7b364691363bfe2ea1d7426ec62aa7c64728c4fb522840a286fe41be5d78af5a

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260820-csx56sba46
SHA256 7b364691363bfe2ea1d7426ec62aa7c64728c4fb522840a286fe41be5d78af5a
MD5 eb4471615ab169d476c1550fcb3e0201
SHA1 8a473ddfa16ede392aab51d06b81e270aeada7d7
SHA512 e8ef7d715961a6df7f3fab639d208a4b6aacb2f12941c5a8686f50464a5fdfebf7db30387821d3ddd3d728792271ace1ca8ded5f1a2255fff2cdabb20b08ff74
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3I:CebAjOKn3wRKRJ3I
TLSH
T1F1D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316660672588693"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{50029447-C2C2-453E-94A2-AB3E987797A8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5164	wmic.exe
5164	wmic.exe
5164	wmic.exe
5164	wmic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5104	2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5164	wmic.exe
Token: SeSecurityPrivilege	5164	wmic.exe
Token: SeTakeOwnershipPrivilege	5164	wmic.exe
Token: SeLoadDriverPrivilege	5164	wmic.exe
Token: SeSystemProfilePrivilege	5164	wmic.exe
Token: SeSystemtimePrivilege	5164	wmic.exe
Token: SeProfSingleProcessPrivilege	5164	wmic.exe
Token: SeIncBasePriorityPrivilege	5164	wmic.exe
Token: SeCreatePagefilePrivilege	5164	wmic.exe
Token: SeBackupPrivilege	5164	wmic.exe
Token: SeRestorePrivilege	5164	wmic.exe
Token: SeShutdownPrivilege	5164	wmic.exe
Token: SeDebugPrivilege	5164	wmic.exe
Token: SeSystemEnvironmentPrivilege	5164	wmic.exe
Token: SeRemoteShutdownPrivilege	5164	wmic.exe
Token: SeUndockPrivilege	5164	wmic.exe
Token: SeManageVolumePrivilege	5164	wmic.exe
Token: 33	5164	wmic.exe
Token: 34	5164	wmic.exe
Token: 35	5164	wmic.exe
Token: 36	5164	wmic.exe
Token: SeIncreaseQuotaPrivilege	5164	wmic.exe
Token: SeSecurityPrivilege	5164	wmic.exe
Token: SeTakeOwnershipPrivilege	5164	wmic.exe
Token: SeLoadDriverPrivilege	5164	wmic.exe
Token: SeSystemProfilePrivilege	5164	wmic.exe
Token: SeSystemtimePrivilege	5164	wmic.exe
Token: SeProfSingleProcessPrivilege	5164	wmic.exe
Token: SeIncBasePriorityPrivilege	5164	wmic.exe
Token: SeCreatePagefilePrivilege	5164	wmic.exe
Token: SeBackupPrivilege	5164	wmic.exe
Token: SeRestorePrivilege	5164	wmic.exe
Token: SeShutdownPrivilege	5164	wmic.exe
Token: SeDebugPrivilege	5164	wmic.exe
Token: SeSystemEnvironmentPrivilege	5164	wmic.exe
Token: SeRemoteShutdownPrivilege	5164	wmic.exe
Token: SeUndockPrivilege	5164	wmic.exe
Token: SeManageVolumePrivilege	5164	wmic.exe
Token: 33	5164	wmic.exe
Token: 34	5164	wmic.exe
Token: 35	5164	wmic.exe
Token: 36	5164	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
824	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2444	5104	2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe	89
PID 5104 wrote to memory of 824	5104	2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe	91
PID 824 wrote to memory of 5476	824	msedge.exe	92
PID 824 wrote to memory of 3308	824	msedge.exe	94
PID 824 wrote to memory of 4672	824	msedge.exe	93
PID 824 wrote to memory of 3308	824	msedge.exe	94
PID 824 wrote to memory of 3308	824	msedge.exe	94
PID 824 wrote to memory of 624	824	msedge.exe	96
PID 824 wrote to memory of 624	824	msedge.exe	96
PID 824 wrote to memory of 124	824	msedge.exe	97
PID 824 wrote to memory of 124	824	msedge.exe	97
PID 824 wrote to memory of 124	824	msedge.exe	97
PID 824 wrote to memory of 1756	824	msedge.exe	98
PID 824 wrote to memory of 1756	824	msedge.exe	98
PID 824 wrote to memory of 1756	824	msedge.exe	98
PID 824 wrote to memory of 4644	824	msedge.exe	100
PID 824 wrote to memory of 5876	824	msedge.exe	99
PID 824 wrote to memory of 4644	824	msedge.exe	100
PID 824 wrote to memory of 4644	824	msedge.exe	100
PID 824 wrote to memory of 5876	824	msedge.exe	99
PID 824 wrote to memory of 5876	824	msedge.exe	99
PID 824 wrote to memory of 4640	824	msedge.exe	101
PID 824 wrote to memory of 4640	824	msedge.exe	101
PID 824 wrote to memory of 4640	824	msedge.exe	101
PID 824 wrote to memory of 6116	824	msedge.exe	102
PID 824 wrote to memory of 6116	824	msedge.exe	102
PID 824 wrote to memory of 6116	824	msedge.exe	102
PID 824 wrote to memory of 5864	824	msedge.exe	103
PID 824 wrote to memory of 5864	824	msedge.exe	103
PID 824 wrote to memory of 4944	824	msedge.exe	106
PID 824 wrote to memory of 1452	824	msedge.exe	105
PID 824 wrote to memory of 4944	824	msedge.exe	106
PID 824 wrote to memory of 1452	824	msedge.exe	105
PID 824 wrote to memory of 2348	824	msedge.exe	108
PID 824 wrote to memory of 4940	824	msedge.exe	111
PID 824 wrote to memory of 4940	824	msedge.exe	111
PID 824 wrote to memory of 3476	824	msedge.exe	112
PID 824 wrote to memory of 3476	824	msedge.exe	112
PID 5104 wrote to memory of 5164	5104	2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe	113
PID 824 wrote to memory of 4660	824	msedge.exe	117
PID 824 wrote to memory of 4404	824	msedge.exe	118
PID 824 wrote to memory of 3560	824	msedge.exe	119
PID 5104 wrote to memory of 3500	5104	2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe	120
PID 824 wrote to memory of 2108	824	msedge.exe	122
PID 824 wrote to memory of 2108	824	msedge.exe	122
PID 824 wrote to memory of 1132	824	msedge.exe	125
PID 824 wrote to memory of 1132	824	msedge.exe	125
PID 5104 wrote to memory of 3764	5104	2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe	126
PID 824 wrote to memory of 4348	824	msedge.exe	128

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2444	attrib.exe
3500	attrib.exe
3764	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.old_1787192462
  2⤵
  - Views/modifies file attributes
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffb6ac3c188,0x7ffb6ac3c194,0x7ffb6ac3c1a0
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11667939948193823982,15339442889317993641,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,11590923975315573420,5027468900945190184,262144 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,12637244282309083754,16897431876120783833,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,17492730415210873679,11063023397065890129,2097152 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,5929526712949282109,8390184194612403817,2097152 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,13246748802868562483,16078374969925812967,2097152 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,7034818429545968497,10967253521458734522,2097152 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:9
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5196,i,8244234572417408981,7899720482346465080,2097152 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:9
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5408,i,6680849775036618115,7010836956401276936,2097152 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:15
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,9582761887192601941,8831270946626271248,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,3947434206519799651,13396590851272202827,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,4035078038717861940,3271896097047028218,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,9617733940052285383,16080500390029967739,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,9617733940052285383,16080500390029967739,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,5982923501567696451,12980591540631967802,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,16983506536485178593,14411678650735039493,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6619270065761217056,10000113076191949958,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,8678929416357418518,2320449004967007444,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,3238530904423830124,4573291432550091963,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2912,i,16240357370220031264,14243398682121702126,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,16580328404241746687,10638752871206361346,524288 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:14
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6436,i,8510868218784670556,9187503449895245343,262144 --field-trial-handle=2276,i,3098750713643960710,16882883384788792444,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
    3⤵
    PID:4348
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5164
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.old_1787192522
  2⤵
  - Views/modifies file attributes
  PID:3500
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.old_1787192583
  2⤵
  - Views/modifies file attributes
  PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d066172f2d7a9d426d994fa20a43087a026cd88846bd098e8ef82fda31f40758
MD5 a9ab08f7f7f1edaa475a77c222e709ea
SHA1 1bd44ec70fc74252cd99e07876388e14bcab1fb8
SHA512 4bba8ed6e06d9da0a4a19a234535e59d8eba22f61ad7387056fe16ac7e85d61cd8b569cc7efdb24989e61b95dd220a6f05728bb56c83247d8fd853ac11d0f293
TLSH
T112515451536219C2E7BE0AB2B7E1544B7EF564DA0A47BE03C0D06E7498E6F051DC90A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593ef3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593ef3.TMP
Size 2KB
SHA256 747241292ff5c1ee4d90ce41fae14ca142323a1036fc0000e3e23448303f4889
MD5 7532bade8373c90fc95f760ac736da95
SHA1 d99679cae15226ddf17c145aa185ae54b2ef52d9
SHA512 cc715bc317884a1f31b423669489a99eafbb3037cb72e0b8902675779417c66985b1eb81e82f7b98096c21f8959fce194b072ca9c08955b081c0748851d7a65f
TLSH
T1D2517461536209C2E7BE0EB2F7E1544B7EF5A4DA0A4BBE03C0D06E7488E6F051DD90A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 86b0b55bb1b4a599a9a32ecc0c6b6d35db93d4140be840a3f60df8e20c2f2004
MD5 6ca54a3c4d7eb2df6fc06d12b91f111b
SHA1 2bee2faf29618475308bbbaf89788beb5535c1d7
SHA512 d93514c26d0442d114046a0a28cbb3504ff20ae694d30736c919b37d39b429823ffdb23be204dcd9b16ab45d69d16d249b4838b49967e0c2444065c0d3a78a58
TLSH
T1A3418FF7C3F4D56E8A1155F0AA14AE2FCE2C0511431C7D5A89E4AF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 935c76877ab773bf00a936695c06e6c34c68111f891bbeaf24c5d4836abaaa61
MD5 0759ba8066f0f8e1b947cb57b7f5dd51
SHA1 196f8a86c5f2d813297c984df9a218a3f548e247
SHA512 c5f14a15e64662cee1f178f80d01f1e0ccd2ed691989fe4eb8db9438cf7cfb6135a22b9bb114c7d6d25c432878d7d61156dbb8a56d02a2ce6591cd5ea7a69f39
SSDEEP 192:sxRYRXCs/fqsYLmlZAzoA8p4U/g6+WNIYn8/hOwyhg+GYIgDSezJ:sxRYYs/fqsYqL5N/5IT5Otg62+
TLSH
T16642B8256D28A93B9CCBE25DFB55BF53D7F95032A0941E44AAFC8A1C04E7ACD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4933190ce6aaf55fb0fb55fecf71b6b82b40c54c4f5c29ba27638048aa0b37d8
MD5 3e6e069f0fadbb05050d7e76092a3c18
SHA1 7e29f5a9588678a72029c58248332c82c10ee571
SHA512 56422de07865ba762387deb97d59b9672c0ac6272ea3324aa96d38545ea30513225011b727154c655d88af1586783502a968918fa609b7faf1ca435722311c85
SSDEEP 192:sxR/RXCs/fqs4L8lZAzoA8p4U/g6+WNIYn8UjOwyhg+GYIgVzJ:sxR/Ys/fqs4YL5N/5ITuOtg6D
TLSH
T19242A6256D68A83B9CCBE25DFB55BF53D7F91032A1941E44AAFC8A1C04EB6CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cd3cc3273ad1a9f3665d662f91ee52242e4e6f1533c979e79f34c17931941782
MD5 64c1e9fae1fc5875a345e6fcb77809e6
SHA1 8f2b42ef4b699383b74001d96a24586f1633f204
SHA512 6ea0647965614f74ca9071b23b7ca74914d881dd7a90ef1bbe0e4f22ad1ce74069168df530166f321f0b3796233e68fa91eba6e00d20715075e1b317b78ce6cc
SSDEEP 192:sxRYRXCs/fqsYL8lZAzoA8p4U/g6+WNIYn8UjOwyhg+GYIgDSszJ:sxRYYs/fqsYYL5N/5ITuOtg62M
TLSH
T10842B6256D28A93B9CCBE25DFB55BF53D7F91032A1941E44AAFC8A1C04EB6CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 76f86277fd4eaf61525e103b400e947280387c1ebe70ce90381a22193f1e33c4
MD5 677e638b28094d96520af9e5b488e646
SHA1 315cf024f1250056a1d155621a73df44d6a373db
SHA512 c34f3876d624fba8e806bdc3b2a688a97ee6d57cc7833bf1fd0ddccdab2a6c49312a24122d396b75e658b001e096eb8832d6ed0ef332234c120bc20b60ba3def
SSDEEP 768:wb8d4g7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/smu46Iroh+S50:wb8d4sE7r6Wgouf6Mu1ja0smV6zti
TLSH
T103D2DA7B740DCB7E4F800ADDEC19BE9F6DA802CB96D8CD4047FA951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e044ef35-5252-46e8-9789-b601336438f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e044ef35-5252-46e8-9789-b601336438f3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 98ba40f8f7f98a3d9d91b860d7d6f0c5085a7a4fac07ad7c1e910b983882cb96
MD5 f15fd6e6e50e700d968dcf406b68e013
SHA1 3b82cfd6b2051260265f2dd6ea2f12737cb79437
SHA512 91e812967fe7288d43f61dcda09280cd8134a294fff5ea5a5d0b39c512ac8a7401000f5542d2abfe0bb1b2a3248f0239f0577b2a92989c34c1dd2832c104786a
SSDEEP 384:nGZcIHP38NeJwWrpM/bJDZNfNoXOVSUUiIFSRKQDETRzcoXfK86sfxEZxxsIj4l/:Uv3t2tDZIO0BaKlNzc4ReyIsPqfr+
TLSH
T1A0F2BE31AC698C63ACFDE286F64636827EF42027C1DC2E54D5DD9F1C09476AD1B5B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1a07a2241dbeb36beba6ce0d9f59b11455dc6556a492a4efc5dcd087923ba245
MD5 8f97f213b503163460c1a107d2991d36
SHA1 e80dba304e8f6b5083554737e8949ddd6a446c7a
SHA512 0cdbcd30777ec6cc8b1b53dc8388ec77842a3940871237d664fdaaa937f6422e0fa215f3223375994e7bbf05170f75534d1d26dc85a476bd775ceaf319aa9459
SSDEEP 768:6rv+4UNbds3nMTDZIO0BaHNzc4ReyIsXQeVH1S5D:6bsbS3MWaHtc44bsgEH1Y
TLSH
T12603CF32A8788977ACF6A686B54776533EF85127C2D81A94C5DE2F0C464B1ED130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d23f680289284702b002caff8497f42aaef2eac008a521fbc36bd4ca163324bc
MD5 109193ed52c073243b38757e76087bb9
SHA1 3d62fee74fbf35ef5af7f8238d8b420d61a22827
SHA512 6a83be0442d62a3ad504ae19c12019f7e038d15e6f8d9445cb0d1e8652dc9e7fb3450068b4448486b36a4d97e9f136594bacfa52c29698e132410a6b9922e96f
SSDEEP 768:srv+4UNbdw3n2tDZIO0BaKlNzc4ReyIsPqy3k:sbsbG32UaStc44bsiZ
TLSH
T13503BE31E8298E73ACFAA686F14736933EF8206780C81A94D9DA5F4C45471ED1B5F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d8b2550f3bc46b97000b030714ac17c1f358ab66f069e3b7675a056ba180fdaa
MD5 56157e4b1d174c1e8ea46ff377db7c25
SHA1 c9c8745f1cb0d34f1ce50aecf0cc056d833f8d72
SHA512 c37ad688c882ea612eefadef00ee381230ea3aeec77af21b1408168ae66ae1697fb2a54a39d53c88419789d90796f844f73701e20075304534daad72b2f6a842
SSDEEP 768:1FQD35wgg20ZU5O0BaKdNzc4ReyIsPqfr+:UD35damtc44bsifr+
TLSH
T180038C36DC64CE67BCFA9786F7067686AEF4106381DCA9D4DAD95E1C00872EE074BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6a843536628c6969c68c69a460cd7ac1a3fd7be9b4c1fb4e4286f6da6db6ecaf
MD5 ee5e2cf6155f4275068436e90c60fb5d
SHA1 73a7b06ab5c1d4de7b14abea743de0813a0cedae
SHA512 95f4e79f018ccda117e103014981a700ca97cf6581f5c9620d3769f12537efe8000b997e8bd8ab4d85b6e08ca7cfdab04c24e39229446614171c35f5449e22dc
SSDEEP 768:Krv+4UNbds3q2TDZIO0BaK4Nzc4ReyIs2qeVH1S5D:KbsbS3rWaHtc44bspEH1Y
TLSH
T1EA03CF32A8798D33ACFA6646F14776933EF8602781C80E94C9DA5F4C4A471DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c8fe7197bea4524d609ef3e01f3e48305f1e02689bea394f1a4983cc688c88b3
MD5 acff3c9009089539c6c4881a2adb1412
SHA1 eda0f1027beb99112650690732a611bc6d00455f
SHA512 1fb0f4a5aef79e4bf73feeebc650adb895ce71c6f6953ba47986995fb2dd79846cf35f1e3f6cee7df6f99879aefbe9646dbcfbc9d7a6d3fac7998cf3fe3a1bdf
SSDEEP 384:nbZcIHP38NeEwWrpM/bJDZNfNoXOVSUUiIFSRKQDETRzcoXfK86sfxEZxxsIj4l/:Dv3G2tDZIO0BaKlNzc4ReyIsPqfr+
TLSH
T116F2BF31AC698C63ACFDE286F64636827EF42027C1DC2E54D5DD9F1C05476AD1B5B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 b539f7905b9233c41e07bf244e3df224aa39035b9d2db30865a6a9392cb01f98
MD5 0c8721e7d6047624f1bafe543c44bfb0
SHA1 798bc17ae1c8007b78cd39d461e3af40b4900fb0
SHA512 aac3ad61503745fd3139897eb1cd5689d90abae7d706a5a5a3d2c184290aee51bafef9ad726b8b3315b3497717466221ffe83b730f739e5c072672a217cc3106
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3B:CebAjOKn3wRKRJ3B
TLSH
T1A3D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.old_1787192522

Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_eb4471615ab169d476c1550fcb3e0201_akira_glassworm_rusty-stealer.old_1787192522
Size 2.7MB
SHA256 71a7bce63b6eed3eff710d26c68a0dec6fddf687688857e0398751e788c138c4
MD5 bf2f09ddaac70147e5c39f3bc51b3b7d
SHA1 30a7134bd59764584fe31810fb0f55e5b453f6ce
SHA512 a71108e5ae2aab7c36eccd2dff8dad56af8104dccb539ebfb51ebbbc2e92f873458689223a60dada93b7eeb1024d0f223ba0d8c4930592b9adb59f0657e0ed03
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ37:CebAjOKn3wRKRJ37
TLSH
T108D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir824_2145116950\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5104-205-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-248-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-230-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-290-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-206-0x000001B510390000-0x000001B51040C000-memory.dmp

Download

memory/5104-270-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-252-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-332-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-342-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-344-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-351-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-354-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download

memory/5104-356-0x00007FF6F8920000-0x00007FF6F8BE1000-memory.dmp

Download