1ee68abbac3577ee45c183a550a6939219ce74cffd9e36e46271bb16e34956ed

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260815-rb3rnaxgla
SHA256 1ee68abbac3577ee45c183a550a6939219ce74cffd9e36e46271bb16e34956ed
MD5 f22e53e961e0da9b0b1bf8208c43d365
SHA1 fb2a7d870f17bde0c634abe38fca0526ec4c2927
SHA512 c026f364fe24bf9d2866b6023840aab5072b17c99f9db568ae9d353af15d6af7688407c146d50ea45b71145d53b3756c57c2dcc3f3cebad2d4221ae963495e53
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ30:CebAjOKn3wRKRJ30
TLSH
T1CAD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_938873097\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_938873097\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_466414698\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_1127343426\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_1127343426\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_1127343426\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_44298711\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_466414698\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1928_1127343426\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312761331404738"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{116E106D-7EF8-4DF6-90D9-34B70EAC6924}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2760	wmic.exe
2760	wmic.exe
2760	wmic.exe
2760	wmic.exe
2748	msedge.exe
2748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1512	2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2760	wmic.exe
Token: SeSecurityPrivilege	2760	wmic.exe
Token: SeTakeOwnershipPrivilege	2760	wmic.exe
Token: SeLoadDriverPrivilege	2760	wmic.exe
Token: SeSystemProfilePrivilege	2760	wmic.exe
Token: SeSystemtimePrivilege	2760	wmic.exe
Token: SeProfSingleProcessPrivilege	2760	wmic.exe
Token: SeIncBasePriorityPrivilege	2760	wmic.exe
Token: SeCreatePagefilePrivilege	2760	wmic.exe
Token: SeBackupPrivilege	2760	wmic.exe
Token: SeRestorePrivilege	2760	wmic.exe
Token: SeShutdownPrivilege	2760	wmic.exe
Token: SeDebugPrivilege	2760	wmic.exe
Token: SeSystemEnvironmentPrivilege	2760	wmic.exe
Token: SeRemoteShutdownPrivilege	2760	wmic.exe
Token: SeUndockPrivilege	2760	wmic.exe
Token: SeManageVolumePrivilege	2760	wmic.exe
Token: 33	2760	wmic.exe
Token: 34	2760	wmic.exe
Token: 35	2760	wmic.exe
Token: 36	2760	wmic.exe
Token: SeIncreaseQuotaPrivilege	2760	wmic.exe
Token: SeSecurityPrivilege	2760	wmic.exe
Token: SeTakeOwnershipPrivilege	2760	wmic.exe
Token: SeLoadDriverPrivilege	2760	wmic.exe
Token: SeSystemProfilePrivilege	2760	wmic.exe
Token: SeSystemtimePrivilege	2760	wmic.exe
Token: SeProfSingleProcessPrivilege	2760	wmic.exe
Token: SeIncBasePriorityPrivilege	2760	wmic.exe
Token: SeCreatePagefilePrivilege	2760	wmic.exe
Token: SeBackupPrivilege	2760	wmic.exe
Token: SeRestorePrivilege	2760	wmic.exe
Token: SeShutdownPrivilege	2760	wmic.exe
Token: SeDebugPrivilege	2760	wmic.exe
Token: SeSystemEnvironmentPrivilege	2760	wmic.exe
Token: SeRemoteShutdownPrivilege	2760	wmic.exe
Token: SeUndockPrivilege	2760	wmic.exe
Token: SeManageVolumePrivilege	2760	wmic.exe
Token: 33	2760	wmic.exe
Token: 34	2760	wmic.exe
Token: 35	2760	wmic.exe
Token: 36	2760	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2328	1512	2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe	89
PID 1512 wrote to memory of 1928	1512	2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe	91
PID 1928 wrote to memory of 6052	1928	msedge.exe	93
PID 1928 wrote to memory of 244	1928	msedge.exe	94
PID 1928 wrote to memory of 3740	1928	msedge.exe	95
PID 1928 wrote to memory of 3740	1928	msedge.exe	95
PID 1928 wrote to memory of 3260	1928	msedge.exe	96
PID 1928 wrote to memory of 3260	1928	msedge.exe	96
PID 1928 wrote to memory of 3260	1928	msedge.exe	96
PID 1928 wrote to memory of 2140	1928	msedge.exe	98
PID 1928 wrote to memory of 2140	1928	msedge.exe	98
PID 1928 wrote to memory of 2140	1928	msedge.exe	98
PID 1928 wrote to memory of 2520	1928	msedge.exe	99
PID 1928 wrote to memory of 2520	1928	msedge.exe	99
PID 1928 wrote to memory of 2520	1928	msedge.exe	99
PID 1928 wrote to memory of 5516	1928	msedge.exe	100
PID 1928 wrote to memory of 4652	1928	msedge.exe	101
PID 1928 wrote to memory of 5516	1928	msedge.exe	100
PID 1928 wrote to memory of 5516	1928	msedge.exe	100
PID 1928 wrote to memory of 4652	1928	msedge.exe	101
PID 1928 wrote to memory of 4652	1928	msedge.exe	101
PID 1928 wrote to memory of 4592	1928	msedge.exe	102
PID 1928 wrote to memory of 4592	1928	msedge.exe	102
PID 1928 wrote to memory of 4592	1928	msedge.exe	102
PID 1928 wrote to memory of 4344	1928	msedge.exe	103
PID 1928 wrote to memory of 4344	1928	msedge.exe	103
PID 1928 wrote to memory of 2392	1928	msedge.exe	104
PID 1928 wrote to memory of 2392	1928	msedge.exe	104
PID 1928 wrote to memory of 2392	1928	msedge.exe	104
PID 1928 wrote to memory of 3844	1928	msedge.exe	106
PID 1928 wrote to memory of 3844	1928	msedge.exe	106
PID 1928 wrote to memory of 5896	1928	msedge.exe	107
PID 1928 wrote to memory of 5896	1928	msedge.exe	107
PID 1928 wrote to memory of 1980	1928	msedge.exe	109
PID 1928 wrote to memory of 3612	1928	msedge.exe	110
PID 1928 wrote to memory of 3612	1928	msedge.exe	110
PID 1928 wrote to memory of 5832	1928	msedge.exe	111
PID 1928 wrote to memory of 5832	1928	msedge.exe	111
PID 1512 wrote to memory of 2760	1512	2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe	112
PID 1928 wrote to memory of 2376	1928	msedge.exe	117
PID 1928 wrote to memory of 3896	1928	msedge.exe	118
PID 1928 wrote to memory of 2576	1928	msedge.exe	119
PID 1512 wrote to memory of 4992	1512	2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe	120
PID 1928 wrote to memory of 1736	1928	msedge.exe	122
PID 1928 wrote to memory of 1736	1928	msedge.exe	122
PID 1928 wrote to memory of 3544	1928	msedge.exe	126
PID 1928 wrote to memory of 3544	1928	msedge.exe	126
PID 1928 wrote to memory of 4504	1928	msedge.exe	127
PID 1928 wrote to memory of 4504	1928	msedge.exe	127
PID 1928 wrote to memory of 5736	1928	msedge.exe	128
PID 1928 wrote to memory of 5736	1928	msedge.exe	128
PID 1928 wrote to memory of 980	1928	msedge.exe	129
PID 1928 wrote to memory of 980	1928	msedge.exe	129
PID 1512 wrote to memory of 4336	1512	2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe	130
PID 1928 wrote to memory of 2748	1928	msedge.exe	132
PID 1928 wrote to memory of 6116	1928	msedge.exe	133
PID 1928 wrote to memory of 6116	1928	msedge.exe	133

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2328	attrib.exe
4992	attrib.exe
4336	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.old_1786802527
  2⤵
  - Views/modifies file attributes
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd1ee0c188,0x7ffd1ee0c194,0x7ffd1ee0c1a0
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,15623116171367663950,10197218477508201562,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
    3⤵
    - System Time Discovery
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=316,i,5582769647261061173,14038410071915513947,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,9162101976293629781,16141407501770038707,262144 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,16368689015494791847,17903012264828706928,2097152 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,15820783315770167722,15136111391451877943,2097152 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,2696867442079427060,14713125794439085035,2097152 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,16789077073673345172,8301447188221400059,2097152 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5304,i,15645984761047761749,15544707938113206621,2097152 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:9
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,11675284145922456440,11452476568221177662,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3640,i,3959124060427066220,15649459786639052442,2097152 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:15
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,15889661010921732639,16591583365746653506,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,9398330555679923331,968892746121622754,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12513661608855839356,13492075929364534795,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12513661608855839356,13492075929364534795,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,14851149977709572960,9658341252446823450,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,13995854336413991282,14040554057588085709,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,15768998975147396486,4530039189611946957,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,14142679462192133758,11386827476518667616,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11047609711323939913,6299842467748267335,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,3292316073780876742,11858049792575076856,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:14
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,16622809252297498059,12331637448227033589,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,11941810793909147588,16231736031616868302,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,14172847004091391824,5804421284299417131,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,2719242616346995010,8002774725845151627,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5632,i,1102696512783912968,13839601869005855514,262144 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,6304609479965235709,5004009199266576728,524288 --field-trial-handle=2576,i,8521457061143338601,8774456837735045176,262144 --variations-seed-version --mojo-platform-channel-handle=1212 /prefetch:14
    3⤵
    PID:6116
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.old_1786802588
  2⤵
  - Views/modifies file attributes
  PID:4992
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.old_1786802648
  2⤵
  - Views/modifies file attributes
  PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 54ce9c688f7d58a5887a722746044747f91541b3743170bd3caab4cb50a9f8ad
MD5 3b09a55922636fe0dd320d346d48a247
SHA1 32a02fe3f4a0984a39d27da6fcba4d5099d30c14
SHA512 762a3b0bc63995c7e71399f3353566ee82a1e93d96896bbfdc50d07db33960e8cda8fce8f612282da505a23ff6a56b1a018b499be0e05710bec1154b22f59144
TLSH
T1C8514DD10BEA1AD2CBFD4EF961E62ADE73F0C09D41635A9065562D701A0AFA7A0D0C37
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f918f25386f9d55bb5296e9d99bd9c8cdd1dd57199aa5e13241884e78cdca523
MD5 bd364cac65a3723a04b591aac68fed9c
SHA1 536cab4d308491e35673086778594f22080845fa
SHA512 36fb789854dfee70b42251c78e7d1d2749a8a606106543f077b824bb7c782e4ba0fd152d5789a5ef2c42f5c0cfbdea97f822cb3089f6cf633732703cfeabaaee
TLSH
T1F5419CF3C3E4856E891196F0AB146E1BCE1C0511432C7D9A89E4AE2BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2344a0b492934573d5d146e01221373b5b5c3f3ccdae05d318c9b9b336eb13c3
MD5 896c47a4fd15d89d0cfed23df641c0fc
SHA1 8952a20e5d262b7f1ba1183a4f3fe9601f105a25
SHA512 e9e7577a8f7e7877e2089cb8c3c45452359fda36fcecc5f5ec0df52b1ca7d5409596d591d16cfebdc512cd2f352fdc7008aa4b4ce6afcbeb2e9e43f38a03383d
SSDEEP 192:sxRoRwCR/f2suMNfDZAhzoA8p4y/g6+WNIYo5TOw/aYZGVIgDmTJ:sxRo9R/f2sXVtfn/5IZOrdy
TLSH
T1BA42D815BD68A93B9CC7E21DFA15BF63D3F91032A1946E48BAFC861C04E66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 187a5f16159a4cfe85d0261081f6b15588cf793dba1db4fcfaeed7a0f5c8f191
MD5 d6973f8b83872c6eb29bba895c816cdd
SHA1 295d6886719cb864ec9860df0ad3776b4d1e2840
SHA512 b9e082a820780668d019c611a9441b66f5604e003ba429cc0256d739a0be5834d66f93189b62246719eb9e023f4d8de787844a4f0a28e2b5d111d8f3aea7cb2c
SSDEEP 192:sxR/RwCR/f2skMNfDZAhzoA8p4y/g6+WNIYo5TOw/aYZGVIgVTJ:sxR/9R/f2s5Vtfn/5IZOrdz
TLSH
T1AB42C8157D68A93B9CC7E21DFA15BF63D7F91032A1946E48BAFC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6934272bd7324ea82935388963024cb7b0d3b9b49a0a3785144737cff5d043b6
MD5 89f77f6504a81e763c7346cc8b21e404
SHA1 58aa12d5d6dce4e3dea4ffcfa9c826965f31ab7b
SHA512 3ea6413e0866b14981cceb8e0641379706773f1f5477800f609fc44f8b40a37f0fc950551b2a67c17057097324edad387cdca97050970eea03131e3c277e3adf
SSDEEP 192:sxRoRwCR/f2suM3fDZAhzoA8p4y/g6+WNIYokROw/aYZGVIgDcTJ:sxRo9R/f2sXvtfn/5ICOrdY
TLSH
T10042C815AD68693B9CC7E21DBB15BF63D3F9103261942E48BAFC871C05E66DE620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d96c23585c3bd4f428f3bb7090dd5ccc261d406c6d4f24fddea604631c66b512
MD5 d6a6924213349d57e1f501ed15505ed4
SHA1 2733349fca3675695f9433d0490e4fa0d74020ba
SHA512 b6334cbc11c8c082541b28a66a9be42e8ec9dda346ee1a161f1543eb588798376bab5da81b41bc4b571ad892b6330224b1c83c009b0d86f1e7a1e2ea815ac0f9
SSDEEP 768:j26H9o7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVKwBVuw0ro9qYe5:j26H9UE7MRWgs2f02u1jatwB4wfcB3
TLSH
T1A6D2DA7B640DCABE4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1f6f40435f713be67fb52c5edc3ae0a435b95d2dbb449356884d51d177c5fbe4
MD5 b31980c34964a670e4714282786fac01
SHA1 6322f30abd8675008f36d39b28d431c26ee14c44
SHA512 f3f8366518c4a45e2c979c55b30942d8b0b6da0d1ff449094ac33ee8a6e7a4f8f5ab73c7851168cea2a9a55187c8c72726f06fa5d2926cc20b5273671467fe19
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrHlyLf1vz3W7gugn3K4Wg53cdF4LGs4KJWB:CCHuC0UE9MZSy6ngoJSaBgCrHlyLf1vO
TLSH
T1B2916601357A02443D7EB60D85F9891BD682B4733919BC6BBBE812A61F67E028DFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a79e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a79e4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c54bfb73f8cbf6459cc663c4b3b5a981efa676bcb6bd3067e76d2f15b8889364
MD5 18e8492b6c5018c038eb759b7efac378
SHA1 1f6362e43dafdfd3d28e75735e4307bfe09015be
SHA512 713e08cf87ddcec88737adc622c5a1cbf2c2e45b1e42a2b13b31d27649c9808885335d36ff46daf7dfb9e293494fae2ad87830371bdc8ba95806a7ee5f140c5f
SSDEEP 768:hrv+4UNbdz3nq/TBOWSYONXyer1IRCzniBEeVH1SK7:hbsbV3qBSIqnvEH1l
TLSH
T17403C032E4989E338DE2A3D5B047B6437FB86057C6840790EDDE2F4E069B59E230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 870220725c61817a6bf7cc3d2abd661b93a91dce29daf2631617e6c38a720120
MD5 ac6931281f9c857fd463816ed6c7ba7b
SHA1 3483e1550ac43ea11e75111333a72d92e919381c
SHA512 55ea24f3902f2042676cc162ad260479bc1cc84aa7d9efa471628b42e97dfd72e7afd5904b6d9ca76c59b95df24b29f0454d0c5a2aad4b5139f84e4b08db70a6
SSDEEP 768:Xa356wa/TBOWS3ztAONXyer1IRCzni97Pi9Pzq:Xa3ApRSIqn4P9
TLSH
T1B4F2B070E5959D234CE5F3D6B14363937EF82067D4C45694AEDA5F0E0987A1E130F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 31771a429076ef6e336960eb65cd53355ed3cd577a880ec09e4e084280b4832a
MD5 79fdbbeb7032dc183f1abab1606c4e8e
SHA1 c234ef6541e825e51e076c1914244531e8f231e7
SHA512 d033635c31dcc535713190e4602f0be4690937a6ff288539aa6e61fcfbde7f25e22364a6d18487cc36665ff8383c5256c492fe57b99e489f11127aea3bf951c3
SSDEEP 768:Yrv+4UNbdz3qU/TBOWS3ztLONXyer1IRCzniw7eVH1SK7:YbsbV3VkSIqn/EH1l
TLSH
T13B03C031A598DE334DE6A396B047B3937FB82067C5800B90EDD61F8E099799E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fe08175234703021d2956f9bd171bf0ce4daf5293cd03a2dd7993dcf2ff18e07
MD5 5f5d6e2bb7b257120a75566895458686
SHA1 ae7fd295d9313135124430c2d4955219ed7216f7
SHA512 c386510658b5d437bac55266742015e5b865980d1031cc0bb41e6fde0b6c7557fb4cef45941a45502d1306ca1d268359ee927bf17fbcdb97a7a0dedd43d21152
SSDEEP 768:/a3C6Za/TBOWS3ztAONXyer1IRCzni97Pi9Pzq:/a3ZwRSIqn4P9
TLSH
T131F2BF70E5959D235CF5F3D6B24363937EF82067D4C45694EEEA9F0E0983A1E130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 75a095bd34be7bac975469aba5f5c879015520f2c0661dc652086240e8b6ee1b
MD5 094d101aa139f7c6b5689e3a9f0a895c
SHA1 269d5cf6272c6d8de79e9758f2be9ce474da193b
SHA512 81985eff1500638178f8022a2b1d1bc0a64b9bb9c7087200538ef1ac9da3eddf243b8736d8e520697e61b5caf19ff38dff0777579a08b7369594f60aa76c0f95
SSDEEP 768:sFQg3Ywgk6wJpsOWS3ztdONXyer1IRCzni97Pi9Pzq:fg3mObSIqn4P9
TLSH
T100039D32E894DE27ACE6A7C6B7067383AEF41067C5C899D4EAD95E4E05C359E030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 fd7630fc72774496ab987b118a1b1993e5c4022d5fb2d18656e864f7e713f555
MD5 5142b7a50fc50a795a28984a24e82bc6
SHA1 bc1e00544e129303591f2a072527b8e360c9a878
SHA512 61f10283eaa5c19ea647972ba723441d33ce69d5c18cc6b084dc6c9c5f188c758c57b0b70c6b2340291c87c4f5f72f53adceaa4e77cee82862e1ddd9f15ec6bd
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3d:CebAjOKn3wRKRJ3d
TLSH
T143D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.old_1786802588

Path C:\Users\Admin\AppData\Local\Temp\2026-08-15_f22e53e961e0da9b0b1bf8208c43d365_akira_glassworm_rusty-stealer.old_1786802588
Size 2.7MB
SHA256 40617535a19e35bc8fd8cf906bc69b25a4042f303ac56af444f3268700cf0854
MD5 84203336f903ba168734fefe800a70c4
SHA1 1ce5111339a394ecd2956a41dca596ca6329e87c
SHA512 d4977173138391ee5c91319fe23fd2e65f97d28b8c98a18127e3d1820cc392857841801e4c5b9abe3e832bd2cb95fee98459868574101434fa17df9be30156b3
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3n:CebAjOKn3wRKRJ3n
TLSH
T176D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1928_1398842613\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-229-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-306-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-280-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-323-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-344-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-263-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-361-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-372-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-243-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-406-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download

memory/1512-193-0x00007FF7CA1D0000-0x00007FF7CA491000-memory.dmp

Download