5fbc80cf7538a3f58a007f7b7cbb423852707b8e37d41a7ceda0b2c97aeb1b19

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260804-s39jysda95
SHA256 5fbc80cf7538a3f58a007f7b7cbb423852707b8e37d41a7ceda0b2c97aeb1b19
MD5 5d06d04598e0cbfdaa81a78a4a01f6b0
SHA1 c203f1e10c746164de896b67b184ba041c4ca321
SHA512 98fa4767e300faa93767483fa8a127c18e3e6330159c1ef9251bfa0f796b52850ee9bb9437926719e0716297bb9b41b65f89cc9a8c440d85b02a204221d7c4d1
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3k:CebAjOKn3wRKRJ3k
TLSH
T108D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5044_173051194\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2147322222\_locales\zu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4280	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303316341295227"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{3EDF45F0-700B-4670-9552-D4CA35FFDD54}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4616	wmic.exe
4616	wmic.exe
4616	wmic.exe
4616	wmic.exe
1924	msedge.exe
1924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4900	2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4616	wmic.exe
Token: SeSecurityPrivilege	4616	wmic.exe
Token: SeTakeOwnershipPrivilege	4616	wmic.exe
Token: SeLoadDriverPrivilege	4616	wmic.exe
Token: SeSystemProfilePrivilege	4616	wmic.exe
Token: SeSystemtimePrivilege	4616	wmic.exe
Token: SeProfSingleProcessPrivilege	4616	wmic.exe
Token: SeIncBasePriorityPrivilege	4616	wmic.exe
Token: SeCreatePagefilePrivilege	4616	wmic.exe
Token: SeBackupPrivilege	4616	wmic.exe
Token: SeRestorePrivilege	4616	wmic.exe
Token: SeShutdownPrivilege	4616	wmic.exe
Token: SeDebugPrivilege	4616	wmic.exe
Token: SeSystemEnvironmentPrivilege	4616	wmic.exe
Token: SeRemoteShutdownPrivilege	4616	wmic.exe
Token: SeUndockPrivilege	4616	wmic.exe
Token: SeManageVolumePrivilege	4616	wmic.exe
Token: 33	4616	wmic.exe
Token: 34	4616	wmic.exe
Token: 35	4616	wmic.exe
Token: 36	4616	wmic.exe
Token: SeIncreaseQuotaPrivilege	4616	wmic.exe
Token: SeSecurityPrivilege	4616	wmic.exe
Token: SeTakeOwnershipPrivilege	4616	wmic.exe
Token: SeLoadDriverPrivilege	4616	wmic.exe
Token: SeSystemProfilePrivilege	4616	wmic.exe
Token: SeSystemtimePrivilege	4616	wmic.exe
Token: SeProfSingleProcessPrivilege	4616	wmic.exe
Token: SeIncBasePriorityPrivilege	4616	wmic.exe
Token: SeCreatePagefilePrivilege	4616	wmic.exe
Token: SeBackupPrivilege	4616	wmic.exe
Token: SeRestorePrivilege	4616	wmic.exe
Token: SeShutdownPrivilege	4616	wmic.exe
Token: SeDebugPrivilege	4616	wmic.exe
Token: SeSystemEnvironmentPrivilege	4616	wmic.exe
Token: SeRemoteShutdownPrivilege	4616	wmic.exe
Token: SeUndockPrivilege	4616	wmic.exe
Token: SeManageVolumePrivilege	4616	wmic.exe
Token: 33	4616	wmic.exe
Token: 34	4616	wmic.exe
Token: 35	4616	wmic.exe
Token: 36	4616	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5044	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4632	4900	2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe	89
PID 4900 wrote to memory of 5044	4900	2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe	91
PID 5044 wrote to memory of 4288	5044	msedge.exe	92
PID 5044 wrote to memory of 4280	5044	msedge.exe	93
PID 5044 wrote to memory of 4204	5044	msedge.exe	94
PID 5044 wrote to memory of 4204	5044	msedge.exe	94
PID 5044 wrote to memory of 4204	5044	msedge.exe	94
PID 5044 wrote to memory of 4552	5044	msedge.exe	96
PID 5044 wrote to memory of 4552	5044	msedge.exe	96
PID 5044 wrote to memory of 2972	5044	msedge.exe	97
PID 5044 wrote to memory of 460	5044	msedge.exe	98
PID 5044 wrote to memory of 2972	5044	msedge.exe	97
PID 5044 wrote to memory of 2972	5044	msedge.exe	97
PID 5044 wrote to memory of 460	5044	msedge.exe	98
PID 5044 wrote to memory of 460	5044	msedge.exe	98
PID 5044 wrote to memory of 2060	5044	msedge.exe	99
PID 5044 wrote to memory of 2060	5044	msedge.exe	99
PID 5044 wrote to memory of 2060	5044	msedge.exe	99
PID 5044 wrote to memory of 2468	5044	msedge.exe	100
PID 5044 wrote to memory of 2468	5044	msedge.exe	100
PID 5044 wrote to memory of 2468	5044	msedge.exe	100
PID 5044 wrote to memory of 2188	5044	msedge.exe	101
PID 5044 wrote to memory of 2188	5044	msedge.exe	101
PID 5044 wrote to memory of 2188	5044	msedge.exe	101
PID 5044 wrote to memory of 4088	5044	msedge.exe	102
PID 5044 wrote to memory of 4088	5044	msedge.exe	102
PID 5044 wrote to memory of 4088	5044	msedge.exe	102
PID 5044 wrote to memory of 6024	5044	msedge.exe	103
PID 5044 wrote to memory of 6024	5044	msedge.exe	103
PID 5044 wrote to memory of 1052	5044	msedge.exe	105
PID 5044 wrote to memory of 3812	5044	msedge.exe	106
PID 5044 wrote to memory of 1052	5044	msedge.exe	105
PID 5044 wrote to memory of 3812	5044	msedge.exe	106
PID 5044 wrote to memory of 3728	5044	msedge.exe	108
PID 5044 wrote to memory of 1444	5044	msedge.exe	109
PID 5044 wrote to memory of 1444	5044	msedge.exe	109
PID 5044 wrote to memory of 2600	5044	msedge.exe	112
PID 5044 wrote to memory of 2600	5044	msedge.exe	112
PID 4900 wrote to memory of 4616	4900	2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe	113
PID 5044 wrote to memory of 6112	5044	msedge.exe	116
PID 5044 wrote to memory of 6112	5044	msedge.exe	116
PID 5044 wrote to memory of 2056	5044	msedge.exe	117
PID 5044 wrote to memory of 2056	5044	msedge.exe	117
PID 5044 wrote to memory of 1364	5044	msedge.exe	119
PID 5044 wrote to memory of 1572	5044	msedge.exe	120
PID 5044 wrote to memory of 1076	5044	msedge.exe	121
PID 4900 wrote to memory of 3248	4900	2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe	122
PID 5044 wrote to memory of 5584	5044	msedge.exe	124
PID 5044 wrote to memory of 5584	5044	msedge.exe	124
PID 4900 wrote to memory of 4112	4900	2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe	128
PID 5044 wrote to memory of 1924	5044	msedge.exe	130

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4632	attrib.exe
3248	attrib.exe
4112	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.old_1785858028
  2⤵
  - Views/modifies file attributes
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe1952c188,0x7ffe1952c194,0x7ffe1952c1a0
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,13874094493504418757,2791705511936385510,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,9823539778649966591,14243011375590891738,262144 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,9035726694270252241,12588250896615949750,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,14746379630147800793,16511815579855869339,2097152 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,3709376126417382172,6309579158112594756,2097152 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,3654294919273543173,9571440120838369512,2097152 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,14290863999907549520,1482659681230214469,2097152 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:9
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,15697967009633678390,4017970519530017334,2097152 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:9
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5484,i,1443828339391502308,11018135604309216783,2097152 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:15
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,11052819954514688386,14151634970480976474,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8007072568144950184,14887266566754453613,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14588978949958791966,12840094546389149479,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,7219321972378811736,6263696646210862543,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,7219321972378811736,6263696646210862543,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,14920058520819708522,2002859755167215363,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,16477272553056727917,2987160423801691893,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,8734851024384630524,12971012437161898306,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:14
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,10813566676150745248,15822497737641062576,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,17852877632242873270,11730516202963786359,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,11025908540109657095,1633971245160595582,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,12536767923847654536,868922268951967714,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3172,i,4954036441678263966,5868587334415889221,524288 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,6855093141128035452,16451252076761544182,262144 --field-trial-handle=2332,i,14989491018051935011,10222245308859406772,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1924
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.old_1785858089
  2⤵
  - Views/modifies file attributes
  PID:3248
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.old_1785858149
  2⤵
  - Views/modifies file attributes
  PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 aeef027e2815b2521540bfafca5dc9868e4704559d94f50c2624cd0f23b3b5ff
MD5 f1bc1e42cdfddfcffa8adefda75f1f43
SHA1 20d79b0f10d48d48de9c6e376ef6de08190a2d00
SHA512 43e29eeed877adc8e480a53c76891a31c421506f933dec010ad4dc44840e55e768de2f9df983c4c2f141fb8e818b737bc704b67a9d859fe5d336876c6c208c1b
TLSH
T19F612D50032E5DEADF2281B3F5B087B5B6F48CB89943DE41999A2E348817F1C72CAC57
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596ff6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596ff6.TMP
Size 3KB
SHA256 6fa6be1a1d4f7a58b57722997220c5baa016d0d32d4c8208a6bdce751479b171
MD5 eebb962684982d1788095412ce845ea4
SHA1 0bb86d42fe15065eae1da51742f7ce47311734e1
SHA512 26ff7fd59c46c4382a6dddfae42e6cea9338681ab4d295503c9a716cdd033bf2bb0efd11e97380c658ea31f3d8b6acbf7bb921e0c05a58ec3db1b9318c9dde6b
TLSH
T184612C54032E4DEADF2585B3F5A147B4A6F08CB49D43EE40999A2E348812F1C72DAC67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 783d6e730c71993431490bdaf735d7f294c87fcae9b85343166d7ac364d82323
MD5 49e24da85107b49c9ded0e876c807c68
SHA1 7469febe409a7f5a3771b93ec0081ad294b7350e
SHA512 78f08333ffe2f985262516d42e673cc71ef4d56fd3f38420af11e028f77ffb60df0ad5640605860c0824ff96e580111dfb896108fa0420df8cd91c165c5c0587
TLSH
T14B51AFF3C3E8892E890156F0A7186E1BCE1D0955432C3D5AC9E4AE1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1e320f3238d37d7be6d049b1f96279c0fc53050c45d7875ece52444480b4dcae
MD5 6e3d02901e5d56924ad8765b2c0cd174
SHA1 c3489ee61bdad61bda35473a2723d0e359b24672
SHA512 7ae084ede7566f914e777e1ad770afc65dddc8495d9c078492c745f33c69f496c68d7cf2871a5df99b74e9d1ac90d772a8fa20ef54b22e2c387a71b7cf188453
SSDEEP 192:sxR3R/C9/fBs4fvIiZUeV0zoA8p4fy/g6+WNIYD9WOw86StGhXIgDsBZTdJ:sxR3s9/fBs4fQkNKy/5ILOUSi6n
TLSH
T1A442C815AA28693B9CC7E25DFB56BF53D6F9603260901E58E7FC961C04EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a310b760f3689785ba3b0b9f30d019aa801ed8c8591cb4e2af4c7f76df4f0200
MD5 02f7d61654d7ea665cfb59cb1df0929f
SHA1 c0b9b856b3125aa0610ccf271a0c45a180f2a844
SHA512 ca926f0b04a8699692e56e9ae47601600767ab856c0dffa2b466d56fa3a49039b7db38540eeec28a482ab330702933e564aefcdf6be86b04a82fce175567901e
SSDEEP 192:sxRER/C9/fBsapIiZUeV0zoA8p4fy/g6+WNIYD9rOw86StGhXIgVBZTdJ:sxREs9/fBsaikNKy/5I0OUSihn
TLSH
T1FD42C8156A28683B9CC7D25DFB56BF53D6F92032A1901E58E6FC961C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 73d3cd81666de781e1a6da43ab75803a2b7d0e42c34c54019693f9ae64c9d634
MD5 85fc4a40aa3652bccd671d37427c10c3
SHA1 d5da79dc63ff34e0a0696795f58a73d8984a2c09
SHA512 63963b975f812170479ac5ea36d5e967fe0c7116f9cab793eda1fac23fa85496c2fd102dcc552a3c220ef18f3f1ded4cec534944448aeb632e7acd4b8e395a10
SSDEEP 192:sxR3R/C9/fBs4fpIiZUeV0zoA8p4fy/g6+WNIYD9rOw86StGhXIgD2BZTdJ:sxR3s9/fBs4fikNKy/5I0OUSion
TLSH
T19242D8156A28693B9CC7D25DFB56BF93D6F92032A0901E58E6FC961C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7ed656ed4ce8f4e9240c45562e6200480f8750b7f2cf577c85d246398a064d2e
MD5 e4bb0e5eb6b41ff688be680bfaf10369
SHA1 77d2fe33ce32662125e0ff04e23b11e230ef8d38
SHA512 05646dfc895971026a652358b9e7e758b4863bf3fe6636fc7751f5f3f297a49a4223ce676eb153bb172fe90c0b2548f9b6733c3579d0723e32c3c0e2716ac6fd
SSDEEP 768:azfWIQ7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVF9Yc167rop2CHY:azfWIcEf30Wg/XfHfu1jaG9Yy6Ip2n
TLSH
T138D2DA7B640CCA7F4F800ADDAD1A7EDF6D6802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

612fb481-9bfa-4024-9969-dd1d46c08548.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\612fb481-9bfa-4024-9969-dd1d46c08548.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a1ba3a7c82da739c633695df78d4400491b8aa69bb79d3587a931bc0b8cd8a99
MD5 2e1ff7c809ef413c8f58a7433123805d
SHA1 e94b618c77d9d659da89afcf459ab83be5aafebe
SHA512 27eb323183be92b27c492660ead129bfa490e089e68bba00ff82de00ef3fbda9a15e8963584fbb7a30815adbc36d37959b068f495f52a0b68c2e5ba03632a89e
SSDEEP 768:tC3xzyFi0ntarEnjN3Gac1FvojKgqmUcT:tC3FiwQnjMaIfgRUcT
TLSH
T146F2B07068759E738CEBE3C675833B936EF1166385D40FA4D6DDAA0D048369C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d3e9a45043e3ff4220eef04fb90e4b21b82960a8b91728ae640d3f57599719b8
MD5 781e870ca23f33e0320ac90103023bea
SHA1 6cf0381164c23870856d5dda14ff2e8a0e442588
SHA512 fb43f997afccad14487fe15c53be7ee93a9f7c35b1f1efea9c21488f396357264d2ff2ee56dde20b4bea2348f3e9daad7a373baacd7992c0b471cb7675686ddf
SSDEEP 768:7C3mzyFi0ntarEnjN3Gac1FvojKgqmUcT:7C3UiwQnjMaIfgRUcT
TLSH
T171F2B07068759E738CEBE3C675833793AEF1566385D40FA4D6DDAA0D048369C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ec2448ead18151265ea78118460ac4cb9cd0e3aaea75da27759a50c292a000d0
MD5 d0b20ddaeb9d92e55f0c1c7e507069b5
SHA1 2ca7c3e24abfd99ac81c69c02fb4acbb34ce9559
SHA512 cca050dfab596a54a71e28ac4ba2e377dd8d8de5a79c527effb558d5f98d7857b5c0d5d7ea0376cafe85c81df4907483e1c5bf88dfa664839447f6046a0690d0
SSDEEP 768:6FQG3BwgkzymsntbrEnjN3Gac1FvojKgqmUcT:hG3qoxQnjMaIfgRUcT
TLSH
T10D039D759864CE779CFBD7C6B6827B879EE0126385D88EE4E6C96D0C10836DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5e669f888e01337c2abc08a8d928e1f8f808eef86efa39fb8d84e6de4586b8b4
MD5 df1214a9acc96e6add3c7498c21b5680
SHA1 c71dcd1ce50fc38128ba526e774d8ebe1b8e4f65
SHA512 b89f84e0d7f8773b63f3d1569786d48812f47bca4e3edb17910d1faab150a9e071a3890130f227d4ee56ae07ac71ba70ec26c06afaa56126a1933c580bf070c0
SSDEEP 768:Xrv+4UNbdC3DzkFi0nt+rEnjN3Gac1FvV:XbsbM3HUcQnjMaIV
TLSH
T18903BF3179689E738CFBD285B5837B437FF416A384C50BA4DACA6A0C05875ED270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a9f55eddb2ad6413aec7580ffb629fade5de56537e1206ac1b1d48c431b4bf9b
MD5 fc93d0c9be908c5b871c1c07e4138df0
SHA1 e7b82bffc7e31dd4a01dc923e43b98e70939d6f8
SHA512 14faeec61841b68e191c11f9baab8ec50607bc933d339dec51f07e3f6b4387fabb8a2baf5963c99271b47048df4692f6fbf5b915f922b499062e85305f2adf0a
SSDEEP 768:rrv+4UNbdS3Imi0ntdrEnjN3Gac1ZReVH1SCz:rbsbg3fPQnjMaGEH1V
TLSH
T17903CF3669A88A738CE7E38575837A037EF4525385C40BE4C6DD6B0D069B9EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

938998bb-3a83-42ee-9010-849facc89b11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\938998bb-3a83-42ee-9010-849facc89b11.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe592e69.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe592e69.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 207dff6c9d713c854974f387531f1c3243cf46f5370ec13e51bc63da9f0f72e9
MD5 84f251bed12e11b6f0250d7542a1316a
SHA1 a1eb09e69cd8504e165d8059c540ce61ec5471c0
SHA512 bb4f233121eb219ffa41519f12121145d88db11817bb926d7c53073c7ac68d567d9a823d2e6dcd174644061e2b220ed0ec9ec2523cbba1f5d3d371534ae2fd0b
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ36:CebAjOKn3wRKRJ36
TLSH
T183D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.old_1785858089

Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_5d06d04598e0cbfdaa81a78a4a01f6b0_akira_glassworm_rusty-stealer.old_1785858089
Size 2.7MB
SHA256 fd945bb8e959a029c690bdef3f7fd69a354f1a839844cd5fcd0a29921e6b6277
MD5 8d9e54b21a74fe173251fbdbdcc86f7a
SHA1 035f16330d8dfff7f09943374d101487b8c8fccc
SHA512 4cf6ceb0802a67b8260099149a354aa67f91a31e67dfb4935c2ac7a24de55d6ed3118734491f5d933a5b6cead367351ac9a82ab60b0da0c4c275fe5780dcdd3c
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ38:CebAjOKn3wRKRJ38
TLSH
T1F2D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

567ba532-c83e-4dac-9f31-b3fbe5da5543.tmp

Path C:\Users\Admin\AppData\Local\Temp\567ba532-c83e-4dac-9f31-b3fbe5da5543.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_531446843\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4900-425-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-503-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-515-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-461-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-478-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-537-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-557-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-558-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-566-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download

memory/4900-567-0x00007FF64C340000-0x00007FF64C601000-memory.dmp

Download