902d669411c45271027f6f262e6728ccb7d3
SHA512 c6787caf1ee18bdf0a089398f8adb1f920e8503d79ec657882d58c30d744cbbbfc7311f9350be0e792f773205bcc6d09bc3cfa366d679ede54cab7ce4cb99403
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroi4w:Ob4YZnE7yTWg1NfwBu1jasobHwANw
TLSH
T11CE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 680b21e3cc89d027dba49bca16f4a88e1bf24244d922a54a28c2f660f250120a
MD5 19b219585037aae32a9a7d7641583e4b
SHA1 e6eb474429fb955b8a1b45aa812a3ccfce867bb0
SHA512 c34dd0f415f21fb12f4c2e8e932bc1474acee357b8957f201ba990357930d3f43b9bf059120a0d7b2192d23c898265ab7ae775686c791cb9a021563609fdf187
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9h7y:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRd
TLSH
T1C1B24A11713F4280387EB91C91B8981ED6C2B4A37519E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e503b4fd82234df34c4cc790ffd6e61229ba377d4d74a52711a7955a854502ea
MD5 835522d782fe80afe71dbb03822120e2
SHA1 5a847d1633012c1219a0beefd3899915d66a0330
SHA512 18caf29d95e89e969615b3ea7fcea4179d74b6984f18859a695885ef48324cc34be5fee6d54afb02945cc1f3d9f88baf52ce014d08705042d7e6bb3e93c2e1bd
SSDEEP 384:nhiF1tNn/s3n9Sn8Ngc8TUNTUlIRzPvuTu5REqfbYG8oqHLcOObjI9G6w7aijh83:IF1j+9SXcwgJuQUG8Drc29MaWa
TLSH
T1DCC25A36EC55CEB7EDE64F98B70A7A56EEE0126385D85AC4DAD81E4C00C71ED4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2c7af858ccd98e1ceaa0275fe7c026292f9439aabfcd8a656a36346df90caa6b
MD5 c5bf269892b27fca90bbe1e2faa2836b
SHA1 4e246c1dc74a488b364c2cbe16df72428bd83ca0
SHA512 6abd867d59f2cef5f378767cd851801bd4573c7513dc019045782415ce463a63a8cc8e05b128535b2ae2d33f5dae1539d7fc276f072061c68056360721247264
SSDEEP 384:nbiF1tNn/s3n9Sj8NLe8TUNTUlIR6BPvuTneREqfbYG8oqGqrzebFukiixZ7DueD:2F1j+96QewguuqUG8DGUqbF44Z71Pr
TLSH
T15DD26C32D865DDB7BCEA4F98B71A7686DEE412B384C84DD4D6D85D4D00872ED070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f9aeff85c15d8d5534ca6406e049a45deab7280191db63d70aa06ae05c4973cf
MD5 a240a5a6d16afd470c792c7f5c02c864
SHA1 6f4dc46e5345bac5da14231c83cd93a34bc07bcf
SHA512 64d010ffdcc576b579bba32c306a9f5714585bc2973cc8551f1f9956a76ed9e0fd20d0530b75e220fda410d6106e93408d82e3562bb4619e525603e79774bb8e
SSDEEP 384:nYiF1tNn/s3n9Sr8NLe8TUNTUlIRcPvuTBEeREqfbYG8oqGqrFkbA18LEEIzsWS:jF1j+9mQewg+unUG8DGUabA6
TLSH
T1A1B23B32D855CEB7ACEB4FD8B70A7696DEE01163888C5AD4DAD95E4C00C72DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 870e4630dbaa1b821c9664c9e707d4acce883f9f50cd3a4a24545baf91a2f4ee
MD5 0bc827f41af0e2e75216e24e75223653
SHA1 086ebafb29d1c7a260c08f7373f58ad27a07c3b1
SHA512 3d8e769d49c5a4e4e48bdd7f142366ca40fdeb1f5b124849a57a75142dea9ecebabdbf27871dede327647cdba87e48196953a083d4106db3abd76084ad83331b
TLSH
T18D512CE08C381AD1D4BD0E7EB04B78EC95E8D726F490343D6858EA985A7A75D208083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cf549aea8a238269042df393c8b4105d42abf72e101236e03a3c40a0345b4e81
MD5 9241d646d554891879c345aa741ba5ed
SHA1 58b5c30f7a893098dd0690706054b598b96455ca
SHA512 2653c9aefae0e5b3afab354b6324fe8f41f2a36f19d24399a70310f3872a47b1f44bb9c7ee47bdc1fa166a37034ef50b8fb917d0d862bf1d7f8e04bee5da9dbd
TLSH
T143512FE08C381AD1D4BE0E6EB44778FC85E8D725F4A0347C6858EA585A7A65D308083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b76e71eb1978920d360eb637ddbb0d286a6254ae8d472c8798780f1b16f783ff
MD5 f0b2dfdb299f440c5eed02a52fea422f
SHA1 122ebd095a35822b5cb94a0581006b26ffbb4d6b
SHA512 db0eb2b814f330e6ed37633420d5c12d7f45a094c01b5a47a426777daf4ee9fa9969af4d7d61b08884994e554d4f5f325842884b7e35d518b88647fd4d092e68
TLSH
T15F513EE08C381AD1D4BD0E6EB05B78FC85E8D725F4A0343C6858EA88597A65D208483F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 e82523eb1496e28d1adf0f0853b0894d8bc27d50a75607182cdb70529b98ef8e
MD5 dd8feb675ce8c3fe2961fe0ada4d4fcb
SHA1 129333cae90cb6ea4dd3c6e12e7e9db0690b9402
SHA512 e9978190e6afdd9cc48d7a5c6f2d63fa13d2949a49c0d30a5dc6035d850e510b0691c6e6bb5824933a23aa1011f94538fe196f6272bbbc0b687d24c8f1f1333a
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3w:CebAjOKn3wRKRJ3w
TLSH
T106D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.old_1783649368

Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_478c6e2350ef9be2d5a9ee58657f5c90_akira_glassworm_rusty-stealer.old_1783649368
Size 2.7MB
SHA256 f1f7f66f32f9888fbf62f152a6d8bf53affcc40ee1e40931a9ac19356f2864bc
MD5 5baf7a2badee8de66f1303957524ebe0
SHA1 25f261d7fc02c6270bf98ce7c4bb586d07fec67a
SHA512 8ca7a0c5f8ec7036906e36f9c9ed9b4501b163703172870b50dc9cc5188b08b96ce6a14d0bb1ef0521fbffadea089968b8c9efcfbd536d2b2fa662a92130659a
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3t:CebAjOKn3wRKRJ3t
TLSH
T195D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3612_1926374923\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6080-233-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-300-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-255-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-314-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-241-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-234-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-208-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-928-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-202-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-951-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-952-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-193-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-977-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download

memory/6080-171-0x00007FF646260000-0x00007FF646521000-memory.dmp

Download