c0c2382f9f703f2aea6e64194331ebc2fd248d6b76ae7917babdf6b12f2b7df8

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260522-cvscpsfv41
SHA256 c0c2382f9f703f2aea6e64194331ebc2fd248d6b76ae7917babdf6b12f2b7df8
MD5 1549c9134cf149d95358b950b80a7828
SHA1 4a15ca8e6deff9adcf026cc80293bb47a37b0324
SHA512 d8d16f81e8c0bdf8569b7640ec8879c9745cc0a4e45e833a8a90dd733baa324e636e5e295223523cc6629babcb6744757fe57b204ffd409f3d6f2e5aa0fc4a6e
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3X:CebAjOKn3wRKRJ3X
TLSH
T189D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1619877379\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1619877379\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_363256643\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\Part-ES	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_363256643\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5692	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238902611332847"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{228C1BBC-AC04-4651-B110-6A5D4E5AB6DF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5036	2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3552	wmic.exe
Token: SeSecurityPrivilege	3552	wmic.exe
Token: SeTakeOwnershipPrivilege	3552	wmic.exe
Token: SeLoadDriverPrivilege	3552	wmic.exe
Token: SeSystemProfilePrivilege	3552	wmic.exe
Token: SeSystemtimePrivilege	3552	wmic.exe
Token: SeProfSingleProcessPrivilege	3552	wmic.exe
Token: SeIncBasePriorityPrivilege	3552	wmic.exe
Token: SeCreatePagefilePrivilege	3552	wmic.exe
Token: SeBackupPrivilege	3552	wmic.exe
Token: SeRestorePrivilege	3552	wmic.exe
Token: SeShutdownPrivilege	3552	wmic.exe
Token: SeDebugPrivilege	3552	wmic.exe
Token: SeSystemEnvironmentPrivilege	3552	wmic.exe
Token: SeRemoteShutdownPrivilege	3552	wmic.exe
Token: SeUndockPrivilege	3552	wmic.exe
Token: SeManageVolumePrivilege	3552	wmic.exe
Token: 33	3552	wmic.exe
Token: 34	3552	wmic.exe
Token: 35	3552	wmic.exe
Token: 36	3552	wmic.exe
Token: SeIncreaseQuotaPrivilege	3552	wmic.exe
Token: SeSecurityPrivilege	3552	wmic.exe
Token: SeTakeOwnershipPrivilege	3552	wmic.exe
Token: SeLoadDriverPrivilege	3552	wmic.exe
Token: SeSystemProfilePrivilege	3552	wmic.exe
Token: SeSystemtimePrivilege	3552	wmic.exe
Token: SeProfSingleProcessPrivilege	3552	wmic.exe
Token: SeIncBasePriorityPrivilege	3552	wmic.exe
Token: SeCreatePagefilePrivilege	3552	wmic.exe
Token: SeBackupPrivilege	3552	wmic.exe
Token: SeRestorePrivilege	3552	wmic.exe
Token: SeShutdownPrivilege	3552	wmic.exe
Token: SeDebugPrivilege	3552	wmic.exe
Token: SeSystemEnvironmentPrivilege	3552	wmic.exe
Token: SeRemoteShutdownPrivilege	3552	wmic.exe
Token: SeUndockPrivilege	3552	wmic.exe
Token: SeManageVolumePrivilege	3552	wmic.exe
Token: 33	3552	wmic.exe
Token: 34	3552	wmic.exe
Token: 35	3552	wmic.exe
Token: 36	3552	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5696	5036	2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe	80
PID 5036 wrote to memory of 4860	5036	2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe	82
PID 4860 wrote to memory of 4920	4860	msedge.exe	83
PID 4860 wrote to memory of 5692	4860	msedge.exe	84
PID 4860 wrote to memory of 5320	4860	msedge.exe	85
PID 4860 wrote to memory of 5320	4860	msedge.exe	85
PID 4860 wrote to memory of 5320	4860	msedge.exe	85
PID 4860 wrote to memory of 2244	4860	msedge.exe	86
PID 4860 wrote to memory of 2244	4860	msedge.exe	86
PID 4860 wrote to memory of 5212	4860	msedge.exe	88
PID 4860 wrote to memory of 5212	4860	msedge.exe	88
PID 4860 wrote to memory of 5212	4860	msedge.exe	88
PID 4860 wrote to memory of 5476	4860	msedge.exe	89
PID 4860 wrote to memory of 5476	4860	msedge.exe	89
PID 4860 wrote to memory of 5476	4860	msedge.exe	89
PID 4860 wrote to memory of 5060	4860	msedge.exe	91
PID 4860 wrote to memory of 5060	4860	msedge.exe	91
PID 4860 wrote to memory of 5060	4860	msedge.exe	91
PID 4860 wrote to memory of 5808	4860	msedge.exe	92
PID 4860 wrote to memory of 5808	4860	msedge.exe	92
PID 4860 wrote to memory of 5808	4860	msedge.exe	92
PID 4860 wrote to memory of 1936	4860	msedge.exe	93
PID 4860 wrote to memory of 5648	4860	msedge.exe	94
PID 4860 wrote to memory of 1936	4860	msedge.exe	93
PID 4860 wrote to memory of 5648	4860	msedge.exe	94
PID 4860 wrote to memory of 3700	4860	msedge.exe	95
PID 4860 wrote to memory of 5968	4860	msedge.exe	97
PID 3700 wrote to memory of 2824	3700	msedge.exe	98
PID 5036 wrote to memory of 3552	5036	2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe	101
PID 4860 wrote to memory of 5328	4860	msedge.exe	103
PID 4860 wrote to memory of 4040	4860	msedge.exe	104
PID 4860 wrote to memory of 4224	4860	msedge.exe	105
PID 5036 wrote to memory of 1652	5036	2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe	106
PID 4860 wrote to memory of 1328	4860	msedge.exe	108
PID 4860 wrote to memory of 1328	4860	msedge.exe	108
PID 4860 wrote to memory of 5172	4860	msedge.exe	111
PID 4860 wrote to memory of 5172	4860	msedge.exe	111
PID 4860 wrote to memory of 3640	4860	msedge.exe	112
PID 4860 wrote to memory of 3640	4860	msedge.exe	112
PID 5036 wrote to memory of 1836	5036	2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe	113
PID 4860 wrote to memory of 4696	4860	msedge.exe	115
PID 4860 wrote to memory of 4164	4860	msedge.exe	116
PID 4860 wrote to memory of 4164	4860	msedge.exe	116

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1836	attrib.exe
5696	attrib.exe
1652	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.old_1779416656
  2⤵
  - Views/modifies file attributes
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff976bac188,0x7ff976bac194,0x7ff976bac1a0
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,17070335302941820538,5281096496095518409,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6899275466956178970,1981772698904846019,262144 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,4248707270364656365,15706852568799453316,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12488819071330482160,10240441135488162897,2097152 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,9853417707540397776,8794608290776529783,2097152 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4848,i,14612378352693159446,13271915060204805165,2097152 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5124,i,5889230636033485749,11086494534653713742,2097152 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:15
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,1482459185795574005,8896304930577937097,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,8856828054409380893,5457856611181924570,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8013735938871603557,16071262301058794522,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16609875814581562010,10086113466731308189,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16609875814581562010,10086113466731308189,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,4311123373421245234,17707972442836126896,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,948418724554231540,8383899646188695037,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,5656894513655666385,14333567800553267851,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,5202208526723110050,672989611024266791,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12548625201994010479,13408388098749580273,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,190881542713921160,18033641364472695306,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6096,i,15984682552512265748,7332460622811156666,262144 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,17999577548001046845,6061142303495769179,524288 --field-trial-handle=2892,i,17244001247211804618,5787364135537958246,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:4164
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.old_1779416716
  2⤵
  - Views/modifies file attributes
  PID:1652
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.old_1779416776
  2⤵
  - Views/modifies file attributes
  PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a1e7b853f49ccd66412bbc5e5137d3940ce8bf02973c5b9e19dfa9fec96782ea
MD5 6ff31b33794133733228abdc28ebc339
SHA1 99a9b93cf7e43c360880d61d556095d1680bd0b1
SHA512 47bfdeb03a5e5c05f1d556dcc6d963df81e1b76764d7a6881526359990924fed94add0bda243a2aeb8e1f14ef50cb82143519d104a232d0bf16e2660bd6a7849
TLSH
T1BDF0F9B6CD21AC3B08FD1B6860A4574AE745175B2B91895B3B3C820D8FB063F464586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 27b2fd111f23d53ed342c1ceb3d1575a0240c69693499114a703a484692993da
MD5 00bdca95c8b76b4ce953bf9a9077b473
SHA1 dd568c8c7afabdf6e2c5a3761cdcc993257e2832
SHA512 330b6928abc294185bf7db33823700265f40d22190c82b2de8780003ff00c4526690e9661629859aadf9061671b84c0bc3a7150dd45f139b9b9ba1883a55c546
TLSH
T1AB510B1987C02BF3F7420634A9D0CB0D3BB07F5389428E4309585CB86F2AB99E70958D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d78.TMP
Size 2KB
SHA256 68a20b38946bbda9a8fd814c65812dc1523f284e0aa669853763e3accb20ba43
MD5 d24128b36ee5f291dbb81955ed5a4a32
SHA1 a0908c9a7fecd3ecf36df013cb548f7a36c02038
SHA512 6645441d7ee553637a86daa30039691cecb9f778f7e105c6b0462878e10f8f35ef18d0821054adecfdf468b9197c8f523b7bf30cf3e07d9a43432c7e61402a72
TLSH
T14051E91587C137F3F3020635A9D1DB0E7B61BF6389528E4309586CBC6F297A9D71948D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 65ddc271ef7debb66db3378320b9fb4435ae7ba7df6bdc63738a26a41f80f9d5
MD5 d669d77109d49c573ff5576ddf67c4c5
SHA1 6de9fca525e4ca0e7222944b97bbf40573ae4b50
SHA512 c5ab5cdc36a92810e85413c2bec3af0cb1031a8805cd687d19a67169b69a7abae194785e307a9a0c7672fd464d872251dbddee94d7866d9d30115c7921df6c78
TLSH
T1B641B1F7C3E4856DCA0195F0AA18BE2BCE2D0914432C3D9AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c1c76d19bac3731c3341db8b8f527368923820936304e0509018821ccc23c8d2
MD5 f06f370b3ca4cc7e055efab93645e9e7
SHA1 7f195a7dd0a5626703ed14d86cc5ce0814d862a5
SHA512 ae019bd2cfb5523e812d55f44cc289668b508285606360bc0faf515e78061ad947e2cc6969e0a50a20379f6791f30a05a0eb0699679e76d878364cc70ffc3630
SSDEEP 384:sxZ/cqck/fnsVFkQUei2Yg/bG5DOqHNd0:sHrck/fWDUE/bG5tY
TLSH
T1DB72F9166A34497BCCDBD219F655BB93D7F9157292904E44AAFCCB0C00E6AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 db03c031eafa75b77827f4ade11b0ba582a3bf97b4890369906e9c490c23fdfd
MD5 29d2f461f19446c9d7ccdfe4834501a1
SHA1 a455f2e2eebd61ceb2de44e1cda57ff525e243f5
SHA512 ae89acd0f44504a9df9cfb9cd0a6f78816873a75c8c396a1911bf417c572530a9f89458260535e215ee66d48cec766c654cbabe899c8b757d39c38ec008c2927
SSDEEP 192:sxZ/RfyMqZjK1Ml8Mck/fnsAFk5KTG5GN2/wyzodpE9/W6+WNGY0h+Ow2fez7Ig4:sxZ/c0k/fnsAFk5Uei2Yg/bG54OqHj+Z
TLSH
T1DD62E8166A24597BCCDBD219FA45BB53D6F9157292904E44AAFCCB0C04E6AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c4387ad64101dfaf679f4900b772abd690f868acdffec65c70aa83783ec3f915
MD5 260e5242bb121262f31d343bdcda2a52
SHA1 7085f2df3d91713c6ef7d4c49b14feac7c124828
SHA512 064503ddc32f820e7ef2017f6b4f124776c931fdbe1498e7faf3a7c2e6c6f73ab8e5e183f76abaf0cffe3433eb761e90d361de2e15676f9721e50cb412cb3a60
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3yzx4Ll3:wQAKq8y02yqEnjbWRmj1QWTu1jaKyzx0
TLSH
T13603FA3B680CCB7E4FC04E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 b9ae3a862d809ba791b2e155217b80b531c6eeb739ffa63c5c753b7ba8893f34
MD5 3e8a2ffe0666878fecaf4cf07dff5da3
SHA1 ce3ed7f33dbc8dfb15b9e7e041201e33fe00f195
SHA512 29ac987f1409a773d6788e7f0bf3a2ac391c65e756e0633640c05c641c472e8652e1ff1268162d329c673f4c36e58e84692ba3a7d09efad450350cca5fe4334b
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F54:GZLVDJjEDPV0/Zdm5j
TLSH
T1B1A25B0232BA12023C7D391C929687674A42F5633469ED3F7BB940B64E67E225DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 91452c1847e48c14fa66c7700237395013f2e88f0784b6e7a1cd7df48226b0f3
MD5 b94cb706e43ceeca3d1f3394165d3305
SHA1 05d3691de25b2aac7d7b182fe5b36526873f11b8
SHA512 8318a245a2c4ebd3862ad6ce5802b4c3123bc7dfa7ced0aeedb9a2931cc911856750e70ac6a4e918a965aeb64a72be63d9e923f88a5721cec29b8a2b14be21f3
SSDEEP 768:CFicpX38wg9KekmQfG143fuw2lPJJBHaj6n:CX3ikOnw2jnHa+
TLSH
T116F2C3F198D78977D99E4B87A33D2D429AFCD063B9884984FB880D1DCC461BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bfb1d316bdea3eb944d5913ddfb0d4556da50c265c9ef1e46b8b6908b6ce3071
MD5 460fb642b620770ccd10a0350c5a1af0
SHA1 32603d173e89dcbb044d89d3b8260c78921de935
SHA512 4587ebe92d488cd87ebeea6b01c2dcb12a22f4ace61d0d69d37c78284f139f3fc70b9fa7179f2f66302933bb1e8f1cf358fe3539121e585e535fdd8beeefbef5
SSDEEP 384:nriF9CcmyWCs38ND8TUNTUlIxBPm3ek32nn9B7QHs4JfbgG19CBFt38vpe4KV8pM:GFccps3EwgPKekmD4sG143upI8p0T
TLSH
T1FAC25B35E868CABBECE64FD9F74E6602DEE01127959C49E8DADC4D0D00872DD130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9738ffffcd96f0103280e0b1f949a18544372d7ff19aeaacdfab103479e9348b
MD5 6208678d437250c86628e3e58f15693c
SHA1 e6197357b983a2cfbe1774bcb4755bf62fc6b5ca
SHA512 160f7b6db7a290ba135e52fa4ef295816df1a6abb93b7d859a250e23620d8b1fd38f6163b1c1e6f0b2873214d814fe1992195e78239a8346884ad119e40a7e89
SSDEEP 768:xFicpM38wg9KekmIfG143puw2lPJJBHaj6n:TM3ikWbw2jnHa+
TLSH
T10DD25A31E864CDB7E9EB4EC9B30A7652DEE011A3D98C4ED9DAC94E5D00872DD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 73739134857813fb49a31530bd4486ee05b4ec64947cc1bca58f85c13ea0a555
MD5 e16f99eb02a8c8a454042d204e9bc7e8
SHA1 b49f9ca6d8a9cbf25bc56890f63b0b9c9cf131bf
SHA512 f7a5f3fa4697398a381bf6bc13f2eb94f20bab72c1ff224519b79d1eb68344923abcc2a41adef18d91485abe20da7b28f193b31b306a9d52336184dec8cfdd26
SSDEEP 768:CF/cpX3Qgwg9KekmHqG143Nuw2lPJJBHaj6n:xX3Q2kM5w2jnHa+
TLSH
T113F2C3F198D78977D99E4B87A33D2D429AFCD063B9884984FB880D1DCC461BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 453690f27b4b9588a1dcacc598a29339f47e059f48c84d68633732fe8ddaa3fb
MD5 3e680921594c0e6510ebcc3605dc5098
SHA1 262b94a1f96cdbb0edaeb886e7a7fd95ff52b275
SHA512 71cc3c15b0dec3872eccf076775d364f34eafb3f2b7646b7d80b6acdc50ea7d04c5b574fc9e89321bf64e354c5b0cf6b001d332dd1dd0f3f980a2d28de82759e
SSDEEP 768:xFccpF38wgCKekmXfG143iuw2lPJJBHaj6n:1F3RkxYw2jnHa+
TLSH
T1DBD25A31E824CDB7E9EB4ED9B30A7652DEE011A3D98C4ED9DACD4E5D00872DD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0b29e36bd10c987d1b7a8e859cdc9a2738bcf48bcf8317c2c28726d721271d39
MD5 0ea79065e31a00e2a7d8533a11e99bf6
SHA1 486b4a6b278e0609aeedcfd595e468eb659600ef
SHA512 1d6818d58712ed13fda4d0757a797fba0450d6f9b8ee4b499e146759b086f1bb129fbe87c63696e09f1acf5780a9cc3b439646c5764cc56ec2053caba1e177a0
SSDEEP 768:BFicpM38wg9KekmIfG143puw2lPJJBHaj6n:DM3ikWbw2jnHa+
TLSH
T157D25A31D864CDB7E9EB4EC9B30A7652DEE011A3D98C4ED9DACD4E5D00872DD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a17eb7133de1bd892c32ae0362738c05c95b6fd3df25d6b78612182f7cd3ef10
MD5 d58733cb552e6cb0a8e424f8668873c3
SHA1 c90efed95188a97c5d28b53313349207f40533e0
SHA512 3bc668623091f629d8d4426fb83665e025d5d0593cab4217883db74f244f850301915f635783a536ecfbdf23733be4730a993bbf94d2a7470f218842c038b552
TLSH
T1CE513EE05C785AD1D4BD0E6FB08B34FC81DCC726F5A0347E6C68EA984A7961E648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c2797c3dc57b5720539db522ecc60d7e1bc89b6b6754cc5533a05b3b18da55cc
MD5 36c26793095ab5c148b1ab629cd60c1c
SHA1 9efc5e49dfc71a37bc9d7483b68cd70eff5ca23c
SHA512 8213c8e84ff4e15c9e9940de88dbfb6af5544acbdc4e9db7a82225de98350625c15efcd41b4acacfec0bff40cf7e348340f5aa779a3c119b9200c2e67ec7e8a4
TLSH
T1685130E15C381AC1D0BD1A7EB0CB78EC81DCC725F5A0347E7C68EA984A7961D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 01d2a836b97806fb9374c4b5d001e5fdce87236c2310f1742c103d723b372645
MD5 d9c2c707bee3f76118969e92017b55a4
SHA1 7159c8bb0e0098466a1509a133ef5026dc439a63
SHA512 10741924d87cab590e4625adfab598e4f02caa9ecbe534fef2971e027810faee0a9496e1a81d28c15fa3bcf8b759bdbce04b98dc747f79bbf5f89f5e47de5865
TLSH
T158513FE15C3D1AC1D4BD1A7EB08B38EC81ECC725F5A0347A7C64EA984A79A1D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 9b38a5b11a3027b5324a8077d285da75f9e488c6fa4766df805ed8674e28876c
MD5 d3af0094a01630069ec588487811ee9f
SHA1 966be7024e39ab132786c4a3162b4cdfb3de7f13
SHA512 7760f83c2bb2c00e5cf0a9d4ca7370020eb41b6fb433595eb366e8b18e1543924788de695a90c017124b18c93c7be761a91397a4a6bab04f15bf242da329becd
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3D:CebAjOKn3wRKRJ3D
TLSH
T130D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.old_1779416716

Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer.old_1779416716
Size 2.7MB
SHA256 fe32397eb4edfa3a9cded0ba922682bb8ddac9a17f137f380ef536cadfdf5641
MD5 7a75fb2c9b8ee6be39a3ee160078e39c
SHA1 a21c387af16bcf48a1469eea9c4f8a30f253105b
SHA512 64994407502b7de0283ac0e543463ba6317067f9d17cb53bb322672518998efe45680fd6869a7faf1ea1d7b4091d69e1e0c0cc60a34c6ca8eb9ce664531e730a
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ39:CebAjOKn3wRKRJ39
TLSH
T15CD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1166610382\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1619877379\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1619877379\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_363256643\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5036-208-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-191-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-295-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-269-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-312-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-320-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-211-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-284-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-182-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-236-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-244-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-397-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-243-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download

memory/5036-406-0x00007FF713AA0000-0x00007FF713D61000-memory.dmp

Download