992bb90919ce8f46b6c4bba012e5fe53e766eee468d86e2a72a3619792db1e15

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260818-fbakbsw1cw
SHA256 992bb90919ce8f46b6c4bba012e5fe53e766eee468d86e2a72a3619792db1e15
MD5 f95c37d4d706d39751fb03a7c6985514
SHA1 421b3e59ca86046538ac08372cef528f443c8f5e
SHA512 b81af39f556c10c443ba2443777c160f39590649f754706af0c0019dc71b9e14138625f946d38ffbc8ee420ae81cba319f42dc7282dd83c83cd347850d9ddf33
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ37:CebAjOKn3wRKRJ37
TLSH
T105D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6676	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1677487553\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1646036607\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1646036607\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1540427755\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1473669744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1473669744\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1677487553\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1540427755\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1473669744\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6676_1473669744\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6960	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315016929810604"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{41DBDE64-F920-4ADB-998E-47CBDDF3D07B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5392	wmic.exe
5392	wmic.exe
5392	wmic.exe
5392	wmic.exe
1236	msedge.exe
1236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6676	msedge.exe
6676	msedge.exe
6676	msedge.exe
6676	msedge.exe
6676	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5724	2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5392	wmic.exe
Token: SeSecurityPrivilege	5392	wmic.exe
Token: SeTakeOwnershipPrivilege	5392	wmic.exe
Token: SeLoadDriverPrivilege	5392	wmic.exe
Token: SeSystemProfilePrivilege	5392	wmic.exe
Token: SeSystemtimePrivilege	5392	wmic.exe
Token: SeProfSingleProcessPrivilege	5392	wmic.exe
Token: SeIncBasePriorityPrivilege	5392	wmic.exe
Token: SeCreatePagefilePrivilege	5392	wmic.exe
Token: SeBackupPrivilege	5392	wmic.exe
Token: SeRestorePrivilege	5392	wmic.exe
Token: SeShutdownPrivilege	5392	wmic.exe
Token: SeDebugPrivilege	5392	wmic.exe
Token: SeSystemEnvironmentPrivilege	5392	wmic.exe
Token: SeRemoteShutdownPrivilege	5392	wmic.exe
Token: SeUndockPrivilege	5392	wmic.exe
Token: SeManageVolumePrivilege	5392	wmic.exe
Token: 33	5392	wmic.exe
Token: 34	5392	wmic.exe
Token: 35	5392	wmic.exe
Token: 36	5392	wmic.exe
Token: SeIncreaseQuotaPrivilege	5392	wmic.exe
Token: SeSecurityPrivilege	5392	wmic.exe
Token: SeTakeOwnershipPrivilege	5392	wmic.exe
Token: SeLoadDriverPrivilege	5392	wmic.exe
Token: SeSystemProfilePrivilege	5392	wmic.exe
Token: SeSystemtimePrivilege	5392	wmic.exe
Token: SeProfSingleProcessPrivilege	5392	wmic.exe
Token: SeIncBasePriorityPrivilege	5392	wmic.exe
Token: SeCreatePagefilePrivilege	5392	wmic.exe
Token: SeBackupPrivilege	5392	wmic.exe
Token: SeRestorePrivilege	5392	wmic.exe
Token: SeShutdownPrivilege	5392	wmic.exe
Token: SeDebugPrivilege	5392	wmic.exe
Token: SeSystemEnvironmentPrivilege	5392	wmic.exe
Token: SeRemoteShutdownPrivilege	5392	wmic.exe
Token: SeUndockPrivilege	5392	wmic.exe
Token: SeManageVolumePrivilege	5392	wmic.exe
Token: 33	5392	wmic.exe
Token: 34	5392	wmic.exe
Token: 35	5392	wmic.exe
Token: 36	5392	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6676	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 4492	5724	2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe	90
PID 5724 wrote to memory of 6676	5724	2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe	92
PID 6676 wrote to memory of 6192	6676	msedge.exe	93
PID 6676 wrote to memory of 4728	6676	msedge.exe	94
PID 6676 wrote to memory of 6960	6676	msedge.exe	96
PID 6676 wrote to memory of 4728	6676	msedge.exe	94
PID 6676 wrote to memory of 4728	6676	msedge.exe	94
PID 6676 wrote to memory of 4940	6676	msedge.exe	97
PID 6676 wrote to memory of 4940	6676	msedge.exe	97
PID 6676 wrote to memory of 2260	6676	msedge.exe	99
PID 6676 wrote to memory of 548	6676	msedge.exe	98
PID 6676 wrote to memory of 2260	6676	msedge.exe	99
PID 6676 wrote to memory of 2260	6676	msedge.exe	99
PID 6676 wrote to memory of 548	6676	msedge.exe	98
PID 6676 wrote to memory of 548	6676	msedge.exe	98
PID 6676 wrote to memory of 2736	6676	msedge.exe	100
PID 6676 wrote to memory of 2736	6676	msedge.exe	100
PID 6676 wrote to memory of 2736	6676	msedge.exe	100
PID 6676 wrote to memory of 5460	6676	msedge.exe	101
PID 6676 wrote to memory of 5460	6676	msedge.exe	101
PID 6676 wrote to memory of 5460	6676	msedge.exe	101
PID 6676 wrote to memory of 4044	6676	msedge.exe	102
PID 6676 wrote to memory of 6796	6676	msedge.exe	103
PID 6676 wrote to memory of 4044	6676	msedge.exe	102
PID 6676 wrote to memory of 6796	6676	msedge.exe	103
PID 6676 wrote to memory of 992	6676	msedge.exe	105
PID 5724 wrote to memory of 5392	5724	2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe	108
PID 6676 wrote to memory of 2888	6676	msedge.exe	112
PID 6676 wrote to memory of 1228	6676	msedge.exe	113
PID 6676 wrote to memory of 5376	6676	msedge.exe	114
PID 5724 wrote to memory of 6076	5724	2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe	115
PID 6676 wrote to memory of 6052	6676	msedge.exe	117
PID 6676 wrote to memory of 6052	6676	msedge.exe	117
PID 6676 wrote to memory of 5580	6676	msedge.exe	120
PID 6676 wrote to memory of 5580	6676	msedge.exe	120
PID 6676 wrote to memory of 3492	6676	msedge.exe	121
PID 6676 wrote to memory of 3492	6676	msedge.exe	121
PID 6676 wrote to memory of 1056	6676	msedge.exe	122
PID 6676 wrote to memory of 1056	6676	msedge.exe	122
PID 5724 wrote to memory of 3416	5724	2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe	123
PID 6676 wrote to memory of 1236	6676	msedge.exe	125
PID 6676 wrote to memory of 200	6676	msedge.exe	126
PID 6676 wrote to memory of 200	6676	msedge.exe	126

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4492	attrib.exe
6076	attrib.exe
3416	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.old_1787028088
  2⤵
  - Views/modifies file attributes
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7ff8eb6dc188,0x7ff8eb6dc194,0x7ff8eb6dc1a0
    3⤵
    PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3164861040259321743,6447679448002927671,262144 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,1124762824329346648,11247528233019463229,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,5670726130387005144,13940325157603601713,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,7775577048945233292,2236759236847725434,2097152 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,9811235122836693208,1983967918347935695,2097152 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5052,i,10021357933345241578,14914217056767439534,2097152 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:9
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5228,i,11966555196785137194,1152404286620898254,2097152 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:15
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,8590696270184176348,13383888032170010750,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,5534062947373390404,12662718905819021057,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,14152598330108760358,16221463162955796759,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,14152598330108760358,16221463162955796759,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,9503541477156379752,4898493211220066479,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,10756893420973687360,10841862047463198662,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=164,i,5559166604132172193,9259181031270897107,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,2033732770246197131,5137666101333064454,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:14
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,11756355301772096280,11632469873411242805,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3184,i,998010144169843556,15392895927039900641,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,528813932028123702,6427737231905425794,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6764,i,1867471848568857197,652273289095843174,262144 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10013552157469242066,8611310894268813954,524288 --field-trial-handle=2284,i,18393668995659988708,13141667704366838182,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
    3⤵
    PID:200
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.old_1787028149
  2⤵
  - Views/modifies file attributes
  PID:6076
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.old_1787028209
  2⤵
  - Views/modifies file attributes
  PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

591d479a-452a-4e7d-a6df-1566f83f1cc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\591d479a-452a-4e7d-a6df-1566f83f1cc6.tmp
Size 16KB
SHA256 fe43d67a091b0bbcc8379832f03caaaf2778a185bcf421eaccd75c1578c7663e
MD5 666639c80222ed94166a543f7fb3cd3a
SHA1 c381f023351dc9ce00d8c5eaf3f33bbef9f9706c
SHA512 bd14ea703bf3353d8c915737f112ac9211b571d60f04aca3cf8bb4b1622971f5cb2aceb8582c06e88c1b17a662f59fbac3a885d70522073bcda44405ca4cdcc0
SSDEEP 384:sxRoYqd8/f/s9LZN/RI0uR/5IW4GONsGQ15g:sU/d8/foL7Wf/5IW41sGQc
TLSH
T14672F815AA249D37DCDBE619FA957F53D3F85173A1501E44AAFCCA0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 542636e74931315e47d8cf9285a26a8c085f618fa381d90ee4d92dcbb8ecd2f2
MD5 b057107538da03324db6a0f89819ce55
SHA1 9cfc746ef05e3207484f2b3d5f877fdbbac371da
SHA512 3e262285859ef2e53ffb6121f32cb1a40ff73968790eec2549a2f69233682a65997fe734470542df6f4256b974d4bffe4d9bb3d5e08240c687e16c9a02e28dc9
TLSH
T15FE02B55C920BC371DFC5B18A1545747E740132B3B41880B3B3C926D4FF063B4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 eb360be5f5eaecc9dab9c710e79af6ba8a051bb1513b3760cf48bf34c5f650af
MD5 529c727026deb05a141dcfed7ab8bd21
SHA1 1d6470af0cc273e45beafe39b3372dac1d57d376
SHA512 840a9acc654638d904bc8eb72488a6d0b01e80dece8b8a74c79737e4ede051d5a03343c51d8ba1e8dc3a9cfa2218c6b14628da537807603984e411b1a5934e63
TLSH
T1944153F56B3307F1EBE1F4B27AE0758932B4D0A999A33FA9110435344A7B77610A3299
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45e9d80480a7483bcf74c05fed9280972453b5d981d28bab45740cf3022ba723
MD5 39fcc8bbecad6c1041cc710f0b94e8c7
SHA1 52378776e5ee5e6361da549e70ddf08e979407fd
SHA512 6e3e9415d860e0bd1860fc5dca9c68c4801dd50c3d27e91c284152b224692e1918a1ca1cab12eaf5b331afef6eec162c24ddc9c10519f37115b84ef725c1ca17
TLSH
T10241AFF783F4856EDA1196F0AA187E2FCF1D0551432C7DAA89E0AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 812653b915a70c6b7fd6b4aa9d797746fa73dc5948f347d7cb1ed2b3b52a8419
MD5 38214e4b206baba201e4f13ad336f988
SHA1 d20bd411095695fca565ece09ae47cb91efc9587
SHA512 030314f77d5356c58c46ddc5f499f7c9cf27b7380d26ed446ddbde9b4b912b55cbf7f0ebda863fbb94e195c0a6b6672b1006c17c6cfbdf16ef8655fc6ee8c0cb
SSDEEP 384:sxRoY88/f/smL0N/RI0uR/5IW4LObsGQ1jb:sU98/f/L+Wf/5IW4+sGQl
TLSH
T1B372E815AA289D3BCCDBD719FA957F53D7F81133A1905E44AAFC8A0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3f72ef00d891cf57eea8758cedf5b5949a8cd2c16dea13ea9f22375f012f061b
MD5 38c373e4caa4b9c2537111d80b8bd578
SHA1 fde826190649831536d0f9bfb3e58dde65ab1f3d
SHA512 6eb9bb11301f2bb3a46079158270f7b72e6a21af10531a30d496c965038cabeeecb4ded317c87236b23f9df25f7f914bce216f1b0da97c2f66670360975ca3c4
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoobbDwzro/4i:Ob4YZnE7yTWg1NfwBu1jaPobHwAwi
TLSH
T164E2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF56D88D5447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4b26ff7eee888f43ac46a2c444aceed46195a9dfe27a74dff78c38e2a7a18a88
MD5 5e25c7884544ac2818cf83d865c6cc90
SHA1 a88731916a05546f66291741102afa29c9f46dbc
SHA512 e57afba687287254e82bb458d2295eae33e8413d0b074254782e4b2c47118ea008ed0ebd611ebd6454f1d4a9860178d3b4bac4bbdda0ee746be98114379a3ade
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9fFp:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRa
TLSH
T19BB23C11713F4680387EA90C91B8D81E96C2B4A37519E53F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3cdbc7057d4fe3cddcbadc958c0ee292d12588a70ccc02d2282652090a16add0
MD5 0ed7ee1e6211087e2bb3496582334f75
SHA1 e9aae583adb41033b6b65b6e50dbe33dea1cd909
SHA512 86e71e54cca0e00f3af01c64c8cbb844adf01e93e2b77f2edb52cc217acf31073f017e9d965df969355bef5e0a0f5e9e9cde39162d3bfd519c0858263967b3c1
SSDEEP 384:nFiFiZcIG8NLC8TUNTUlIREPvuT8RLEqfbzG3+3YEi3rwOVySllYJTfY81Fz48LD:MFQGQCwgeuIBG3yYEMRVZuTH1fBuc
TLSH
T1B9D26C329854C9B7ECEB5FC97A4A7647DEE05163898C8AD4DAD85E0D00C71EE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2a176b19f0a7442f4f68a6938bab90f6e7626ea1d577ed754c8bcdff4124fbf1
MD5 74c73046f321e89abce3ba106603e084
SHA1 01dfbb24568f4bf5c2d6d61f650f103912376356
SHA512 237f9e1b01aaae665e8e742dc529e94b5f8193c269bca604d8aa6e2b3e42be02cf512e9a5a4211b47d887b06342c7aeedd5b69ffe9478e70eb89f0951c995020
SSDEEP 384:nmiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTu9REqfbzG3+3YEeLrOObjI9G6w7ZV8p:NF1j+9SXswgUuiXG3yYE8r29MW
TLSH
T1A2C25B36E859CEB7EDE64FD9B70E7A46EEE0516384985AD8DAC85E0C00C71ED4307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 374a89a8083ba0cc84596b84f59781429188931533df2c7f0ec56c753db58b79
MD5 c7829a9d8102af398b30172275debfdf
SHA1 556cf40910e22f147812a897d445d5998f39d155
SHA512 26d69e8abe11c86b2052f08476dfbdd86a98e3059ad7ac71900b63ebda9aba527b55ca6893bccfc85773888b943f14cec12a93fbf0166f7ac2541247cf323f49
SSDEEP 384:nYiFiZcIG8NLC8TUNTUlIR4PvuT8RLEqfbzG3+3YEi3rwOVySllYJTfY81Fz48LD:jFQGQCwguuIBG3yYEMRVZuTH1fBuc
TLSH
T1CCD26C329854C9B7ECEB5FC97A4A7646DEE05163898C8AD4DAD85E0D00C71EE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cdabb1f5044002c1a866af78044f1e92e18530f12ea22fa6c95b7fafcaa7bcf0
MD5 fda6583ee010aa8dbc8f5cbf115c8688
SHA1 6ecbd907340dba5adb46d42478e4d78c665ad68e
SHA512 1b5a9797f4ed42b0e303e9457f8081110e940f8fd8b8adfcc6a9f4e1fe351054808685578e83b89e94f9540d99a43cef0a8dd83cf7e4bc9d61bc6f0f3c415f5c
SSDEEP 384:nSiF1tNn/s3n9Sn8NgC8TUNTUlIRiPvuTIcLEqfbzG3+3YEi3rwkVOObjI9G6w7W:ZF1j+9SXCwgUu9BG3yYEMJV29MW
TLSH
T184D25C36E855CEB7ECD74ED8B74A3A46EEE05163888C5AD8E6D85E4C00CB1ED4707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d077c79417fa20a6024c52fef29a623c567e11a2d298e73ca78cc167d15b4b53
MD5 dbdc48c16dd6e52e3470a95fbbc0f8c8
SHA1 e784a3be629cb20f304d159a193903e0ffe48650
SHA512 d634b495e4b2b2dcf2e353b0470d03c77556639e8dd0d72cad3ecf4e61b93deaf4554f1924514890e93d495fcc328c48131bd85bd4aecbbcea23700dd6b92427
SSDEEP 384:nYiF1tNn/s3n9SG8NLC8TUNTUlIRBPvuT3RLEqfbzG3+3YEi3rwkVySllYJTfY8z:jF1j+9jQCwgPulBG3yYEMJVZuTH1z
TLSH
T16DD25B369855CEB7ECEB4FD87B4A3646EEE05163888D4AD8DAD85E4D00C71ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 74a88f5e6dc9a3edaa69b4bd1c5e414569e5643e460bce25879c7c2f590467b7
MD5 1ce39fde659f16a0a6e8ec9309454c9d
SHA1 661a30f4233860c2e1a7302031c5cdb409211ff3
SHA512 b7887120f8d102c0e5e6e24911309f90efe8d17e255f0e423b1cbda1c8e176d23ec448b84dd8f101add3ebd79b6996059e52e30c6ae26796111ed0240d96c2cb
SSDEEP 384:n5iFiZcIz8NLC8TUNTUlIREPvuT8RLEqfbzG3+3YEi3r92VySllYJTfY81Fz48LD:QFQzQCwgeuIBG3yYEMoVZuTH1fBuc
TLSH
T1E6D26C329854C9B7ECEB9FD97A4A7647DEE05163888C8AD4DAD85E0D00C71EE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 63e36b77e100c5c24b95c0e6a50373d8df13ec37520bc17987a5de9aec958345
MD5 e4ddf28c58b4757d4a14c04e8ec2ebf6
SHA1 19798cc092c3ee38a727c38d5a8e93f9fc2e6e8f
SHA512 38c1654a83af49fde1bb9f841b8d7f88a64eba9b3cf84913a9f0975a536075a6d9dfcbb214b4118858bfb65097487d8341249ecec16cb6d13aa218efcd83eece
TLSH
T1D0511FE04C3C1AD1D5FD0E7EB08739FC95EC9726F8A434386858E998596A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f7edb8e54884795a399cf363b08025af7a10f0a9e9c48c87854a53534b72072a
MD5 6afaf2c6a06041dbc126d4d845923690
SHA1 abca841a40f03e80b0fe881dcc99787623e80af6
SHA512 5e79322c7342aa79d04b2b260bd0d2aefd014a02f582524bf394b2d2864d1c03d374236e83a6fda7af77ba775e7dc37e002340410b733c52d8ef4197226e3449
TLSH
T1E8512DE04C3C1AD1D4FD0E3EB09739FC95EC9626F89434386859EA989A7A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 b50865d85024a31fd82b643c3c105ac6d4632c0b8a83a417ea67fd4deeb643ea
MD5 3a01047b59e676a42b59cd001edaebe9
SHA1 37d1d390be7ad25f8a55350523912c685ff009a7
SHA512 32278d55842787f350bd6730c32ea6220d53efbbaf6ba5fdd758ce1cdb50207391ef6363989eeb5511a89d4a249d6467e2396aeccddc6e54b3158f6c1dabf9d6
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3+:CebAjOKn3wRKRJ3+
TLSH
T10DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.old_1787028149

Path C:\Users\Admin\AppData\Local\Temp\2026-08-18_f95c37d4d706d39751fb03a7c6985514_akira_glassworm_rusty-stealer.old_1787028149
Size 2.7MB
SHA256 460e3ca930ec23265d1140d906b60eb63517603a39517de1fb6da6cca41ce13c
MD5 38b61240db752aed8a3c72b8491c7bdc
SHA1 6b27c3aa02a3137860ae5689caf5321a75fd895f
SHA512 a20ef39206688bcc5198890f056b4dfd9d515de22a497a33285fefabed20dc74f88ce01bc0f0b091fd7870bd6e3dc773965cca46a0ac58dc45fce6fff066a1a0
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3o:CebAjOKn3wRKRJ3o
TLSH
T127D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5724-196-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-249-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-220-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-263-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-278-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-214-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-295-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-213-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-304-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-185-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-330-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-171-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-346-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download

memory/5724-147-0x00007FF6A4330000-0x00007FF6A45F1000-memory.dmp

Download