24c7d44d023f37d41df67fbe494e16769190ceab2d426ff5fe662f49bfb5d373

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260822-ephbnaeq2s
SHA256 24c7d44d023f37d41df67fbe494e16769190ceab2d426ff5fe662f49bfb5d373
MD5 6d044dad9af8969b2d95e58104ba20d4
SHA1 b55ae00d99648cf2288ed09a649b4ce55fc0249a
SHA512 3dfe9060cbd2f255f8e80452ccff36fded6431b966003dbafeef5e6ca8bec110b7af2a8268b37792f4146a6a15a9c06d7b7e4955b7c4fc5143229a29881e0af2
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ31:CebAjOKn3wRKRJ31
TLSH
T13AD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3880	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_191147993\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_467180273\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_256811581\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3880_1994468258\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1868943811\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_256811581\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1868943811\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1868943811\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_467180273\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_960091948\_locales\kn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318452179466491"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{CE8C7D2D-7345-48B5-A2D8-57AED0E607B0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4880	wmic.exe
4880	wmic.exe
4880	wmic.exe
4880	wmic.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3376	2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4880	wmic.exe
Token: SeSecurityPrivilege	4880	wmic.exe
Token: SeTakeOwnershipPrivilege	4880	wmic.exe
Token: SeLoadDriverPrivilege	4880	wmic.exe
Token: SeSystemProfilePrivilege	4880	wmic.exe
Token: SeSystemtimePrivilege	4880	wmic.exe
Token: SeProfSingleProcessPrivilege	4880	wmic.exe
Token: SeIncBasePriorityPrivilege	4880	wmic.exe
Token: SeCreatePagefilePrivilege	4880	wmic.exe
Token: SeBackupPrivilege	4880	wmic.exe
Token: SeRestorePrivilege	4880	wmic.exe
Token: SeShutdownPrivilege	4880	wmic.exe
Token: SeDebugPrivilege	4880	wmic.exe
Token: SeSystemEnvironmentPrivilege	4880	wmic.exe
Token: SeRemoteShutdownPrivilege	4880	wmic.exe
Token: SeUndockPrivilege	4880	wmic.exe
Token: SeManageVolumePrivilege	4880	wmic.exe
Token: 33	4880	wmic.exe
Token: 34	4880	wmic.exe
Token: 35	4880	wmic.exe
Token: 36	4880	wmic.exe
Token: SeIncreaseQuotaPrivilege	4880	wmic.exe
Token: SeSecurityPrivilege	4880	wmic.exe
Token: SeTakeOwnershipPrivilege	4880	wmic.exe
Token: SeLoadDriverPrivilege	4880	wmic.exe
Token: SeSystemProfilePrivilege	4880	wmic.exe
Token: SeSystemtimePrivilege	4880	wmic.exe
Token: SeProfSingleProcessPrivilege	4880	wmic.exe
Token: SeIncBasePriorityPrivilege	4880	wmic.exe
Token: SeCreatePagefilePrivilege	4880	wmic.exe
Token: SeBackupPrivilege	4880	wmic.exe
Token: SeRestorePrivilege	4880	wmic.exe
Token: SeShutdownPrivilege	4880	wmic.exe
Token: SeDebugPrivilege	4880	wmic.exe
Token: SeSystemEnvironmentPrivilege	4880	wmic.exe
Token: SeRemoteShutdownPrivilege	4880	wmic.exe
Token: SeUndockPrivilege	4880	wmic.exe
Token: SeManageVolumePrivilege	4880	wmic.exe
Token: 33	4880	wmic.exe
Token: 34	4880	wmic.exe
Token: 35	4880	wmic.exe
Token: 36	4880	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3880	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4252	3376	2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe	90
PID 3376 wrote to memory of 3880	3376	2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe	92
PID 3880 wrote to memory of 2544	3880	msedge.exe	93
PID 3880 wrote to memory of 7092	3880	msedge.exe	95
PID 3880 wrote to memory of 3360	3880	msedge.exe	96
PID 3880 wrote to memory of 7092	3880	msedge.exe	95
PID 3880 wrote to memory of 7092	3880	msedge.exe	95
PID 3880 wrote to memory of 6568	3880	msedge.exe	97
PID 3880 wrote to memory of 6568	3880	msedge.exe	97
PID 3880 wrote to memory of 2160	3880	msedge.exe	98
PID 3880 wrote to memory of 1212	3880	msedge.exe	99
PID 3880 wrote to memory of 2160	3880	msedge.exe	98
PID 3880 wrote to memory of 2160	3880	msedge.exe	98
PID 3880 wrote to memory of 1212	3880	msedge.exe	99
PID 3880 wrote to memory of 1212	3880	msedge.exe	99
PID 3880 wrote to memory of 5752	3880	msedge.exe	100
PID 3880 wrote to memory of 5752	3880	msedge.exe	100
PID 3880 wrote to memory of 5752	3880	msedge.exe	100
PID 3880 wrote to memory of 1564	3880	msedge.exe	101
PID 3880 wrote to memory of 1564	3880	msedge.exe	101
PID 3880 wrote to memory of 1564	3880	msedge.exe	101
PID 3880 wrote to memory of 7096	3880	msedge.exe	102
PID 3880 wrote to memory of 7096	3880	msedge.exe	102
PID 3880 wrote to memory of 1308	3880	msedge.exe	103
PID 3880 wrote to memory of 1308	3880	msedge.exe	103
PID 3880 wrote to memory of 2196	3880	msedge.exe	105
PID 3376 wrote to memory of 4880	3376	2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe	109
PID 3880 wrote to memory of 2388	3880	msedge.exe	113
PID 3880 wrote to memory of 4992	3880	msedge.exe	114
PID 3880 wrote to memory of 4784	3880	msedge.exe	115
PID 3880 wrote to memory of 3928	3880	msedge.exe	116
PID 3880 wrote to memory of 3928	3880	msedge.exe	116
PID 3880 wrote to memory of 4348	3880	msedge.exe	117
PID 3880 wrote to memory of 4348	3880	msedge.exe	117
PID 3376 wrote to memory of 2596	3376	2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe	118
PID 3880 wrote to memory of 7112	3880	msedge.exe	120
PID 3880 wrote to memory of 7112	3880	msedge.exe	120
PID 3880 wrote to memory of 5796	3880	msedge.exe	123
PID 3880 wrote to memory of 5796	3880	msedge.exe	123
PID 3880 wrote to memory of 6264	3880	msedge.exe	124
PID 3880 wrote to memory of 6264	3880	msedge.exe	124
PID 3880 wrote to memory of 1344	3880	msedge.exe	125
PID 3880 wrote to memory of 1344	3880	msedge.exe	125
PID 3376 wrote to memory of 3924	3376	2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe	126
PID 3880 wrote to memory of 3144	3880	msedge.exe	128
PID 3880 wrote to memory of 6352	3880	msedge.exe	129
PID 3880 wrote to memory of 6352	3880	msedge.exe	129

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2596	attrib.exe
3924	attrib.exe
4252	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.old_1787371613
  2⤵
  - Views/modifies file attributes
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffd3eadc188,0x7ffd3eadc194,0x7ffd3eadc1a0
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,13039645927204208465,2171053704230372611,262144 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,6723363811948710664,2306146877102996339,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,9472516269373636407,13403627408560363928,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3240,i,16288622758744556076,5907202493809251050,2097152 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,17743491945441192259,14866182305548404797,2097152 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5100,i,11027690875707520608,5242729975510114148,2097152 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:9
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5320,i,806239477484100234,4696482236940200589,2097152 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:15
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16986957866681732120,16794598272024807107,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
    3⤵
    PID:7096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,9597966573019329306,4363865152963107086,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6418050545728491436,4816337875701145087,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6418050545728491436,4816337875701145087,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,6040194258447951387,6199344846892644620,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,15414995274297851470,17429884136020882577,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,4048759481962173597,1398938405144463126,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,15166505011582865085,9307505885320887726,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2968,i,17698230497719888829,17025534911044384905,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,3061759710203831602,11799510151702681077,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,2775318247957521840,14375508657784389729,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,17610284959675340064,16590756102539678074,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
    3⤵
    PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,15138546654142113567,11751482497748986625,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,18060508469438661183,8562457282304390781,262144 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,8889817703884662152,1430358451968108191,524288 --field-trial-handle=2312,i,17369081639594427289,4402428074723405267,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:14
    3⤵
    PID:6352
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.old_1787371674
  2⤵
  - Views/modifies file attributes
  PID:2596
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.old_1787371734
  2⤵
  - Views/modifies file attributes
  PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b2bf9cd5e5a26b7e044f9558d51d1e289f4057283db79c79aad1da17371ef4bd
MD5 c1ad7716468ee698979a7dec2dddcbbf
SHA1 0d9bdb023d46fd422ee6c4a29f65d4ef995e4e9c
SHA512 8ab5774fac821a3f53cb49367fb995b04aea7f1c645cc9760cbe095f1a77b9f939686c96db0d2590cc4136fd6b36106a8095cbc85ca0d86d8cd5bdb369af4e93
TLSH
T1E4E0EDA9C960B82719FC1B18A1540687EB40239B3A518A4B3B3C822D8FB473B438AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f291c90118e7053f3a0c735a0eae449461fb8dc26dc36729be6775a7dec72a48
MD5 5af54c966ab44c6a65b9afb1f7685b0f
SHA1 c54dda523fa973a4c25a3f4870cec52d955089f4
SHA512 7d6a1ac04b06a37cad22b46637ee11bc1cb29a5917301ee809f8eccf74f4474a8315c79fe3fec67b2c929a4cfe76001581e30beae62296706bb037380c69220a
TLSH
T1B16170D0432F1AF1E7A143B53DFD8B49363498BA620F5EA2C844D23358E232923B2860
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ecb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ecb8.TMP
Size 3KB
SHA256 7c7323068823ad3b59a2c108e8b600952815ad926e044f6a72577a97e89a3a85
MD5 6f0296c1da19fa01be2dc3d7f32c0051
SHA1 1afaf973ce3cdf737b98b347aad7c9aafbb91f6b
SHA512 131b2a53430ee98e3b2964bc3903cadd173a30f657770c43ef1513f6b96ac149d0a4c93b2016d835c9cad71ec048ffddc5e234861c69e91d5c3a25ad29383203
TLSH
T17F615FE0432F1AF1E3A447B53DFD8B89767498BD620F5EA1C854D17758E632823B2860
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf2b44a8353792324b684d1d485f2ee612fa0f103c487592f0fe952716d48859
MD5 b516e659b54131be5cae9cf8b02815d3
SHA1 c2aab4ca2e8bb5c4463daf09ee2287f72c5e78df
SHA512 48858f3b0669b2b34078088da15102cdc6a1091755c8d8509173c4d42119572db1d1bc74ba089dbcd2911320b4616d88850f157e7749575829007454cbe707e6
TLSH
T19041DEF783F4856ECA0195F0AA186E2FCE2D0515432C7D9AC9E4AE1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6cfcfe2bf8b938cb92227075b7623144184649a2ed27c49f27397f0b8c38233b
MD5 870af2639e95b7c09995788744ba02c9
SHA1 9257a62ddff1f3ee39167f95990eead2220f4d00
SHA512 39ea2ebf612ba89a712be13920df1a785f6e210851e0c2f7f397498815ecc53cc22faab8c2d4598310e82d60870864a9ef32afea054beb5871841e7d004aca4d
SSDEEP 384:sxRv+81/fusmAzN/RI0l8/5IW4MOcsGQcjb:sLD1/f3ZW1/5IW4+sGQm
TLSH
T1D272D8156A34997BCCCBD219FA957F93D7FD1173A1505E44AAFC8A0C04EAAED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0c6bb8d8654038c65387d98babf764e8f21716e9dc59ad518d2cfa6d0f51a7dc
MD5 07829d929670bdbd7f8827c301099359
SHA1 329f8b4175c00c79b97f25ef2799b7b419a030af
SHA512 dc419bf5ba791b8bdfc27e158c1ebf5b214b71184ad100791911c2c217eb8add13e4c8feb223a6fed40685e56040d928e9972aadfc32048f0a7cda765b155311
SSDEEP 384:sxRv+q61/fusAAHN/RI0l8/5IW42OssGQc02:sLB61/fdtW1/5IW4ksGQ0
TLSH
T1C772D815AA349977DCDBE219FA857F93D3FD1173A1505E44AAFC8A0C00EA6ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 872395ee87650a64cf8ab6c563cee15668e692c78e0fc350ba94f96a0bf18a92
MD5 a04bdfd34b2fca1a3abf7d17fbf0cfc6
SHA1 904cc7f9b7c4cbfcdb27ffab2dd4f17ab39c784a
SHA512 77bad33bcdbda128925ef4ba7b3ade132238ccf29371a2ae7ec42310cb30feff37a6ba4045b128d1618deeb09971f058445e2f176f3e1135f76975b13e2ced38
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYobbDwzroB4xS:Ob4YZnE7yTWg1NfwBu1jaHobHwA2xS
TLSH
T148E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b60f7312b1ad5ebaaffd16460c875d1fcbc894a0e0b06c25dc222e2268471f75
MD5 0197d776d681224ed6c02438b7796e83
SHA1 2f5d0b56eebe4270229582c858aaea36dbbb2646
SHA512 7fe2d3a347bcddc56837b1a76554f55c234dc31065ee839ceea643576ccb7f45f68cd96d640e97b28d39e6f53e852fc58b4006fd04ab374894ff8412d7148052
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9ftw:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRr
TLSH
T16CB25C11753F4680383EA90C91B8981F96C2B4637519E53F7BA802A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1b3045ab18061a5e94e40faa61c2b6edb767dcc6132866f2b18f917d1bceccda
MD5 8630790f6d767d301fca0ce8b523f911
SHA1 24906fc7a6b9cc949a026fbebd8c81cf1bf6ccd4
SHA512 66f0d7ba68c622c3052e7ac7cc4481c51e0abac7ac42f19dc1d1b383545ca13578776e27fb16f788511c8313620dd5d0e3405cd6d726ef642778b16f744e7d75
SSDEEP 384:nSliF1tNn/s3n9SB8NLC8TUNTUlIRFPvuT9oPEqfbGGj6P57ClAcaTey2vbkF4OE:SsF1j+94QCwgbuyYGmLTey5+29Mn
TLSH
T138D25C32E865CE77ECEB4E99B74A7696EEE41263848C5DD8E6D85D0C008B2DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 84b9c548be8eea78c78ac898083dce32cf1b5ada66cebbdabcfd758afbdb524e
MD5 64a05e20a6059fddd17a2aa7f1ae5ac0
SHA1 57b523fb22c15ef41edc522fbb31fe1cb492de25
SHA512 1f117b3def84f26d73de5b2a871175189522087e37d037acbddd0517362b3387555e46eb88ab6acfee23141b15f8ed093f00823ddc1f66686d8c2d22c5a393f7
SSDEEP 384:ntliFiZcIS8NLC8TUNTUlIR3PvuT7oPEqfbGGj6P57ClAcaTey2vbOF4brWR8LEw:tsFQSQCwg1uAYGmLTeyl+b6ho
TLSH
T126C25C31DCA4CDB7ACFB8E99A64A7687DEF41163D58C89D4D6C85D0D008B2EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e657f410432074a3849d535aa1aa6c473ccbccfd4ce310070f541887eb455810
MD5 358e23efedde2ae8af34cea7620764b2
SHA1 804d93693214d82a4a94a8ee8c6393496e0ecfca
SHA512 c561b1ada3ec6d90746e30ed50a255cb8d7e5c04471ee0ae9b68d8161be1c322db59c371acd7f2589ab48d29f58f83249f25a22a6858c1048c02c1f6ced0dd56
SSDEEP 384:n7iF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTuiREqfbGGj6P57ClAcaTZLFzOObjI9N:WF1j+9SXmwgUubqGmLT1l29MW
TLSH
T1C1C26C36EC69CEB7EDE64F99B74A3A46EEE00267849C59D8DAD85E0C00C72DD0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6329716ece862394ac473427d098fde4870fa398a62824ffa4e308a990c4b396
MD5 9dd90662383ea0b4382b9da4dd9086d5
SHA1 3064fbdda44b444a5ceaff5f15fd595434ac913f
SHA512 9fd8823aa3b25dc7661f3b0cc00034eed2be6d26e416d6db1d333b74f78def46792fe3b3f47686d055ba11d6061eae3534d04d3987e2d68a88f6cf8111e6cc17
SSDEEP 384:nSliFiZcIS8NLC8TUNTUlIR3PvuT7oPEqfbGGj6P57ClAcaTey2vbOF4brWR8LEw:SsFQSQCwg1uAYGmLTeyl+b6ho
TLSH
T11DC25C31DCA4CDB7ACFB8E99A64A7687DEF41163D58C89D4D6C85D0D008B2EE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6319cff10fef759b626a1b68b333ec78d1bb13cbce62001e1c92495294d9b01c
MD5 7499e28000b76db19be94597e0f00d83
SHA1 9163d13a0a7899fbbc92317b45135660c808565a
SHA512 17949a062ed20c2f7e5ebf2cf99b3c72ee52ff8be247ed94dc98406d87b8a15ce024359365a8c1913d0db323b2438c41bf270253f512ce314b7eec64ceedbf65
SSDEEP 384:nciF1tNn/s3n9Sn8NgC8TUNTUlIRiPvuTcXPEqfbGGj6P57ClAcaTey2vbkF4OOG:HF1j+9SXCwgUuAYGmLTey5+29MW
TLSH
T1DBD25D32E859CE77ECEB4E99B74A7686EEE41273848C5DD8E6D85D0C008B2DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8f718aaf689ab527cc734e1c065311a995a65d836be0802a11bc89667c91ba6e
MD5 ef7e492890b73242d3d97c15c0ecd465
SHA1 237f16159fe67c192af0a1655d9e841abc9b179d
SHA512 5d0b1eaad39a88419ff59b0ca0d1ec26ac0b80098f0b6ddecd81d7f81af18c6da649418664122d9eef93fe97cce2d8f4865c7c2521c784fa6caeb838adf54a78
SSDEEP 384:nt8iFiZcIS8NLC8TUNTUlIR3PvuT7oPEqfbGGj6P57ClAcaTey2v22F4brWR8LEw:tnFQSQCwg1uAYGmLTey2+b6ho
TLSH
T1D7C25D31DCA4DDB7ACFB8E99A64A7687EEF41163D48C89D4D6D85D0D008B2ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fe9a30d8e70ff4d47591d4df868f40b88437abe8ad4e3877de6cce1008382b7c
MD5 56526ca66de8cbbb9f3f9a9e75c5aeb7
SHA1 fee8fb56f16fa9e99455f4e396b3ea0909f026da
SHA512 a550c2e28462a67fec3a1f22963d3240db53c0df7212cf046554e277aa41a7674098e541751513150e64b1fb40492419a5b3aaf3a5a2b91adbe76d1f7cd1ccf4
TLSH
T1284130E04C381AD1D4BD0E7EB48B39FC85EC9726F894343C2858EA589A7A61D348083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 633d78a31bbb2f757c524fcd0b11008c7eaefc048e0080f3d9a5fb626c1d4cff
MD5 7bc47fa18577594aa2088112894c142b
SHA1 fea60c973631007cd9c7f5443819d2a5d559cd1c
SHA512 5382468a242e88e053f498cb3627032d9fd6f51ec8a03fd589645342e0f816d621e2b83abc199edd0599b82d50bd087f625b9883fef6992529b12f93389d88e1
TLSH
T1FB4130E04C381AD1D4BE0E7FB08B39FC91EC9725F8A4343C6898E958997E20D208083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a78ef7ae51a85d0a6483ff867fa06e6313ec5f126a3c4ff970e5faf023430bcf
MD5 b3abfd662e741c0bdcf7f2eb77637e3b
SHA1 9eb67617dba47d661e4ed05a340d7f711e0ab0d8
SHA512 1dab32f85494cf7e4c8deed3946b05393f725e9852b16caf5c59de46caa8ded300140ee2e8918cfe564efb1a3a929e41d2dd841b19eb0a29de81c5c71c441228
TLSH
T1374130E04C3826D1D4BD0E3EB08B39FC84EC9726F894343C6859E9589A7E60D349083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3d788a59a605ed17c95f085f708aadbdf3662050312a9957d1725de4ed769a31
MD5 7c787dcd8d1442a60633e89535fb1d95
SHA1 afb2516a430e532e24662779c7d22da32506bfa8
SHA512 1937b5f8c0a84b4f4cb597c25ce4e54a783c7a1497deddfee07130a9a99c71a5f5c0b3d9add69c95b1dedfc6058aba8f036a3649042a9b80b4e6a62bca913577
TLSH
T155412DE04C381AC1D4BD0E7FB44B39FC84E8D726F890347D6858EA985A7A65D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 45004930da823fae3f8afb5e631355faa60d7e7e942b20e89d20563a961fe0f2
MD5 34e218ae0aabbbbfad32d71528678718
SHA1 a433f67daee8131abc5699ebfeffa6b02d6ce378
SHA512 ebc45944a8f1f67df5d87132f725dfeefbaac0133afcd90d6fe715e2fe28a5c43570df221d9d130ab152999b361a265d8a5a2a965a3929a70173228b81d58d9c
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3U:CebAjOKn3wRKRJ3U
TLSH
T13BD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.old_1787371674

Path C:\Users\Admin\AppData\Local\Temp\2026-08-22_6d044dad9af8969b2d95e58104ba20d4_akira_glassworm_rusty-stealer.old_1787371674
Size 2.7MB
SHA256 62789c606a53d20c840005ab49aabb97b4df9c75bd203549f25cbd6359474f06
MD5 edcc0c244294e898df9a0d9773758961
SHA1 97122aacc702d8874562ac52ad1765bba8638932
SHA512 84f4d5d5efac3537647050aeb474d91b2e4deafc70621a25806082bbf073355eefdce5f715677ae35a5786fb5792f76ac6d00798b38f52a497082b2d6f3ccf07
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3e:CebAjOKn3wRKRJ3e
TLSH
T1B5D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2196-172-0x0000019292810000-0x0000019292A51000-memory.dmp

Download

memory/3376-550-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-599-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-475-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-518-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-533-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-200-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-564-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-436-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-504-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-466-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-583-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-156-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-190-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download

memory/3376-467-0x00007FF61B740000-0x00007FF61BA01000-memory.dmp

Download