5132666e6a68d148879eb9d2d064bbb559d22e37c159e48faf085a5ed42c5fce

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260817-d4q2nsseqg
SHA256 5132666e6a68d148879eb9d2d064bbb559d22e37c159e48faf085a5ed42c5fce
MD5 7453b4065073b642ef5c202c49cde43a
SHA1 4de7576fe6a7d56d2dc105c2ebdf4055ce2f7a54
SHA512 c2c26c85e390b618789455c5363790f8bc3ab179864f4bddba73acb6637504383954cbdd7fb952dd1d6fa08abd2bee614f3183269e9e0eacbcbf5da11697a171
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3a:CebAjOKn3wRKRJ3a
TLSH
T18DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1224	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1763507046\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_840003948\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_840003948\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1736344727\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1763507046\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1763507046\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1736344727\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1333347619\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1333347619\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1763507046\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314112535281918"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{D58E9446-5BF7-40F4-BFA2-BE991A33566A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5096	wmic.exe
5096	wmic.exe
5096	wmic.exe
5096	wmic.exe
1904	msedge.exe
1904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2752	2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5096	wmic.exe
Token: SeSecurityPrivilege	5096	wmic.exe
Token: SeTakeOwnershipPrivilege	5096	wmic.exe
Token: SeLoadDriverPrivilege	5096	wmic.exe
Token: SeSystemProfilePrivilege	5096	wmic.exe
Token: SeSystemtimePrivilege	5096	wmic.exe
Token: SeProfSingleProcessPrivilege	5096	wmic.exe
Token: SeIncBasePriorityPrivilege	5096	wmic.exe
Token: SeCreatePagefilePrivilege	5096	wmic.exe
Token: SeBackupPrivilege	5096	wmic.exe
Token: SeRestorePrivilege	5096	wmic.exe
Token: SeShutdownPrivilege	5096	wmic.exe
Token: SeDebugPrivilege	5096	wmic.exe
Token: SeSystemEnvironmentPrivilege	5096	wmic.exe
Token: SeRemoteShutdownPrivilege	5096	wmic.exe
Token: SeUndockPrivilege	5096	wmic.exe
Token: SeManageVolumePrivilege	5096	wmic.exe
Token: 33	5096	wmic.exe
Token: 34	5096	wmic.exe
Token: 35	5096	wmic.exe
Token: 36	5096	wmic.exe
Token: SeIncreaseQuotaPrivilege	5096	wmic.exe
Token: SeSecurityPrivilege	5096	wmic.exe
Token: SeTakeOwnershipPrivilege	5096	wmic.exe
Token: SeLoadDriverPrivilege	5096	wmic.exe
Token: SeSystemProfilePrivilege	5096	wmic.exe
Token: SeSystemtimePrivilege	5096	wmic.exe
Token: SeProfSingleProcessPrivilege	5096	wmic.exe
Token: SeIncBasePriorityPrivilege	5096	wmic.exe
Token: SeCreatePagefilePrivilege	5096	wmic.exe
Token: SeBackupPrivilege	5096	wmic.exe
Token: SeRestorePrivilege	5096	wmic.exe
Token: SeShutdownPrivilege	5096	wmic.exe
Token: SeDebugPrivilege	5096	wmic.exe
Token: SeSystemEnvironmentPrivilege	5096	wmic.exe
Token: SeRemoteShutdownPrivilege	5096	wmic.exe
Token: SeUndockPrivilege	5096	wmic.exe
Token: SeManageVolumePrivilege	5096	wmic.exe
Token: 33	5096	wmic.exe
Token: 34	5096	wmic.exe
Token: 35	5096	wmic.exe
Token: 36	5096	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5184	2752	2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe	89
PID 2752 wrote to memory of 1224	2752	2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe	91
PID 1224 wrote to memory of 6708	1224	msedge.exe	92
PID 1224 wrote to memory of 6920	1224	msedge.exe	94
PID 1224 wrote to memory of 1792	1224	msedge.exe	93
PID 1224 wrote to memory of 6920	1224	msedge.exe	94
PID 1224 wrote to memory of 6920	1224	msedge.exe	94
PID 1224 wrote to memory of 3808	1224	msedge.exe	95
PID 1224 wrote to memory of 3808	1224	msedge.exe	95
PID 1224 wrote to memory of 5144	1224	msedge.exe	98
PID 1224 wrote to memory of 1988	1224	msedge.exe	97
PID 1224 wrote to memory of 5144	1224	msedge.exe	98
PID 1224 wrote to memory of 5144	1224	msedge.exe	98
PID 1224 wrote to memory of 1988	1224	msedge.exe	97
PID 1224 wrote to memory of 1988	1224	msedge.exe	97
PID 1224 wrote to memory of 1552	1224	msedge.exe	99
PID 1224 wrote to memory of 1552	1224	msedge.exe	99
PID 1224 wrote to memory of 1552	1224	msedge.exe	99
PID 1224 wrote to memory of 1840	1224	msedge.exe	100
PID 1224 wrote to memory of 1840	1224	msedge.exe	100
PID 1224 wrote to memory of 1840	1224	msedge.exe	100
PID 1224 wrote to memory of 1044	1224	msedge.exe	101
PID 1224 wrote to memory of 5124	1224	msedge.exe	102
PID 1224 wrote to memory of 1044	1224	msedge.exe	101
PID 1224 wrote to memory of 5124	1224	msedge.exe	102
PID 1224 wrote to memory of 6304	1224	msedge.exe	104
PID 2752 wrote to memory of 5096	2752	2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe	107
PID 1224 wrote to memory of 6584	1224	msedge.exe	111
PID 1224 wrote to memory of 6660	1224	msedge.exe	112
PID 1224 wrote to memory of 4876	1224	msedge.exe	113
PID 2752 wrote to memory of 5664	2752	2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe	114
PID 1224 wrote to memory of 1712	1224	msedge.exe	116
PID 1224 wrote to memory of 1712	1224	msedge.exe	116
PID 1224 wrote to memory of 2316	1224	msedge.exe	119
PID 1224 wrote to memory of 2316	1224	msedge.exe	119
PID 1224 wrote to memory of 1104	1224	msedge.exe	120
PID 1224 wrote to memory of 1104	1224	msedge.exe	120
PID 1224 wrote to memory of 1188	1224	msedge.exe	121
PID 1224 wrote to memory of 1188	1224	msedge.exe	121
PID 2752 wrote to memory of 4420	2752	2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe	122
PID 1224 wrote to memory of 1904	1224	msedge.exe	124
PID 1224 wrote to memory of 4492	1224	msedge.exe	125
PID 1224 wrote to memory of 4492	1224	msedge.exe	125

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5184	attrib.exe
5664	attrib.exe
4420	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.old_1786937647
  2⤵
  - Views/modifies file attributes
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc21a3c188,0x7ffc21a3c194,0x7ffc21a3c1a0
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4521601846286108049,3963340024542273768,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9085532119915979209,17046081643212196761,262144 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
    3⤵
    PID:6920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,2819634975741679811,8647350744657577634,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,6716202663815994578,4564780225191609703,2097152 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,1795699635875001850,10713988596088875643,2097152 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5048,i,13819916487093338079,8833062859353291642,2097152 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:9
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5340,i,12396527224900743976,4879410465351479685,2097152 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:15
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,5189488276862517592,15672591989549477597,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,6701586027804608624,437843727851845454,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,12973730568999062321,2818288814365611091,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,12973730568999062321,2818288814365611091,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,18211056837590007302,13768956682070835536,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:6584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,9118544309833987904,18274815151798268785,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:6660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,2403472052373930391,12116939971358940192,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,2968410526644162625,8902463502217118704,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,5066031902014381785,17272167755202253072,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:14
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,6153584987832571626,5711396491117287936,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,231526564864502100,9615856596194657164,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7004,i,16312482083912983219,11157258661287901689,262144 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,7547430651372031974,3956711025682613025,524288 --field-trial-handle=2652,i,11526869418358268418,17081170774294308865,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:4492
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.old_1786937708
  2⤵
  - Views/modifies file attributes
  PID:5664
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.old_1786937768
  2⤵
  - Views/modifies file attributes
  PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

18c75254-d25b-4b2b-b9d7-417f40471589.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18c75254-d25b-4b2b-b9d7-417f40471589.tmp
Size 414B
SHA256 a92e618fa0f0dba1117d96a7874c88f2a912e4ba36d57c07a72bba5274f2bac9
MD5 277d2f10d50cff60362e45d7321baa77
SHA1 d8a74898c51e4a13184258df389671b6416673ed
SHA512 d32a9c2303c69b28e3564e17169792b65a17b2ba0d26739b77236542ec9935b2016751ace30b071fd6ea6eabd70247d81db14612997990f1746b07e89ea1989b
TLSH
T148E02BA9D920BC3759FD1B18A0980A47E750131B3B409C4F3B3DA22C8FB46378786C5C
MD5 SHA1 SHA512 TLSH

Submit Download

49f20b72-3367-49db-b79d-f5a2422cd4a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49f20b72-3367-49db-b79d-f5a2422cd4a8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6275cfaf789d0dac52252a43d5571b5f916fa673603f3941acdcc7dc46dc905b
MD5 9a41b4d9da047f4e52b9c5e554d77a72
SHA1 387ae933ab82c67e4d1f6a85e13e95a200fcaebb
SHA512 4bbf85aba7ee09f57bb4bb8c13177d9d64a7074141db195eeb6f4c32abec9980de4bc7ba4ae7c46b8cf74b3f703f01db150873f41edbc899112fd1276a24aaf5
TLSH
T15951787463BA19C2D7A58AB154D049D5BEF0A2F9C607FF0568C89F348A06F94A0E40EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599fc1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599fc1.TMP
Size 2KB
SHA256 89a56c5861386de044ec2fb3e189193a88148aee4a1b60ff45ba9744340168be
MD5 cd5d434f4c3c524d29221883a5f869a0
SHA1 3c217b2173b589f3870e02113445f8ce9a9f5efc
SHA512 3bd97eb72013072588d65780f81729ea756f99869dd082c4ba0dd968bb2c021467a5bba2f0be51aa7fad0a4f2bc6dfb335326a3171def8665992c91f4b85124a
TLSH
T15151537463BA09C2D76199B154D105D5BEF0A2F8C257FF0568C89E348A16F94A0E00AF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 036d309c9c181732900ee30b2d21e09309226f3901db9c1212f7300717255d88
MD5 c54b2f99f9c25068ece2da63d1ee3a5b
SHA1 1247c57d566fbf7d1769c6b3d75c20ad624c91a6
SHA512 9d3b0c9b997ad3bc08a7ba50467faf2be5d5a0cb07c18beb3950318077b8c46eca8fa1b7960fc02a6b899de2eca632ab69a8c79a96e20c28ea54bd72cbae95f0
TLSH
T1964190F783F4856E8A1195F0AB186E1FCF1D0515432C7D9AC9E0AE1793E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3a1084b7ca8c10523b696771cbe2df8c925fe22b2f8c9f17ecadc2e38f63a8e9
MD5 4bfc81c8e23b065eb0e40eb4e42ffb2f
SHA1 5d411dd4442088915fbc7a200fa28d9b5ab42612
SHA512 0ad63bd2e8a7a4f299f52f5ee7a8b02a1024c5f8c839105f590344ec3c2df5e0a029a999f06f81d4196040e37e4f2b115757bca531caf0c5d02be35c1b1367fe
SSDEEP 384:sxR818i/fWsh59N/RIGqh/5IW4dOAsGQSjs:s4qi/fz5fWF/5IW4TsGQj
TLSH
T11F72D815AA389D7B8CDBD319FA957F53D7F81173A1905E44AAFC8A0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6dc6f96ac3f703d2bd2fb6913611a7948a72af5ebf365b1d6efa210be29e8bd2
MD5 85051fa5f3afca54b36f0830e00a7585
SHA1 164e3f78aea94e10d367effec979678f61bf3f2f
SHA512 0e45d8a8c06b2510c28f559dc54246b5cf65e388d5479c5cd8a131c53083c26bbbabe191381702ce6d52b4eec2246c307b26ab8a499a8e1bfdf2379ee29f96c0
SSDEEP 384:sxR81qJi/fWs35vN/RIGqh/5IW4/OTsGQSll:s4kJi/fZ5lWF/5IW4GsGQY
TLSH
T1F372D815AA3899779CDBE319FA957F53D3F81173A1905E44AAFCCA0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 79b61325c40edce613bda42feed2d5ffb60939a7d78b8001ffd6de1db3ec5578
MD5 1aef7b0ccc9b456a3d486041679d0b25
SHA1 6c6001259e3f31394e626fe859f605ebc02b444a
SHA512 12cedee28571f7cb5ec9bfaad10599fe938dc8c74e3b7cce9cd6147716864e6874bec609aa6f25c4e9b890b5acc6d16227be4517f7b4cf510d1f1a9a1de242a7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroO140:Ob4YZnE7yTWg1NfwBu1jakobHwAOq0
TLSH
T13CE2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 495cc396fe1ceef95bf8afc7c1cab7c876b5f642b94c3d594ce173436948dec3
MD5 27703ae545c1355c37350c2f7a736533
SHA1 24a27316313db11314e9d2f371a58e2a8ec378d6
SHA512 f6a1df5a150eef50cfeac2252705bfd08e55777418d464cbfd720737869dc7595423efaf07666327ef2860a146c724d98f8e786495a461cdabecad9a80b478f0
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EExiWESiNG/SOoQBUHMU3eipvIj:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRI
TLSH
T19EB25F51713F4680387EB90C81B8982F96C2B4637519E53F7B6802A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ff601fd3c146f4eca0eb31dcea845244fc686888861eb0a1a3920abad3bf4f4e
MD5 1424603085af1ce51986daa81b65528f
SHA1 e8d320606980563528eb035df2530b814533b6dd
SHA512 34b8f9852ec24d6eb7c9b085ffb47918f7d46921895d345049699cfc8bf7ab8cc5de85e84bf0ee3e79118017fc6a1f8fb4ea26775c2066fef95c0317b996aa4a
SSDEEP 384:nciFiZcIdj8NLd8TUNTUlIR6PvuT/FzEqf+GGECXcMlZApVTOOPrXLpe8C/k8LER:HFQdjQdwgwuBrGEPJTOi9PB
TLSH
T11ED24B71E8A4DD67ECFB9FD5A7497642DEE45163D8C89AC8DAD88E0C00C719E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 28ca22d130f1ad932205d7e6fc3d27c4d93b9020a26cd484db3ed912a1bcae4d
MD5 dbadb24e7ea795c9906566c50219aefe
SHA1 c5790727c5570420726048728f967f2d38e4d882
SHA512 580417788b4a5a7610ff97be64fc63d36ff1fb26b515e8eff5c27e827dcbcef4a57404a466844ff6209e730f85b525e0a3785b1e1e538de51424371a88a13f4f
SSDEEP 384:nDiF1tNn/s3n9Sc8NLd8TUNTUlIRbPvuTxFzEqf+GGECXcMlZAfkTFHH8LEEIz4r:uF1j+9BQdwg5ufrGEPWTK
TLSH
T1B7B23B32E8A5CD77ECEB5F99B74A7642DEE0526388C89AC4DAD95E4C00C72DD0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 95b594f3fd86e707270ece9695263c516fcceeb100a64308f4985b16ae78ee31
MD5 73145507664c8dd4833fa9b847d8dc68
SHA1 de71d937485bdd2f70f1d21e28a524cdcfa767d0
SHA512 f64aca54d10aac323fabf672a85cddcc52b6832cc223fc517abcbf89a03703be7f27a7d8131c2f8806f056078c3716b3198639bafb5f97e8412b90e32a0ede4e
SSDEEP 384:neiFiZcIMj8NLd8TUNTUlIR6PvuT/FzEqf+GGECXcMlZAfBTOOPrXLpe8C/k8LER:1FQMjQdwgwuBrGEPTTOi9PB
TLSH
T1B2D24B31E8A4DD67ECFB9FD5A7497642DEE45163D8C89AC8DAD89E0C00C719E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 29a6388b23d320e32ccb95c8017f6dcfa9b9d622ccae4fe639e01b41ce2a8656
MD5 c66b45ddb376f3cb707bbbc40d194032
SHA1 3d403ca9593b136dbd7cf94c2c5ddb9f212b4d28
SHA512 375ccc2786b0a11ea2fa1c9dd06f0f0e0e6c16986ee2a369ede757aa300022960775b545168c4d4f622d93e2c46a51a65a5af67e4b4ea25b9ab8afc1b572b9df
SSDEEP 384:nPiF1tNn/s3n9Sn8Ngd8TUNTUlIRiPvuTgdzEqf+GGECXcMlZAfkTOObjI9G6w7m:aF1j+9SXdwgUuGrGEPWT29Mm
TLSH
T12EC25C32E855CE77ECE74FE8B74A7A86DEE052A788DC5AC4DAC95E4C00C719D070781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 902ccaf76cb6907248ea16fc200ce43cc91debb4d80b7d4ae88d8919ec52e807
MD5 fa98f0e3ffebb4a20cbe208cc03393e9
SHA1 c092eef6c7d40ea784241a3f0fd718df39e2c5cd
SHA512 c783cf9f7142f6be546e4666ccff421b7e34da100f81b7c0a843b0b340680781e1e727bdfbc189a4104c27bb835f2af22394b0ccfc775227e8729ea83afef445
SSDEEP 384:nDiFiZcIMj8NLd8TUNTUlIR6PvuT/FzEqf+GGECXcMlZAfBTOOPrXLpe8C/k8LER:uFQMjQdwgwuBrGEPTTOi9PB
TLSH
T17DD24B31E8A4CD67ECFB9FD5A7497642DEE45163D8C89AC8DAD89E0C00C759E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c588967d7a6416eedcbfa0801806f5137d43ab27f0332710af7b137709088910
MD5 6e4314d23ac9bbe9614361c4c2dc5d04
SHA1 3d7404c1699514585b6dcc32e43886e2a93d28ea
SHA512 af0923e802a16a8e4c7cfa65f5b3bd606658c9a17b58f76112dfce332c51c30cbbf0cb82d3a89400a309a27650a73dc340968b7acd8923e05fb0a69e3101d43c
TLSH
T1D04120D04C392AD1D4BD0E3EB45729FC94EC9726F89434386859EA58967E60D355083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 17d7b0dcac2d20112db1f6fe04c4a946828d0ec4a53d1da5ff39d525ca565ec3
MD5 d748eda12748f82e0651fc8a8a940327
SHA1 272fbf2f9036535341f389af7b9d7454af923654
SHA512 438edad34791b701756d6dbe0bf5ee09c309788d5a2e9382f9977fb69ac9f71b1bf0ee4c031f0c7f47a22fa93276e41b9da616c51d87cc7f6991ceca4d03dd58
TLSH
T10D412FE04C392AD1D0FD0E7EB58739FC94ECD726F8A434786898E95855BA21E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

f2af1842-6b48-4834-8ddf-a135c2ad9e1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f2af1842-6b48-4834-8ddf-a135c2ad9e1d.tmp
Size 26KB
SHA256 82d95c225886b6f791e3ebd74f1fb23f448441e4755694f25f568280997c763e
MD5 b5f96fbfb2bfeaed814049e114d11856
SHA1 0b238e52c869ab9e9784fefdc6b393961b6b0c2d
SHA512 ca225778d150712f8c025feb42db3e3c4d8a10311187d1d35b5f796a0f4e95305095c53b582b90d76820cd90683d4636b5125ef102110e859b897ff760f85c99
SSDEEP 384:nNiF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuWREqf+GGECXcMsLUOObjI9G6w7m98M:EF1j+9SXOwgUuDZGEPhU29Mm
TLSH
T1D6C24A36E865CEB7EDE64FE9B74A7A46EEE0526785DC59C4DAD85E0C00C31AD030381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 46938578314171b72f26bb22bdca7397c0a8c16581e179f23c3a2a91ff11623d
MD5 de799ed4f0b5277fc443e1363245b01d
SHA1 2ed5fe82ba2fe30dcc3b1fd34b9440883bb75055
SHA512 70a45723dac2efe28227cdd0b7d3b3239f8a359a72ebba414d9d5f2a7f1d697f8949c32d65d2e9119f8c8a339139e06112c7be03dba3ccc341d29634daac35db
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3T:CebAjOKn3wRKRJ3T
TLSH
T15CD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.old_1786937708

Path C:\Users\Admin\AppData\Local\Temp\2026-08-17_7453b4065073b642ef5c202c49cde43a_akira_glassworm_rusty-stealer.old_1786937708
Size 2.7MB
SHA256 1c4c4809aebd33596bd7eb8fbb74d9eb5c124e9117fe0660ec8255d9b4c4bdce
MD5 c1b2c6e6ceeb4cf4ab87d1907cf9913f
SHA1 58f4d7f45e4e122e45828f47821a9a186203c4e0
SHA512 10716e6d984b5486ddd1b68d685e22e1ff97a51169dbd50260338d175a6d3b8f8b7652ab619eb3324a1657c869d49b97bf0384b1af6bfe5c1931db2951c2d284
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3z:CebAjOKn3wRKRJ3z
TLSH
T18BD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2752-309-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-202-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-199-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-228-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-182-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-318-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-158-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-341-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-227-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-360-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download

memory/2752-234-0x00007FF6C4FE0000-0x00007FF6C52A1000-memory.dmp

Download