371eba64025dc32519917a3f1b0e93f312f7d12a4af601c1e2a2cb6b39db2da3

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260822-d3anasvvfx
SHA256 371eba64025dc32519917a3f1b0e93f312f7d12a4af601c1e2a2cb6b39db2da3
MD5 c87420fa7162563b5f7399fd31143371
SHA1 685a5b7a3afe4b5cb6b2aceff7d67900ab59715e
SHA512 3f62c841d784498f8d1d9f65666aa44ef0393530104d2aab7b7c840f1f2ef4ab12f3fec97cefe04b8f88882d5214c592604f3432a7e3a097bb960ed0842ffd0e
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3G:CebAjOKn3wRKRJ3G
TLSH
T10FD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6704	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6704_1479743127\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1101255380\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1101255380\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1101255380\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1101255380\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_2104592732\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_2104592732\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6704_1328481386\_locales\zh_CN\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318430989406663"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{A87FAF8E-B246-4F6C-8E82-6C9EBBE63FBA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3428	wmic.exe
3428	wmic.exe
3428	wmic.exe
3428	wmic.exe
1300	msedge.exe
1300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6704	msedge.exe
6704	msedge.exe
6704	msedge.exe
6704	msedge.exe
6704	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4420	2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3428	wmic.exe
Token: SeSecurityPrivilege	3428	wmic.exe
Token: SeTakeOwnershipPrivilege	3428	wmic.exe
Token: SeLoadDriverPrivilege	3428	wmic.exe
Token: SeSystemProfilePrivilege	3428	wmic.exe
Token: SeSystemtimePrivilege	3428	wmic.exe
Token: SeProfSingleProcessPrivilege	3428	wmic.exe
Token: SeIncBasePriorityPrivilege	3428	wmic.exe
Token: SeCreatePagefilePrivilege	3428	wmic.exe
Token: SeBackupPrivilege	3428	wmic.exe
Token: SeRestorePrivilege	3428	wmic.exe
Token: SeShutdownPrivilege	3428	wmic.exe
Token: SeDebugPrivilege	3428	wmic.exe
Token: SeSystemEnvironmentPrivilege	3428	wmic.exe
Token: SeRemoteShutdownPrivilege	3428	wmic.exe
Token: SeUndockPrivilege	3428	wmic.exe
Token: SeManageVolumePrivilege	3428	wmic.exe
Token: 33	3428	wmic.exe
Token: 34	3428	wmic.exe
Token: 35	3428	wmic.exe
Token: 36	3428	wmic.exe
Token: SeIncreaseQuotaPrivilege	3428	wmic.exe
Token: SeSecurityPrivilege	3428	wmic.exe
Token: SeTakeOwnershipPrivilege	3428	wmic.exe
Token: SeLoadDriverPrivilege	3428	wmic.exe
Token: SeSystemProfilePrivilege	3428	wmic.exe
Token: SeSystemtimePrivilege	3428	wmic.exe
Token: SeProfSingleProcessPrivilege	3428	wmic.exe
Token: SeIncBasePriorityPrivilege	3428	wmic.exe
Token: SeCreatePagefilePrivilege	3428	wmic.exe
Token: SeBackupPrivilege	3428	wmic.exe
Token: SeRestorePrivilege	3428	wmic.exe
Token: SeShutdownPrivilege	3428	wmic.exe
Token: SeDebugPrivilege	3428	wmic.exe
Token: SeSystemEnvironmentPrivilege	3428	wmic.exe
Token: SeRemoteShutdownPrivilege	3428	wmic.exe
Token: SeUndockPrivilege	3428	wmic.exe
Token: SeManageVolumePrivilege	3428	wmic.exe
Token: 33	3428	wmic.exe
Token: 34	3428	wmic.exe
Token: 35	3428	wmic.exe
Token: 36	3428	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6704	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 5212	4420	2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe	90
PID 4420 wrote to memory of 6704	4420	2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe	92
PID 6704 wrote to memory of 6688	6704	msedge.exe	93
PID 6704 wrote to memory of 2300	6704	msedge.exe	94
PID 6704 wrote to memory of 1264	6704	msedge.exe	95
PID 6704 wrote to memory of 2300	6704	msedge.exe	94
PID 6704 wrote to memory of 2300	6704	msedge.exe	94
PID 6704 wrote to memory of 2852	6704	msedge.exe	96
PID 6704 wrote to memory of 2852	6704	msedge.exe	96
PID 6704 wrote to memory of 6516	6704	msedge.exe	98
PID 6704 wrote to memory of 2928	6704	msedge.exe	99
PID 6704 wrote to memory of 6516	6704	msedge.exe	98
PID 6704 wrote to memory of 6516	6704	msedge.exe	98
PID 6704 wrote to memory of 2928	6704	msedge.exe	99
PID 6704 wrote to memory of 2928	6704	msedge.exe	99
PID 6704 wrote to memory of 1552	6704	msedge.exe	100
PID 6704 wrote to memory of 1552	6704	msedge.exe	100
PID 6704 wrote to memory of 1552	6704	msedge.exe	100
PID 6704 wrote to memory of 6744	6704	msedge.exe	101
PID 6704 wrote to memory of 6744	6704	msedge.exe	101
PID 6704 wrote to memory of 6744	6704	msedge.exe	101
PID 6704 wrote to memory of 3956	6704	msedge.exe	102
PID 6704 wrote to memory of 3956	6704	msedge.exe	102
PID 6704 wrote to memory of 3232	6704	msedge.exe	103
PID 6704 wrote to memory of 3232	6704	msedge.exe	103
PID 6704 wrote to memory of 1064	6704	msedge.exe	105
PID 4420 wrote to memory of 3428	4420	2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe	108
PID 6704 wrote to memory of 6644	6704	msedge.exe	112
PID 6704 wrote to memory of 5352	6704	msedge.exe	113
PID 6704 wrote to memory of 3308	6704	msedge.exe	114
PID 6704 wrote to memory of 3540	6704	msedge.exe	115
PID 6704 wrote to memory of 3540	6704	msedge.exe	115
PID 6704 wrote to memory of 2424	6704	msedge.exe	116
PID 6704 wrote to memory of 2424	6704	msedge.exe	116
PID 4420 wrote to memory of 1992	4420	2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe	117
PID 6704 wrote to memory of 4248	6704	msedge.exe	119
PID 6704 wrote to memory of 4248	6704	msedge.exe	119
PID 6704 wrote to memory of 7152	6704	msedge.exe	122
PID 6704 wrote to memory of 7152	6704	msedge.exe	122
PID 6704 wrote to memory of 2812	6704	msedge.exe	123
PID 6704 wrote to memory of 2812	6704	msedge.exe	123
PID 6704 wrote to memory of 5376	6704	msedge.exe	124
PID 6704 wrote to memory of 5376	6704	msedge.exe	124
PID 4420 wrote to memory of 3540	4420	2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe	125
PID 6704 wrote to memory of 1300	6704	msedge.exe	127
PID 6704 wrote to memory of 6720	6704	msedge.exe	128
PID 6704 wrote to memory of 6720	6704	msedge.exe	128

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5212	attrib.exe
1992	attrib.exe
3540	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.old_1787369494
  2⤵
  - Views/modifies file attributes
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff96050c188,0x7ff96050c194,0x7ff96050c1a0
    3⤵
    PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,14986193284441268141,2773227649223439066,262144 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3145838765974615846,12225237896364294627,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,12659539653326344072,10374601760134186952,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5286009127101838185,4142425436389389036,2097152 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,18167212821125837316,1943067101542284548,2097152 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5068,i,11607728798264976945,1881615363468568206,2097152 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:9
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5316,i,11029554192833373287,3141819407482673996,2097152 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:15
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,1778203819662821418,17004106803223102672,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,4253783018819556369,16861847422217898270,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12600123937277732676,8514980511930145014,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12600123937277732676,8514980511930145014,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,16988666457653284229,8955695828708126778,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,17400330143510020335,8855264405746640607,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,8798667299477788316,16327755239563794809,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,15933912558612728390,17382905004176941256,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:14
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,16738017591373773195,17582540670548068342,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,3815163409607036555,12060845694047065846,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,6685351992294591995,166026276412935975,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,3350745603879089836,3355267758179533137,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,10433066377018430903,2350858523083240330,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6388,i,8729123533582273017,12776827199065837353,262144 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,17155486205709538854,17309555178613009921,524288 --field-trial-handle=2300,i,12671956596016794202,15625294564593151178,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
    3⤵
    PID:6720
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.old_1787369555
  2⤵
  - Views/modifies file attributes
  PID:1992
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.old_1787369615
  2⤵
  - Views/modifies file attributes
  PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 335121320ff8a1e1fa86e74a9154187c54d678e97bd063fe0e13b69df1cceea6
MD5 8b4bf8f0c1690c776632af409479276c
SHA1 328ac33f3e3b1e350bd1256b46debe018042b31f
SHA512 6abc291ff1d9c17ed4c82ba238099a2134de3184314a390d01ada50485c9919a36654511a00b6639f853900826dfba0d743f6955cd30b5bb051225c99b7e978f
TLSH
T1D2E022AAC925BC2719FC1B18A1540747FB40135B3B51884B3B3C822E8FB473B468AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 1f6d5de4685f4028a282aeb935d7e343156cfc8ade78d084b65156972f498224
MD5 4d0a13d524264ce09c22be0bf732d191
SHA1 2445b1d600a303b2591cec0d66f823fdcd39e800
SHA512 9bfaba66819016a090a1c14ba32380ec75ffb492a3999280fd66149e034b72be0b1c859fa6e5e98d0f0b5a5eb569b94cc7d95b49d04aaa700266efed01440ec4
TLSH
T1866151541F1059E2EB2246B6D1D314D937F6BFBF0707AE120C70AE78C816F98A8C1867
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597749.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597749.TMP
Size 3KB
SHA256 8931cf1f63f61517bff1c03d56e4828a87c39ca1ed790c4bd739babf2df276c4
MD5 47073c70f3564fe985f9e9cea5d2ae69
SHA1 3c3f3d13070f46533473e51991279b53399b1a4f
SHA512 a2350e069ca08e04114f07ed73a63c5793b2eacc8b8c9718ebe6aa3e6d352a405445269e95ddc56968ec4fe872260a3921335d1fd4154dbac71ca2cc650bf97a
TLSH
T1DF613D541F1159E2EB2648B2E1D314EA37F5BFBF07079A124C70AE78C856F94A8D1863
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c6e92d390b718f625e04c908ab5ed3157d0480e7cec0b577ba731cc6db2ffecc
MD5 358120e744f307de6bf65d6322b66245
SHA1 2d47f810ea8b8e6b36077c00be3516697ab4bc7a
SHA512 10d0f23a47c8cd0b0570edaeaf037797cad4b803c6ef38a8a772dfd068a319d22dd20dbd4b5441352ff15e79d99bdbf1a5b850b07b652098bde6fed981bbe607
TLSH
T1A341C0F783F4856E8A0195F0AA186E1BCE2C0515832C7D9AC9E0AE5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 37e9466555714c349d1e908c50364acf46acfcdfa23eb92c5a4626d4ead945fc
MD5 8ed9ddf772c89c7ac6762cfc5799aeac
SHA1 5fc9830ef4ab6f87a248e446a1a91a78ff5f0f66
SHA512 278598758c29cac72bbf0e250dc8af1f31085b4faa65e0c4699e4a07a790a80795eba27b1b5c5e61867d79377068edf139136b108c1bb5f1383def7775b5c5e2
SSDEEP 384:sxRSlqsf/f5svTL+N/RIvp4/5IW4qOVsGQ6HwR:se0sf/fUwWi/5IW4ZsGQ6s
TLSH
T1B572D815AA289D779CCBE219FA957F53D3FD5133A1551E44AAFC8A0C00EA6ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 51ef84af53003df8619f48471a0e1e96e8450b4e762200b4b7a2f1e1746e8a1c
MD5 af889dee95d001aaf06457f4e02f1adb
SHA1 9fc6c7f7c8ddec6580792b645844ed3895a79bc0
SHA512 7ead404877e8aa42690c4d2c6115c11316f197ad18b1666019e3d02437a1bbe2b942ec670b800b8bed72961936bdb5a2db29df9f18006451b06c78689d2761cf
SSDEEP 384:sxRSl8f/f5sATLSN/RIvp4/5IW4nOCsGQ6HjtD:seaf/fRcWi/5IW4HsGQ6F
TLSH
T13172D8156A389D7BDCCBD209FA567F93D6FD1133A1505E44AAFC8A0C04EA6ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4434b1c0e757b46af8ff7b530947c006b89bb8ec19e97eee63669abb6442fb50
MD5 6ff9e3e97e7423e9cef78aaaf8f37818
SHA1 74a9cd65396bd168a47840f0c9a0b4ebd1e47d0f
SHA512 799f80a9b390b3ebe5ab967aff918700ccabbc5fccc65d96f2eb9d74661a85183d173b779457bfe869ba357423cb7ccf802ac8bac75932d96ca22186e9163b2a
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroa4E:Ob4YZnE7yTWg1NfwBu1ja4obHwAlE
TLSH
T12FE2FB3B280CCB7E4F804ADDEC29BD9B6DA801CF5AD8C95447EA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c7032fa244450bb9d955dcde5ff63eb7a6a816c28c7c078a6fc46bc57015a48c
MD5 37c61ab2437014043fbbd7cd751cdfd7
SHA1 8aab96d24526dbea99c3266b9d7c9d0adb194e8e
SHA512 4f9e059714007ee268b21390b9ac803adbe7bc35581fc7fe41aba2c0fda1b37d3ee365ecc47cafb467c073471fc75283c8942a8e8bbc609486780f51db40559b
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9/5Q:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRD
TLSH
T193B25C51713F4680383EA50C91B8981E96C2B4A37119F52B7BAC06A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 886e9a21fa6d7c0e7117aadc242de429be74822297a4b3448b6f3d75d21a46d8
MD5 75726fc8737f90bb7fb3667f59aab3c8
SHA1 3bdaebd350557a0c310cc93888a352ff1a4a51b7
SHA512 9c8bd4525e5e3372388fe715e4c777b3b35c1f620eee78cfbc23b1fc47e867370a5dac6852e76f6978120e294dd879a4a37a0568797e339ac25625c285e172c3
SSDEEP 768:6FQaxQjwgzuBNGexe1lXDvNZoeMuiQuMSd:heQxuHe1lXDseiQdC
TLSH
T18AC25C319C94DD77ACEA8BC5A7497647EEF4416388CD9DD4D5D84E0C008B2EE1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2ba311388eceb7271c2692bd80ddc548a252c37c0974380c3db57db5e1a8d356
MD5 6ac9afcaaabf7dba48f88c2b7acb20c5
SHA1 df761c9196955c9ff911703eeaa6dcca2c6d1d94
SHA512 6d1657e11cba1410dbed8f896b723f45eb1974cb77eba66c7bb3cf16888ab82b814204c33317fc7eabfab05fe52a512d8bca3adfc3df8b6b6d44d1bac9743567
SSDEEP 768:fF1j+9SX6wgUuM6Gexe1lXDvNVFFTAV5X5i:W9SXbuve1lXDBFTkpi
TLSH
T11FC25C31AC55DABBEDE68FD9B70A7A06EFE0519384D85DD4DAD81E0C00C72AD0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5c3f7730ccb650b353c7f7c9fe19d1d3fedb83870f35d717e2ff4fb05e831b9a
MD5 a8e97537343067a5ca86531632602085
SHA1 f13d695eb16fd51827005c102e6e466ffa1cf35f
SHA512 1f0d061008286ad9521713257cf8cd44ca1f0f2d55d82336c96f7b418e63887c723bd8a970aca5f4ab0f51e339e9d2260d28fa8f75701a0abfb1766d81e8ca65
SSDEEP 768:UFQ7xQjwgzuBNGexe1lXDvNZoeauiQuMSd:3tQxuHe1lXDsqiQdC
TLSH
T1A3C25C319C94CDB7ACEA8BC5A7497647EEF4516388CD9DD4D5D84E0C008B2EE1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4afa805d0109c604732450f7eba30a98c38b9c29c645d9deaba4bb70baa6726e
MD5 b12c4624226a82b71ae50806e8c1af7f
SHA1 15fffcb6144b0a501fd5c0b0e5e724ab6d27f510
SHA512 a6c213fd9a7b9647ce7d89bca9016675dd3c68b27e86d28091bcbc05d3653bee01f738210f0208bbe9baa534ee860488d6adee76a17fbae6cd8d8e2c921281a1
SSDEEP 768:SF1j+9SXjwgUunNGexe1lXDvNZoeMuFTAV5X5i:n9SX6uJe1lXDsiFTkpi
TLSH
T1C1C26C31AC55CE77ECE68FD5B34A7A46EEE051A388C99DD4D6D85E4C00C72AD0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57f4d557780c940b21552656847397c20af808fe109637cf84ac9d3b7bc1c545
MD5 02a0e11175138e9444006c7ee31039cc
SHA1 b862d1a430b61b0738ed8ec4a46016b4c3b6ac74
SHA512 a10bd414056877e37ac56bee97185342d116ab3976c5d55c3ef7f78b4a5cac4a8208c4e19f12968cecf7303ad855a5626e5fb7c1c24ab67fc63f80dcaf32333e
SSDEEP 768:UF1j+99Qjwg6uiNGexe1lXDvNZoeMuiQu0:599QYuQe1lXDsiiQj
TLSH
T1ACC25B319C94DD77ACEA8BC9A70A7657EEE051A388CD5ED4D9D85D4C00CB2ED0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 119ba88fd2133e2f9a7617e6512f5a821120a9374dc2ee17f61b96dc64094528
MD5 64c4bac7465556d6f677e667535746d1
SHA1 a22dc2b43ead12d19533cb64566683f03f6f66d6
SHA512 1c7927f44d1f0104162e6926217b4fb1850a4e4be59aa72c8a462af7a54bafab2e6d92803e0820b2c9c6fce2c36b96a3d9e199d2ee2d8896516678a773176eaa
SSDEEP 768:wFQ7xQjwgzuBNGexe1lXDvNZoeauiQuMSd:jtQxuHe1lXDsqiQdC
TLSH
T113C25C319C94DDB7ACEA8BC5A7497647EEF4516388CD9ED4D5D84E0C008B2EE1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c79a0af5c7980899990b5a650050ab2dd34e18d0bc7b8cbaca2c5405b698826e
MD5 d5b69568d2c9f41d606b038a10a959d8
SHA1 271106fba04dbde8a5be712d103c636cd5c17738
SHA512 e4427219a07c44e3a89341ea345d44cc7efe3bfa9aa6f8c5b08b9dd133ea133661f5abd0a8579d26187ec785c1e80969ccb57bd504f9558f10b3b30834192fce
TLSH
T1CD3131E04C3D19D1D4BD0E7FB04725FC94D89226F89434386859E968963D61D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 004caaa21520df5124231909d0fcb3ce34b8499f4a23c1639b90c5aae94a17f5
MD5 9163faae5844d6e074a89c9d923d519b
SHA1 46c1227e4e137de9883d55e07f11326ad7f7bd98
SHA512 c0c6aa4a7b4abc7fb7fb64051fbcbd46a5462fd373d0cc57d70c41fa2a88b84f3356852aed80ad87cddb6cfc324d8314df79d41a97bbacd924df93263d1316e6
TLSH
T1973141E08C3D1AD2D4FE0D6FB44B25FC94E89322F89434386858E968963D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c11218753f132d91939a5e8edca5c3c375120fac07470da64f826a2130af10f2
MD5 60c4adf1c528f6f281ce6ec4116d8637
SHA1 87c09ebd2f8c768dc5cdc041926065b37efa63dc
SHA512 2f203c0bd0ab42df7b5280260ccfc47359624acb92303f546ec4fbc09c4152193c978151fe9a7168bfd46901bcff772df6ee3b5a0e2325ae311c528c0eb69119
TLSH
T1EB3121E04C3D19D2D4BE0E7FB48729FC94E89726F8A474386898E969967E61D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 88b3706ce4342b3aae7d2cae689c67c2cc08cc1a82142aa2d20765799b16782c
MD5 1cf92343660e419985e1ee9a56e1b79c
SHA1 105e58795c48de5277ec4c44cbb1ac8248156763
SHA512 0a854f9cbc87a8e3afc56c0a64009556539cf225c40fcd54fff94972acc71aa5f43478999b3a8fba3dbb98506752e8f292527efe7827ec2f4f4e3f232ed3ff50
TLSH
T1CE3121E08C391AC1D4BE0DAFB44B25FC94E89326F5D034386859ED68967D65E354087F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 34f251c225bb5e45d3f729c3c60b6dfe689702d5940422431a86eeb99aa487f0
MD5 74c64a15c4110be5cacace0e64c16467
SHA1 506ffe31bd7fea9ae008543b5217a2e9b82921ce
SHA512 47c01535abba5bfba9043cc9efe6a1b5410b7940530ce9493dee5d3d7a1096c8c646c9c084f1066f6e54659f47c5629088908e7c0e72979d4a6ce96f0caf349f
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3v:CebAjOKn3wRKRJ3v
TLSH
T16AD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.old_1787369555

Path C:\Users\Admin\AppData\Local\Temp\2026-08-22_c87420fa7162563b5f7399fd31143371_akira_glassworm_rusty-stealer.old_1787369555
Size 2.7MB
SHA256 c8b5e1f27bb7163969c6282585c1b201091b01a486906cba98c70cec645288c4
MD5 cdcc1449df6b53c8adae45692bf6d5de
SHA1 3d2b943815baaa3423d3fc2917eb581806f1cbb5
SHA512 cacfbd869a956c8eda4f050ccf5371bb601d85dfe6552ada8c8d64bbc72e9ad53ac6a2eeaadf69b427a38316f06df580fa177717acb5a5b1daf764b3cda331f9
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3Q:CebAjOKn3wRKRJ3Q
TLSH
T1F6D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4420-541-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-151-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-460-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-509-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-524-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-459-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-466-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-495-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-553-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-445-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-576-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-175-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-592-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download

memory/4420-193-0x00007FF7DEE20000-0x00007FF7DF0E1000-memory.dmp

Download