db6d9bc1f05c4ebc20c3d843b4d9e6c010de8577608afa14d4a2f6ba6415c18c

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260820-cty4vsba49
SHA256 db6d9bc1f05c4ebc20c3d843b4d9e6c010de8577608afa14d4a2f6ba6415c18c
MD5 c51b2388ab7b3fc7ea63e8d94912c3d4
SHA1 2ffa6c28c1c3b278281d17c114e001bd6de3e610
SHA512 8fa9ee5c0676ef5c21e6873371c518888f51b90f110ab52ae389442e3afa8dd402d31a20fab8ba7cbb24ddd9f989e788c38fdd50791c95c31511c86f6bf9b217
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ32:CebAjOKn3wRKRJ32
TLSH
T17DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4976_1857860465\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4976_281309856\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4976_281309856\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1892	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316661762870967"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{4637F8B7-2D30-4F74-A365-12CAB694A6E2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3732	wmic.exe
3732	wmic.exe
3732	wmic.exe
3732	wmic.exe
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4372	2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3732	wmic.exe
Token: SeSecurityPrivilege	3732	wmic.exe
Token: SeTakeOwnershipPrivilege	3732	wmic.exe
Token: SeLoadDriverPrivilege	3732	wmic.exe
Token: SeSystemProfilePrivilege	3732	wmic.exe
Token: SeSystemtimePrivilege	3732	wmic.exe
Token: SeProfSingleProcessPrivilege	3732	wmic.exe
Token: SeIncBasePriorityPrivilege	3732	wmic.exe
Token: SeCreatePagefilePrivilege	3732	wmic.exe
Token: SeBackupPrivilege	3732	wmic.exe
Token: SeRestorePrivilege	3732	wmic.exe
Token: SeShutdownPrivilege	3732	wmic.exe
Token: SeDebugPrivilege	3732	wmic.exe
Token: SeSystemEnvironmentPrivilege	3732	wmic.exe
Token: SeRemoteShutdownPrivilege	3732	wmic.exe
Token: SeUndockPrivilege	3732	wmic.exe
Token: SeManageVolumePrivilege	3732	wmic.exe
Token: 33	3732	wmic.exe
Token: 34	3732	wmic.exe
Token: 35	3732	wmic.exe
Token: 36	3732	wmic.exe
Token: SeIncreaseQuotaPrivilege	3732	wmic.exe
Token: SeSecurityPrivilege	3732	wmic.exe
Token: SeTakeOwnershipPrivilege	3732	wmic.exe
Token: SeLoadDriverPrivilege	3732	wmic.exe
Token: SeSystemProfilePrivilege	3732	wmic.exe
Token: SeSystemtimePrivilege	3732	wmic.exe
Token: SeProfSingleProcessPrivilege	3732	wmic.exe
Token: SeIncBasePriorityPrivilege	3732	wmic.exe
Token: SeCreatePagefilePrivilege	3732	wmic.exe
Token: SeBackupPrivilege	3732	wmic.exe
Token: SeRestorePrivilege	3732	wmic.exe
Token: SeShutdownPrivilege	3732	wmic.exe
Token: SeDebugPrivilege	3732	wmic.exe
Token: SeSystemEnvironmentPrivilege	3732	wmic.exe
Token: SeRemoteShutdownPrivilege	3732	wmic.exe
Token: SeUndockPrivilege	3732	wmic.exe
Token: SeManageVolumePrivilege	3732	wmic.exe
Token: 33	3732	wmic.exe
Token: 34	3732	wmic.exe
Token: 35	3732	wmic.exe
Token: 36	3732	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4976	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2268	4372	2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe	89
PID 4372 wrote to memory of 4976	4372	2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe	91
PID 4976 wrote to memory of 300	4976	msedge.exe	92
PID 4976 wrote to memory of 3396	4976	msedge.exe	93
PID 4976 wrote to memory of 1892	4976	msedge.exe	94
PID 4976 wrote to memory of 3396	4976	msedge.exe	93
PID 4976 wrote to memory of 3396	4976	msedge.exe	93
PID 4976 wrote to memory of 2624	4976	msedge.exe	95
PID 4976 wrote to memory of 2624	4976	msedge.exe	95
PID 4976 wrote to memory of 6004	4976	msedge.exe	97
PID 4976 wrote to memory of 6004	4976	msedge.exe	97
PID 4976 wrote to memory of 6004	4976	msedge.exe	97
PID 4976 wrote to memory of 5196	4976	msedge.exe	98
PID 4976 wrote to memory of 5196	4976	msedge.exe	98
PID 4976 wrote to memory of 5196	4976	msedge.exe	98
PID 4976 wrote to memory of 1924	4976	msedge.exe	99
PID 4976 wrote to memory of 1432	4976	msedge.exe	100
PID 4976 wrote to memory of 1924	4976	msedge.exe	99
PID 4976 wrote to memory of 1924	4976	msedge.exe	99
PID 4976 wrote to memory of 1432	4976	msedge.exe	100
PID 4976 wrote to memory of 1432	4976	msedge.exe	100
PID 4976 wrote to memory of 2452	4976	msedge.exe	101
PID 4976 wrote to memory of 2452	4976	msedge.exe	101
PID 4976 wrote to memory of 2452	4976	msedge.exe	101
PID 4976 wrote to memory of 1592	4976	msedge.exe	102
PID 4976 wrote to memory of 1592	4976	msedge.exe	102
PID 4976 wrote to memory of 1592	4976	msedge.exe	102
PID 4976 wrote to memory of 5896	4976	msedge.exe	103
PID 4976 wrote to memory of 5896	4976	msedge.exe	103
PID 4976 wrote to memory of 4528	4976	msedge.exe	105
PID 4976 wrote to memory of 6028	4976	msedge.exe	106
PID 4976 wrote to memory of 4528	4976	msedge.exe	105
PID 4976 wrote to memory of 6028	4976	msedge.exe	106
PID 4976 wrote to memory of 4284	4976	msedge.exe	108
PID 4976 wrote to memory of 2440	4976	msedge.exe	109
PID 4976 wrote to memory of 2440	4976	msedge.exe	109
PID 4976 wrote to memory of 4404	4976	msedge.exe	110
PID 4976 wrote to memory of 4404	4976	msedge.exe	110
PID 4372 wrote to memory of 3732	4372	2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe	113
PID 4976 wrote to memory of 3516	4976	msedge.exe	117
PID 4976 wrote to memory of 4648	4976	msedge.exe	118
PID 4976 wrote to memory of 1288	4976	msedge.exe	119
PID 4372 wrote to memory of 2476	4372	2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe	120
PID 4976 wrote to memory of 1676	4976	msedge.exe	122
PID 4976 wrote to memory of 1676	4976	msedge.exe	122
PID 4976 wrote to memory of 1268	4976	msedge.exe	126
PID 4976 wrote to memory of 1268	4976	msedge.exe	126
PID 4976 wrote to memory of 5924	4976	msedge.exe	127
PID 4976 wrote to memory of 5924	4976	msedge.exe	127
PID 4372 wrote to memory of 1044	4372	2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe	128
PID 4976 wrote to memory of 4592	4976	msedge.exe	130
PID 4976 wrote to memory of 1832	4976	msedge.exe	131
PID 4976 wrote to memory of 1832	4976	msedge.exe	131

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2268	attrib.exe
2476	attrib.exe
1044	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.old_1787192571
  2⤵
  - Views/modifies file attributes
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff917c6c188,0x7ff917c6c194,0x7ff917c6c1a0
    3⤵
    PID:300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,11827731483105226990,4602507040846447863,262144 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,9904624787118941254,10029978229014240499,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,17174001867656892876,15750186677722454246,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,11252902982143590343,122897364314123834,2097152 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,3114748555857294331,10615405308474239091,2097152 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16509130007800098973,16310816144835982658,2097152 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,5000095759636060493,2392321879047359849,2097152 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=1796,i,8152995448027826668,8366968530479111755,2097152 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:9
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5440,i,15265010497447965597,3245106215708343242,2097152 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:15
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,13319912938337919900,6232002204844738983,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,5722725427171752888,1800219986662418161,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,10395652673856927348,13100118575558558514,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10873345979329868229,8142016468972411891,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10873345979329868229,8142016468972411891,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,18258618488828154169,13038674596539082884,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,7835531278774824932,9260492295275230367,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,6669633150965639582,17064715017393360516,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,2331791643264539690,16077116553442356948,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15474678174584128754,13117841849831998567,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,2126765562183174819,3324940532657049863,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,7591615037787735624,16708169686982536679,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,15996201454119942011,12854367275161149532,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,14906063289915289793,8890811578052537400,262144 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,5847627569770688690,11441676356777790068,524288 --field-trial-handle=2160,i,17808513963531884302,9714770421428572926,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
    3⤵
    PID:1832
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.old_1787192632
  2⤵
  - Views/modifies file attributes
  PID:2476
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.old_1787192692
  2⤵
  - Views/modifies file attributes
  PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a5d195e1d85bc3287df2314b38f5e71c9855bd640cc64815327a16baebcb0058
MD5 578d752c7e4269de8859b7a936623177
SHA1 39df0d2bb6b16deb8a8f880eb459b4960bbfce30
SHA512 10ca9f9aceb49c76b5f626ddb49711ecf8d37e8a0bbfdba69bc79c178d0b9ad7ac2972bf869c3e183975dd59a2da91aae47a750472c1c19e69911ab3541ecf5b
TLSH
T11751B81043272EF1F7A5B8B226D148593F38D02EE52B6E1ED1D7FE7448877642E220A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c7ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c7ea.TMP
Size 2KB
SHA256 920a8e5c0d133761618750df93b623297cf4e7e4c12667fe82a1ba2931ddc533
MD5 b8aafe007c2e8dd92808dcc738aa5401
SHA1 9d7c72ab3463c8efe99d5ebd7ccaf26a33af7ed4
SHA512 64dadbc17486c000ff1eae8e4d75e1c75ab77f6ee55b06ad1ab9de58e90daa5069bd35c40c3e8ff7d0e7d11909532308d3906eb3b497542b409a8805d621d6b1
TLSH
T12251966043272EF1F7A4B8B216D018893F38D02DE52B6E1ED1D7FE3448973602E225A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3b1993617b773c77934597b066661ddc863b99b2ceda8dc2aa10b6aa28cfeeb4
MD5 d3053a2fcc8a81d2be375ad89699b9be
SHA1 3b9a121db8bffb3d12645a2e076fe2fe43d774af
SHA512 453bcae4e721a134db37086dc2d7ffb39f12a46fc645ab8e2a12ed6adca16332591d82ae37f03b711381bb924c5032b232a55073f7f1ebde9ecd4182b44c21fd
TLSH
T1C6319FF783B4953E8A1195F4AA086E1FCE690415432C7D9AC5E05E2B93E3461D180E9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f47bd585eaf99fc96db559d91e97979ed035883cf986434ab42908078a22c83d
MD5 25fc399ed37a6aceffeb206170833d6f
SHA1 7c890a55624c3e21d1ebeb34d9f871b07f25bca0
SHA512 c96cc7bbda4bf7cfc6097cddd77ed7afeefcc4bb21405a2b191a6344116ea3ea1763d2e279c68227ce205d072a78cfeeb008da3370611a1b286a20acf77b3ace
SSDEEP 192:sxRzrC6/fRsql2Z3zoA8p4l/g6+WNIYE/kOwniKaGFIgVAJ:sxRze6/fRsqlAew/5IwOvoG
TLSH
T14A42C6156D28A97B9CC7E21DFA25BF53D3FD5032A1905E48BAFC861C04EA6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 33883bbf66525bccafb50742a8812b665e5c1c6452039b97eae0611b67162bb0
MD5 91550d71cec99cfa367687f01b6e3fa9
SHA1 cf62c71565f75982dd72113c1fad56e41cef223d
SHA512 17b0fd9a2f14bd7427134eb4fd908efa3f6439bb55dff1e1b167382a4e447d7625b7016b3b68e7cf646656747298caeeaf25bfe9b631ccfa95027fc06acb91ac
SSDEEP 192:sxRsrC6/fRsbg2Z3zoA8p4l/g6+WNIYEhoOwniKaGFIgDFAJ:sxRse6/fRsbgAew/5ICOvoq
TLSH
T1F042B715AD28A97B9CC7E21DFA55BF53D3F95032A1905E48BBFC861C04EB6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 30697211711b07e2da784f0a3034225de7deb2c2c2b3f10b64aee52b3a0ccf70
MD5 ea5fb11b0e58118fe4a2717d6e80e797
SHA1 ff50544499d1aa4b39d1a3fde2d890d7bb6c99a6
SHA512 4d031ae6838d9571c0d6eaa34fe2958ada11fcb90d7a210eae9e4062f7273ad43c466195405d2156d8321e9be23ebc4f176851a44428379277d50e3209a19eb8
SSDEEP 192:sxRsrC6/fRsbl2Z3zoA8p4l/g6+WNIYE/kOwniKaGFIgDHAJ:sxRse6/fRsblAew/5IwOvo4
TLSH
T1AE42C715AD28A97B9CC7E21DFA55BF53D3FD5032A1905E48BBFC861C04EA6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 95b990043a407c9e81ddd8d42bf8ea052e5b100234509da3dd2d83396931589e
MD5 6c78f36cc75e8aca02de1c8ae9904521
SHA1 d74b509178feeb9e8ea892568e86906b6ac33c51
SHA512 c9e53e5515cb772328fe4daf896e4080793549ea3e8df05ee305bcbf255d0f10ec48ed7162aab322216c671789ed1e1bbcf0cc1c081b88c7c2912da336754d02
SSDEEP 768:0UQilW7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3h2OVqjronR6j:0UQil2E7PaWgH7feQu1jakh2IqQE
TLSH
T1BFD2DB7B640DCB7F4F804ADDEC197E9A6DA802CB9698CD8047FA845C03C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4b2fd11-fc5e-4a3a-8ded-d9e8c6c664ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b4b2fd11-fc5e-4a3a-8ded-d9e8c6c664ca.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8020b03ad96fe44dab519fc333d2cfd2ccb6e36291a015880060912f00fca5a7
MD5 e9f5e154f06e2fc3d224c11f935b178c
SHA1 a9640153a9e50eb05784d8c97ce4571f46e294ec
SHA512 c7a201aab2a9256885b3e18fadcd0e66c43a835ec04767c9d8d98dae6a80ab3c923aa2295bd92440ffc2afbf55ab1183c506a8800392b17cf8d433c400fd6f9a
SSDEEP 384:n/ZcId38N5dfqG+IUAPp3f79IFs/FUi0BSR48CghlmoeByl9vsRRxoGzjKGa8xzT:Xd3EqGE4DV8K48dHeByERRFzjK3YzfB5
TLSH
T185F2AEB06CA49DB34CEAD28EB643775BFFF0412386C85A2491DD9B0E448269D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7eb5fd0936949ddfa3aa10683e0209a2a8b24d3273887ae1fc525c9b3e127241
MD5 e2b3522fafe11630b127125c1df95096
SHA1 9b837db5548fd7a7576a5eff5ae1cd39ffe8115a
SHA512 9231ac6f514fb6e01c3dec5baf432a54e906f46a7a81a71275078f31c266607f0db2c0b3417265b4a9f7c29d3a338f45c551fdb05aedce3de295c0381d92bc78
SSDEEP 768:Qrv+4UNbdf3xqGxiDrK48dHeByERRFzjK3YVeVH1SCj:QbsbJ3UGEe48dHSyw/DEH1Z
TLSH
T15903CF71A9A85E734CE7D2897683B61BBEF4421386C41BA4C1DD6F0E85870DD130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fb752d8891a8115c21aa1a9ccbeab819c436a1da5b4e0969540d3736f875543f
MD5 bed5652affd87941f65137fd284eea7e
SHA1 0acaf2a8781cb7cfd81161df4589c275043b8e39
SHA512 7bc3f11559a4e4db80e0ed438b86683a666fbefec746911054fae8cf955e7302b5e1a536625f3497d9e1184a77aa2d0a853a7d5582dcb306d78bdef1e785a6cc
SSDEEP 768:FFQU3AwgbqGEUDsK48dHeByERRFzjK3YzfB5:kU3TGB48dHSyw/dfB5
TLSH
T178037DB19CA4DE776CEBD3CAB742764BEEE0416386DC9994D5C89E0D00831DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 94b63524e2fe784ecf2aa3fa56640493597d735746c7f2a3c68da0964bc1dd08
MD5 448cac6612719f80fb1c2efe4bb6ad9e
SHA1 0e7b6e5a6da8afdf5d2e920c4ced7dae9dbe3c36
SHA512 1248fb4df1307ac0f30c7f79a9b6431d064e43dd9d5a07b0b6e94072bc1da4715f616a175bb2c82af8aaf4b9e7db3a1de197d4c497a5ec23e0c81dcb29005727
SSDEEP 768:Erv+4UNbdf3lqGt4DVrK48dHeByERRFzjK3YzeVH1SCX:Ebsbp3AG6448dHSyw/dEH11
TLSH
T17E13CF70AC689E734CEBD28AB583775BBFF4411385C40B64D1D99E0E458619D170BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f436869e969f76bfcd4068323e15bc255ab4e5dd6cc82ea9aafe97986abca8b7
MD5 bc20b935a1a8dc5f6989b930da256295
SHA1 0d077cbf3e147118af10fefb00684c3cdad7779c
SHA512 91dd71fff865805ed318e122a7c46fc6e68bfcbb49511c97dcd3cc15245948ecb0ab43bd78967a42b87331639fb190f7b04b5b452876e1c43d870e7abd1d4aa5
SSDEEP 768:Yrv+4UNbdf3wqGviDVfK48dHeByERRFzjK3JzeVH1SCj:YbsbJ3RGqM48dHSyw/yEH1Z
TLSH
T1A403CFB0A8689E734CE7928A7583B75BBFF4422385C40B64C5D99F0E85861DD170BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 a81ba51e8f9236921e6e133da0af4d2f96c137955403fe15d5ec40f20f197192
MD5 976081122024a42d1cadeaab9cfb505d
SHA1 526e540c91b6f28af9a85851bda750af858f03f5
SHA512 55163466b626115431b53f3de5f0384f1b50b53778a8f3e5514cdc69b77c54821fb087925428be60ddd586a86d31597176f5ba784a29319e17fe145c119a0c45
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3n:CebAjOKn3wRKRJ3n
TLSH
T1D5D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.old_1787192632

Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_c51b2388ab7b3fc7ea63e8d94912c3d4_akira_glassworm_rusty-stealer.old_1787192632
Size 2.7MB
SHA256 96e54de99be3af9c25ce27c93ee6f528c2190a9f1d2d5b74a9ec815a7873a560
MD5 65c6559c8965e52874dac6a01d4960c6
SHA1 d0d73c747c66b28313619fc87888ddffe5678a6b
SHA512 5dae11d0cae9d971665df32cf659e9dc55147829a88f82b0b2ad802013ad26f10be1f72cf4b14b75ed2f520a77a7180aa2962bbb99e01b4ba460dd910751515d
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3T:CebAjOKn3wRKRJ3T
TLSH
T1A9D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4976_1547714193\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4372-307-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-330-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-285-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-263-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-254-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-264-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-317-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-223-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-187-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-347-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-353-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-355-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-363-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download

memory/4372-244-0x00007FF7132F0000-0x00007FF7135B1000-memory.dmp

Download