ae52222f7dc9a4d09006bc191761b1804344809824fe0ea585399be481f1204c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260729-2nekpsxtaz
SHA256 ae52222f7dc9a4d09006bc191761b1804344809824fe0ea585399be481f1204c
MD5 540ccc9cd1ad023c2c5136c0ec95f82b
SHA1 bdb7e2139d652d9781c8c6cb20c54c58a3dbdb21
SHA512 a290ad745695f566300b3fe4f721af6c3265be8e45dc049a069802c0452d5722d127a12f19252d79deb389a1ca874882804f3ebfdcbcd3ac259986e25b0d2c9f
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3y:CebAjOKn3wRKRJ3y
TLSH
T19ED57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3328	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_1986095511\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_1528788464\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_1528788464\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_1994516327\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3328_941138767\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_663683270\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_1994516327\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_663683270\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3328_547760670\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1428	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298386150828166"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C813CD0D-07C6-400A-B936-32A478727E71}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5592	wmic.exe
5592	wmic.exe
5592	wmic.exe
5592	wmic.exe
6836	msedge.exe
6836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4224	2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5592	wmic.exe
Token: SeSecurityPrivilege	5592	wmic.exe
Token: SeTakeOwnershipPrivilege	5592	wmic.exe
Token: SeLoadDriverPrivilege	5592	wmic.exe
Token: SeSystemProfilePrivilege	5592	wmic.exe
Token: SeSystemtimePrivilege	5592	wmic.exe
Token: SeProfSingleProcessPrivilege	5592	wmic.exe
Token: SeIncBasePriorityPrivilege	5592	wmic.exe
Token: SeCreatePagefilePrivilege	5592	wmic.exe
Token: SeBackupPrivilege	5592	wmic.exe
Token: SeRestorePrivilege	5592	wmic.exe
Token: SeShutdownPrivilege	5592	wmic.exe
Token: SeDebugPrivilege	5592	wmic.exe
Token: SeSystemEnvironmentPrivilege	5592	wmic.exe
Token: SeRemoteShutdownPrivilege	5592	wmic.exe
Token: SeUndockPrivilege	5592	wmic.exe
Token: SeManageVolumePrivilege	5592	wmic.exe
Token: 33	5592	wmic.exe
Token: 34	5592	wmic.exe
Token: 35	5592	wmic.exe
Token: 36	5592	wmic.exe
Token: SeIncreaseQuotaPrivilege	5592	wmic.exe
Token: SeSecurityPrivilege	5592	wmic.exe
Token: SeTakeOwnershipPrivilege	5592	wmic.exe
Token: SeLoadDriverPrivilege	5592	wmic.exe
Token: SeSystemProfilePrivilege	5592	wmic.exe
Token: SeSystemtimePrivilege	5592	wmic.exe
Token: SeProfSingleProcessPrivilege	5592	wmic.exe
Token: SeIncBasePriorityPrivilege	5592	wmic.exe
Token: SeCreatePagefilePrivilege	5592	wmic.exe
Token: SeBackupPrivilege	5592	wmic.exe
Token: SeRestorePrivilege	5592	wmic.exe
Token: SeShutdownPrivilege	5592	wmic.exe
Token: SeDebugPrivilege	5592	wmic.exe
Token: SeSystemEnvironmentPrivilege	5592	wmic.exe
Token: SeRemoteShutdownPrivilege	5592	wmic.exe
Token: SeUndockPrivilege	5592	wmic.exe
Token: SeManageVolumePrivilege	5592	wmic.exe
Token: 33	5592	wmic.exe
Token: 34	5592	wmic.exe
Token: 35	5592	wmic.exe
Token: 36	5592	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3328	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 2104	4224	2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe	90
PID 4224 wrote to memory of 3328	4224	2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe	92
PID 3328 wrote to memory of 3912	3328	msedge.exe	93
PID 3328 wrote to memory of 1204	3328	msedge.exe	94
PID 3328 wrote to memory of 1428	3328	msedge.exe	95
PID 3328 wrote to memory of 1204	3328	msedge.exe	94
PID 3328 wrote to memory of 1204	3328	msedge.exe	94
PID 3328 wrote to memory of 5780	3328	msedge.exe	96
PID 3328 wrote to memory of 5780	3328	msedge.exe	96
PID 3328 wrote to memory of 828	3328	msedge.exe	97
PID 3328 wrote to memory of 6776	3328	msedge.exe	98
PID 3328 wrote to memory of 828	3328	msedge.exe	97
PID 3328 wrote to memory of 828	3328	msedge.exe	97
PID 3328 wrote to memory of 6776	3328	msedge.exe	98
PID 3328 wrote to memory of 6776	3328	msedge.exe	98
PID 3328 wrote to memory of 1260	3328	msedge.exe	100
PID 3328 wrote to memory of 1260	3328	msedge.exe	100
PID 3328 wrote to memory of 1260	3328	msedge.exe	100
PID 3328 wrote to memory of 6848	3328	msedge.exe	101
PID 3328 wrote to memory of 6848	3328	msedge.exe	101
PID 3328 wrote to memory of 6848	3328	msedge.exe	101
PID 3328 wrote to memory of 3036	3328	msedge.exe	102
PID 3328 wrote to memory of 6036	3328	msedge.exe	103
PID 3328 wrote to memory of 3036	3328	msedge.exe	102
PID 3328 wrote to memory of 6036	3328	msedge.exe	103
PID 3328 wrote to memory of 256	3328	msedge.exe	105
PID 4224 wrote to memory of 5592	4224	2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe	108
PID 3328 wrote to memory of 6376	3328	msedge.exe	112
PID 3328 wrote to memory of 5152	3328	msedge.exe	113
PID 3328 wrote to memory of 6792	3328	msedge.exe	114
PID 3328 wrote to memory of 5456	3328	msedge.exe	115
PID 3328 wrote to memory of 5456	3328	msedge.exe	115
PID 3328 wrote to memory of 6000	3328	msedge.exe	116
PID 3328 wrote to memory of 6000	3328	msedge.exe	116
PID 4224 wrote to memory of 2388	4224	2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe	117
PID 3328 wrote to memory of 756	3328	msedge.exe	119
PID 3328 wrote to memory of 756	3328	msedge.exe	119
PID 3328 wrote to memory of 1404	3328	msedge.exe	122
PID 3328 wrote to memory of 1404	3328	msedge.exe	122
PID 3328 wrote to memory of 4272	3328	msedge.exe	123
PID 3328 wrote to memory of 4272	3328	msedge.exe	123
PID 3328 wrote to memory of 5716	3328	msedge.exe	124
PID 3328 wrote to memory of 5716	3328	msedge.exe	124
PID 4224 wrote to memory of 5584	4224	2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe	125
PID 3328 wrote to memory of 6836	3328	msedge.exe	127
PID 3328 wrote to memory of 4288	3328	msedge.exe	128
PID 3328 wrote to memory of 4288	3328	msedge.exe	128

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2104	attrib.exe
2388	attrib.exe
5584	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.old_1785365010
  2⤵
  - Views/modifies file attributes
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x364,0x7ff8b005c188,0x7ff8b005c194,0x7ff8b005c1a0
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,17970038933083705197,10986823169860464517,262144 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,2673581163729220519,12054757057138280992,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,1946466639171537432,3275557228935627172,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,3783286960137453300,5648155669636005008,2097152 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,666568394687788413,3209693988293231191,2097152 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,11020210308422971139,5956236963522619635,2097152 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:9
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5340,i,7478494106133579059,5430942150434788806,2097152 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:15
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,588790501765438830,15630159334481705087,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,14498622990764432915,18363496947910170988,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15691125206366062812,4310907537985128971,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15691125206366062812,4310907537985128971,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5986981370494219100,1996215127882321455,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2801795959541162990,1129753792985101904,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,6082896146752666774,8661848330841672090,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:6792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,9680554470816496024,8208749179134100598,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5363806455719981910,10527480028231364696,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,3188977712434573221,3955443125944162183,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,8602514099026419786,5168818560859948680,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,15814783237472394346,423191020581983587,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1853704002668003183,9146882849417502266,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6672,i,14770303631509075828,13338482942703009993,262144 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,12304270367216209856,7740524428566329937,524288 --field-trial-handle=2576,i,11425259645811985938,14852655469733489097,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:4288
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.old_1785365071
  2⤵
  - Views/modifies file attributes
  PID:2388
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.old_1785365131
  2⤵
  - Views/modifies file attributes
  PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c4c9d013a67ecf5006cbcda1c704911e797f29d69bc8bce2626e8807a877b8a3
MD5 a6c0fe46337f0130a71b684d07bd8a9a
SHA1 9bd7993540409fe7265cc7e9aaa556096045a29b
SHA512 258969a766caac60f32887699081610a9e04abd80b67227ba550138eb571dbfae65339757318164e22c96518908da0db3c0a99e1c154701fbf96e2bb3eb8fc59
TLSH
T1F3F0F9A6C921BC3719FC1B1860680A47E750131B3B41D88B3B3C825C4FB463B474681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d7a334249daf452de16b629f5f5661a6b3ebcd4b96a479f0acd740e724735e7
MD5 c195481864d8d6b8e20216da59df8405
SHA1 36e0a868ab747f3a21d2a519eb63f8dae4ad7cde
SHA512 ce51cb7c0f067cf89a1f6f2228b0398f5e51b3aac01a9573b52db2a44081ea52eeafd19cc2f02a39708a91c044d7478121699d0afada3b4f90eb3c7ba6731098
TLSH
T14161FA9173210AD2DB358DBE22E1D856AFFD5D96050F5E5A11407D3FFC0AF4224D0963
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597c6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597c6a.TMP
Size 3KB
SHA256 464fb1e19e5700c02ff32a6e32b34013b212711de3be88a2c29b0ed214407a73
MD5 283a1a870f0a20eeed2bb2b0d76bc3a8
SHA1 e746691985686f079a5f0395eba99e1603628317
SHA512 19a77e6cc75334a581d9a53f5b96754bf5d688aed406d697983222e18d2d1a08122cdff3a4e4fab1578dc7e341573c0cd6af431343190b2d42905d1f82cce1a7
TLSH
T14D61E89273210AD2D7398DBE22E1D895AFFD9D96050F6E1A51807D7EFC0AF4214E1C23
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 36b39e15c737dc90badd18de4fe2bcc6435544a9dc12c7d8eec5eeef6c4d326f
MD5 baa617c91264ea0bc01aaa62c366f262
SHA1 2f060ac216728a7479fe019887e1a8008724eb4d
SHA512 5b2f000ad5f79c81fdb4cbfd043698f3365a074030fd62f3b56cdc408c9fbe6e3a561b35154747a0664c759ee5cb82fd714603d4e8366db4d34c11af1bb90a1a
TLSH
T14551AEF7C3E4866EC91156F0EA18BE2BCE1D0914832C3D5AC9E4AE5B93E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c99f0379-7477-40c1-884e-b46bf83b3d08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c99f0379-7477-40c1-884e-b46bf83b3d08.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b7ac60582051f1db63953f9dec88b5377f45df3e7434f681babf5592dc9cb86e
MD5 b0ee6f2854c4c49f24eca0e20f8dd95d
SHA1 d432cff34f8951660c2925c591255ef9da9ca976
SHA512 2ffe51b0f7eb126b4b7c1ba97f534c5dcc394d68e3f9d66e28e379ef8d4a40a35dc0d3b6f9aeb9dd84e1183668e90e9dcfc88403e04ae2249047ba21047ee60b
SSDEEP 384:sxRKRH8p/fPshUN/RIALJ/5IW4NOlsGQtj5:sm2p/fweW2/5IW4OsGQv
TLSH
T12672D916AA249D77CDCBD219FA567F53D6F8113391905E44AAFC8A0C04E66ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9ad244bb006e5884faaaf2d49cd4f1782f43850579f952d2eecc995163e250b2
MD5 25da7a66c4dcd973256d1ab115b3b45e
SHA1 cad38dc91ef79d093f53034f1313bcd433c13518
SHA512 e828d9af9f5384d20c668dd6af37b46501b46ce48d6be835839ea455e174360d03116b1ebf29c58b6ba048a754b60a5d6bd73e21f06d13b5bcaaed54e3cb3191
SSDEEP 384:sxRKRHqbp/fPsn4N/RIALJ/5IW4FOlsGQtPo:smgbp/f6iW2/5IW4GsGQy
TLSH
T18B72D91AAA249977DCCBD219F6967F93D6F8117391505E44AAFC8F0C04E67ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f39b250b909935ba0758acc703eb8f35e385a7a627b0a6ca69495ac7efdc0165
MD5 dd7541ba6ea0463d90582968f9b7ffef
SHA1 813984f74284c435d791288e47e7b367495c3868
SHA512 d38a544a41a14435b3ee6f09cfe4fc63124e456de6b24a122d21c6427e2fd7ce2a612e3ea53c53833cc22d56737e4672ec8d9ca95e541dba8d9879cd1521a4e4
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpobbDwzrom49:Ob4YZnE7yTWg1NfwBu1jayobHwAB9
TLSH
T1ECE2EC3B280CCB7E4F804ADDEC29BDDA6DA801CF56D8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b433e047ce7d48fddac5a2bc1e030741d4f1c465a77b74643643ea5eadb8915e
MD5 c85cea10c7cd5285a96a04a0ecdc7d4c
SHA1 e295824815e7df4851b34b70598e46fcbdb1312f
SHA512 b5c166a79abfc8fcb19694ae603aed0bbdc88706440039bac52667f1570ccd5e58dfbef0e7302fa780c78219fa32e8a2613e09a5a13911d5ea64da9288bb1050
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9JV7:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRm
TLSH
T130B25B11713F4690387EA90C91B8D81F96C2B4637519E52F7BA802A65F67E038DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 db058bd65f3e47576da1b6e8874bf32ef368648aff2e5c4c10e3d1424c9dcd85
MD5 a65415b9786c4c10d08edef8333a93b6
SHA1 a97e943889c14232eeeed245d0c671813032661c
SHA512 0d17cc8ecdecd3a8e1ae85347ca97ac72290f7b74f5921bf1a15bd20131e58a1f6b265e5d24b6f4520583f7db76c6e3a7db7e0e2a2135e907c422aeab91cce30
SSDEEP 384:noiFiZcIs8NLe8TUNTUlIRUPvuTe1eleff+GGnR9nnFLKMiScjmwy2p8LEEIzm:zFQsQewgiuOeiGRVi1j+j
TLSH
T1FAD25B32DCA4C977EDE78AC9B6497646DEE011A3C58C9EC4E9D95D0D00D71DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0bc4b39ca5d3201b649eb5f624e92761c61fc44d79fe92e80a18f296a9996d37
MD5 b32cb9e6514d111053cafea25f5dcd7d
SHA1 f9c7277ebc81daf8618879d914f41e63843e3615
SHA512 09ce86600355a112e4dc969f10df3fdb12dac6112b3c8fdf8e0c787619926a58c8f8d69cdfa1a64be9eeeab4132c022f06dac38938bc8ce53f55e15360ceb105
SSDEEP 384:n4iF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuCReff+GGnR9nn/LVOObjI9G6w7uW8O:DF1j+9SXOwgUufmGRRV29Mj
TLSH
T1A1C24A36DC95CEB7EDE74FD8B24A7A4AEEE01267859C69C4DAD85D0D00C71ED0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b32a40699995457e1bd4e89fecdf1d5bf9ffd828a84c3f6d8060aec613ecdb0d
MD5 166301ed6113eb484183d43c8fe78357
SHA1 554fac78c77175dfdad4d0219687f447a1dff041
SHA512 0f05f435a946355e98371b5c97806db40c29233d88e2cc969780c2d64af78f7007662b391f859fe0ebe607d18657c666501a584eb48623d39a1f1462653da7e6
SSDEEP 384:nliFiZcIN8NLe8TUNTUlIRUPvuTe1eleff+GGnR9nnFL4ciScjmwy2p8LEEIzm:sFQNQewgiuOeiGR3i1j+j
TLSH
T1F1D25C32DCA4CD77EDE78AC9B6497646DEE011A3C59C9AC4E9D95D0C00D71EE070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 aa5bb800111e0fc2efe2928d37eba205a5fa9442528105e5498db9a11cbd3d61
MD5 30ad7444b3b0406217626ad736f32619
SHA1 11c1526f801225c0aebb647c3ded93789b3b2ffa
SHA512 545c147f69f4576be9dbd9487d1ca4edbbd49510f672dfd7077a04d33ab5eba613f3a0fd3a8acc9325f2b0a6db70d09bedff983f3276383d32a7429f13162ae8
SSDEEP 384:n1iFiZcIN8NLe8TUNTUlIRUPvuTe1eleff+GGnR9nnFL4ciScjmwy2p8LEEIzm:8FQNQewgiuOeiGR3i1j+j
TLSH
T1F0D25C32DCA4CD77EDE78AC9B6497646DEE011A3C58C9AC4E9D95D0D00D71EE070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f86b2319b720f8e4e2dfc957e1288f92fbfb2f93e80084dc60b0d7feff99cc1e
MD5 79293769586e8d4565cd3f21d3fbb4aa
SHA1 1ecca2d6165ce32042f6db11c0268528beb30d2b
SHA512 565792f825cd9ede6438e0ce3fcf3b226fe5bc8fe3e0137d4194a78269f225b8da9194553b53aa8b1118588b9e5e491352c01760752b9bf67e9095d5a3796b60
SSDEEP 384:nliF1tNn/s3n9SL8NLe8TUNTUlIRxPvuTg1eleff+GGnR9nnFL4ki8d8LEEIz8cI:sF1j+9yQewgXuoeiGRZi8RI
TLSH
T1A1B22B36DC95CE77ECE74AD9B74A7646EEE012A384889ED4E9D85D0D00C72DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1145bf14c1b64499ed29e1bed995598686b48841d91f3a47af8390b77baf6b6a
MD5 ce59875d8f19e180bebd38e188be4d86
SHA1 e921b6ff943e0bbd7b3e1a65f99bf79edee7976f
SHA512 08d4206d34dd317052f7053e6c6caae8253ca7009ac9737b545b4f96fca733b30d004d12447ffc04d22d9088b0c5f5dc925bc5ea30006d49752f7f1bd6aedbc4
TLSH
T1084120E09C3919C1D4FD0DBF788B25FC94D88726F4D430386898ED59527A65E354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 000d8c398a2486f6ac06a63cb1fe623622cc9c6e6ca9d34cf872f86d10d847c2
MD5 e148e96f4b9ec436a8fc26349eb3b685
SHA1 b22f84bee0c43c2fa847fe67b5398bef3a88b0cb
SHA512 4cbc25231b3d2686e8ab3fb888a5fdd9978054ef5317d881381bacd6700097185798949bcf499076f4ceef4ba7d1ce85df3c240f0c097f2299c1e9a746b1aa85
TLSH
T1A2411EE09C3919C1D4FD0DAF788B29FC94D88726F494307828A8E958967E65E268483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3df19836dbbdc5b1421ad8dc4f7e7e0e7a434d2617ad0282a47668f0071d5437
MD5 a3dcf738dc6e5ac7d9cf4e7251687726
SHA1 0fa66734ea4a1723e40fe030e1148e966da66236
SHA512 fb4e007caa73a0809c1153241a6cdc386c73ede299c669d8ebfb6b9e20367ab6c0a58a7a3d213c3c9260d7accb85def6356c041eac1f7d599b79602d986b1e9a
TLSH
T1984164E09C391AC1D4FE0DAFB44B29FC94D8D326F4D434382858E968963D65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

1e3fa947-4230-49dd-baa0-2ae3ec923053.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1e3fa947-4230-49dd-baa0-2ae3ec923053.tmp
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 317043b47dfcf95b9bdd4d93519e7c23118b23acd83586b08e448e74b6559c6e
MD5 24952dabe112ecdc28186687771e23cc
SHA1 28efd31a38407e999c088cfa70d4c279d6e2b6f0
SHA512 1406eb1f280c6a2c7e785824a85df190cd34b721fa7e744770d4b7bb81362a347e3e7d3f69052de3232b63c7ece0532f76fd4c9f0d6741d83c980698657fd5f0
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3r:CebAjOKn3wRKRJ3r
TLSH
T160D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.old_1785365071

Path C:\Users\Admin\AppData\Local\Temp\2026-07-29_540ccc9cd1ad023c2c5136c0ec95f82b_akira_glassworm_rusty-stealer.old_1785365071
Size 2.7MB
SHA256 c484b68655e0b1401eedad6bcdabf85c9361797561e7774aacfcf7f2a92d4b2d
MD5 6cc4f2fa22fd3b41f783b2961a01816f
SHA1 803efa94eaab81c47a9f9cbf8a771f7a0738fd2a
SHA512 937f781f2b61526b8612bad6564603204d6f6938bb4c26563cadf53bfcece42d7b51a9de0637c39647bf9dbafee15b20d137177d61286bfada2ae5cfeaab2d82
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3f:CebAjOKn3wRKRJ3f
TLSH
T110D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4224-427-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-464-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-485-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-458-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-500-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-457-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-525-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-538-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-190-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-557-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-173-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-566-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download

memory/4224-149-0x00007FF73D210000-0x00007FF73D4D1000-memory.dmp

Download