cd0ae89be5ea2e60073e6f0b2305d5189a925292baf10aa2f74b1d17f4bd94da

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260525-q3485ac16w
SHA256 cd0ae89be5ea2e60073e6f0b2305d5189a925292baf10aa2f74b1d17f4bd94da
MD5 91fce4a62117fc8ad34b92807b3c1b31
SHA1 67fd01e654ab497a72d9cf96a2ef27985bcf259f
SHA512 8afb8637cac91f42e90461cc6550c81ebb485ebda40836723fa28d3eefecd85838cb9eb11f15a47137f1aa1574fe7230fd48190393fc6f18f266ff3d8b8d18c9
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3/:CebAjOKn3wRKRJ3/
TLSH
T14DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_539241507\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_823932935\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_539241507\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241904943029519"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{E34B8748-2451-4A13-9EAC-C15EC3154126}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3260	2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5312	wmic.exe
Token: SeSecurityPrivilege	5312	wmic.exe
Token: SeTakeOwnershipPrivilege	5312	wmic.exe
Token: SeLoadDriverPrivilege	5312	wmic.exe
Token: SeSystemProfilePrivilege	5312	wmic.exe
Token: SeSystemtimePrivilege	5312	wmic.exe
Token: SeProfSingleProcessPrivilege	5312	wmic.exe
Token: SeIncBasePriorityPrivilege	5312	wmic.exe
Token: SeCreatePagefilePrivilege	5312	wmic.exe
Token: SeBackupPrivilege	5312	wmic.exe
Token: SeRestorePrivilege	5312	wmic.exe
Token: SeShutdownPrivilege	5312	wmic.exe
Token: SeDebugPrivilege	5312	wmic.exe
Token: SeSystemEnvironmentPrivilege	5312	wmic.exe
Token: SeRemoteShutdownPrivilege	5312	wmic.exe
Token: SeUndockPrivilege	5312	wmic.exe
Token: SeManageVolumePrivilege	5312	wmic.exe
Token: 33	5312	wmic.exe
Token: 34	5312	wmic.exe
Token: 35	5312	wmic.exe
Token: 36	5312	wmic.exe
Token: SeIncreaseQuotaPrivilege	5312	wmic.exe
Token: SeSecurityPrivilege	5312	wmic.exe
Token: SeTakeOwnershipPrivilege	5312	wmic.exe
Token: SeLoadDriverPrivilege	5312	wmic.exe
Token: SeSystemProfilePrivilege	5312	wmic.exe
Token: SeSystemtimePrivilege	5312	wmic.exe
Token: SeProfSingleProcessPrivilege	5312	wmic.exe
Token: SeIncBasePriorityPrivilege	5312	wmic.exe
Token: SeCreatePagefilePrivilege	5312	wmic.exe
Token: SeBackupPrivilege	5312	wmic.exe
Token: SeRestorePrivilege	5312	wmic.exe
Token: SeShutdownPrivilege	5312	wmic.exe
Token: SeDebugPrivilege	5312	wmic.exe
Token: SeSystemEnvironmentPrivilege	5312	wmic.exe
Token: SeRemoteShutdownPrivilege	5312	wmic.exe
Token: SeUndockPrivilege	5312	wmic.exe
Token: SeManageVolumePrivilege	5312	wmic.exe
Token: 33	5312	wmic.exe
Token: 34	5312	wmic.exe
Token: 35	5312	wmic.exe
Token: 36	5312	wmic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3472	3260	2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe	84
PID 3260 wrote to memory of 2216	3260	2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe	86
PID 2216 wrote to memory of 4176	2216	msedge.exe	87
PID 2216 wrote to memory of 992	2216	msedge.exe	89
PID 2216 wrote to memory of 4732	2216	msedge.exe	88
PID 2216 wrote to memory of 992	2216	msedge.exe	89
PID 2216 wrote to memory of 992	2216	msedge.exe	89
PID 2216 wrote to memory of 1244	2216	msedge.exe	91
PID 2216 wrote to memory of 1244	2216	msedge.exe	91
PID 2216 wrote to memory of 2352	2216	msedge.exe	92
PID 2216 wrote to memory of 2352	2216	msedge.exe	92
PID 2216 wrote to memory of 2352	2216	msedge.exe	92
PID 2216 wrote to memory of 2552	2216	msedge.exe	93
PID 2216 wrote to memory of 2552	2216	msedge.exe	93
PID 2216 wrote to memory of 2552	2216	msedge.exe	93
PID 2216 wrote to memory of 4212	2216	msedge.exe	94
PID 2216 wrote to memory of 4140	2216	msedge.exe	95
PID 2216 wrote to memory of 4212	2216	msedge.exe	94
PID 2216 wrote to memory of 4212	2216	msedge.exe	94
PID 2216 wrote to memory of 4140	2216	msedge.exe	95
PID 2216 wrote to memory of 4140	2216	msedge.exe	95
PID 2216 wrote to memory of 1032	2216	msedge.exe	96
PID 2216 wrote to memory of 2328	2216	msedge.exe	97
PID 2216 wrote to memory of 1032	2216	msedge.exe	96
PID 2216 wrote to memory of 1032	2216	msedge.exe	96
PID 2216 wrote to memory of 2328	2216	msedge.exe	97
PID 2216 wrote to memory of 2328	2216	msedge.exe	97
PID 2216 wrote to memory of 4564	2216	msedge.exe	98
PID 2216 wrote to memory of 4564	2216	msedge.exe	98
PID 2216 wrote to memory of 4564	2216	msedge.exe	98
PID 2216 wrote to memory of 1764	2216	msedge.exe	100
PID 2216 wrote to memory of 1764	2216	msedge.exe	100
PID 2216 wrote to memory of 1764	2216	msedge.exe	100
PID 2216 wrote to memory of 3844	2216	msedge.exe	101
PID 2216 wrote to memory of 3844	2216	msedge.exe	101
PID 2216 wrote to memory of 3676	2216	msedge.exe	102
PID 2216 wrote to memory of 3676	2216	msedge.exe	102
PID 2216 wrote to memory of 3708	2216	msedge.exe	104
PID 2216 wrote to memory of 3860	2216	msedge.exe	105
PID 2216 wrote to memory of 3708	2216	msedge.exe	104
PID 2216 wrote to memory of 3860	2216	msedge.exe	105
PID 2216 wrote to memory of 5172	2216	msedge.exe	107
PID 2216 wrote to memory of 5324	2216	msedge.exe	108
PID 5324 wrote to memory of 5436	5324	msedge.exe	109
PID 2216 wrote to memory of 5684	2216	msedge.exe	110
PID 2216 wrote to memory of 5684	2216	msedge.exe	110
PID 2216 wrote to memory of 5752	2216	msedge.exe	111
PID 2216 wrote to memory of 5752	2216	msedge.exe	111
PID 2216 wrote to memory of 5880	2216	msedge.exe	112
PID 2216 wrote to memory of 5888	2216	msedge.exe	113
PID 2216 wrote to memory of 5880	2216	msedge.exe	112
PID 2216 wrote to memory of 5888	2216	msedge.exe	113
PID 2216 wrote to memory of 5580	2216	msedge.exe	114
PID 2216 wrote to memory of 5580	2216	msedge.exe	114
PID 3260 wrote to memory of 5312	3260	2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe	115
PID 2216 wrote to memory of 6036	2216	msedge.exe	117
PID 2216 wrote to memory of 6020	2216	msedge.exe	118
PID 2216 wrote to memory of 6028	2216	msedge.exe	119
PID 3260 wrote to memory of 5184	3260	2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe	124
PID 2216 wrote to memory of 5792	2216	msedge.exe	126
PID 2216 wrote to memory of 5792	2216	msedge.exe	126
PID 2216 wrote to memory of 5480	2216	msedge.exe	133
PID 2216 wrote to memory of 5480	2216	msedge.exe	133
PID 3260 wrote to memory of 1136	3260	2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe	135

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3472	attrib.exe
5184	attrib.exe
1136	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.old_1779716890
  2⤵
  - Views/modifies file attributes
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffcc892c188,0x7ffcc892c194,0x7ffcc892c1a0
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,562437804663458445,13700457888859191290,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8313538072322416848,4677241983093217000,262144 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,11935328600875773940,3932978736190759706,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,17705028949855721274,14224527812349957452,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,4451592280952253668,3399251998770175720,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,5261856362522019422,16362663563155400272,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,1804714179467440522,16442314439952796734,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4188,i,1686378954974835347,14894937533769283211,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,12977732524986441397,12230957712729341549,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5496,i,508913275042645124,10163531434880131570,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:9
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5584,i,10198338106973881497,5380385721690093385,2097152 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:15
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,15586525402216605285,9823612767600014106,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,15494669953871069084,12391716529381216533,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,10478334685641396445,4506503265492576803,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,4701721803826024856,3161317203857396560,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,15671789647468301344,789579108015068612,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,15671789647468301344,789579108015068612,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,18410409981017942307,16559157658888358240,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,10273398065921073256,6186145176121977181,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,9439066328109575781,16120144460748922391,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,2550697686976204296,14030242076616238870,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,12199631266952482220,10712055441488963892,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,17840324635622512594,1059267805518944623,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,3638594029301611193,4668956536140579069,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,3335112253052438568,6638087518565783353,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,8272244989931041501,13189039574427116898,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11938414085614261797,374824200717386860,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,270837439365054342,7640607437079695169,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6976,i,4858185389079619856,1823787404585933523,262144 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,3659799265316502472,16165785994363420289,524288 --field-trial-handle=2184,i,10738290013161877398,11973107105563681514,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
    3⤵
    PID:5152
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5312
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.old_1779716950
  2⤵
  - Views/modifies file attributes
  PID:5184
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.old_1779717010
  2⤵
  - Views/modifies file attributes
  PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b825960e093c505ed8b2d25208a6a3ef4eb588fd7e3f0a739f6681adec4241fe
MD5 f001f4c7632aabbc8547c40a2a9665a2
SHA1 d3257e13c3132d0536b33ef02f337f9476b1c310
SHA512 c9c2806c7593f3b769405c2676589dac1a14d13f8c6d2e67e0b14995b01f4e41d04a60b8f556d218c2168180bcb2316746a622635dc3053b54c55fbde5cf4f2d
TLSH
T185D092217B5DB082EB0A0A3188639B342A6EC94A389BC21A7122400DAD66808E3C944B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22365024d48727271cea3f4a0227522b6f03c49f56b43e6c84b7ff09091fecdf
MD5 06f667ba3e99a1653d7a18267b654b23
SHA1 215c6ee19110026e8893c47477f4e12711e7c9de
SHA512 f5c1db56da435db9aed5ca1b2fd0fc395cc06bfca2c0a716350e1dd59d05dfac9f6e0cc97ea6d28624b96006d4eaacb12207f25701f287601683ff070a2f9da9
TLSH
T105D092213B9DB082EB0A0A3188639B342A6EC94A389BC21B7122400D9D67848E3C944B
MD5 SHA1 SHA512 TLSH

Submit Download

13fd9470-143b-4867-81a4-03d58ad4d871.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13fd9470-143b-4867-81a4-03d58ad4d871.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 07801cea303f5f40bb17deece305b86ce214b290f7928e968003fe126d2c91c4
MD5 16b0f3c384cef15087a6b5a85b2b55a8
SHA1 540913c52075de86f09ca19565d72bc7bbe6752b
SHA512 4e2cf8334c8098c6aabfceec0f445553d8122bf37f66495232b05edd1a030ddcdba0e9b615e1974f7de48c02713b0dcbe038d9e4511ba677a6b1ea86a4ddfb80
TLSH
T15571925302B20C13EB6B02FE95E2B1CF3DB1468D0D431C2136E475B9EB06726F45E849
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b169.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b169.TMP
Size 3KB
SHA256 7621053e1ff2657e321498fe1d811597c34194fc4ca209688802620ae68d9a10
MD5 1a3e1c46e43f47a462e524e9bdb9c87a
SHA1 dc405301b0b6d8c3543e326683f6f7853f7259c3
SHA512 07d6b03f3a7d1413cc1f690653690bc9f95f658ea61cd91f4ee1c83f9f5f2818d5e05154295ec549af69bc0aa86b49e2d0d069f4c344e5d2fcb8564f29d929df
TLSH
T1A361815702B20C13EB6E12FE95E2B2CF3DB1469E0D531C2136E079B9EB0A712F51E509
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2216_765916035\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6a19a0d1590ed1ce943e8476c0b6e489759895cd1d56d30421a7849198fd7799
MD5 41dfcbf8a0e34d5cac9078bacded17ed
SHA1 d4e05e787422aeaef3eabf3e29be4af6bf89148e
SHA512 7bd0a92d89c888c93b8974d85057b8352aa57e828509aa966cc1781da361ed16c298131d3e20c30be04542bf11c1a3be6d0a2e840ebb7c5f4cd71ea7e7ab0986
TLSH
T10F41CCF3C2E8856EC91146F0BB28BE1BCE2D0A55532C3D9A84E4EF4B93E2470D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ce201973d69bfb1ba04b0c37eb0ab2d8d54b8f8aab17b50d66355607d0c5470f
MD5 9b2a39bf2cbdbab6817d10499a8af977
SHA1 5854c4b05410d3668cb8ebbe0e4b208b9973c7e3
SHA512 ed6e045b30d73ec91e661e53ed68add0a0c6fcab467fa8679601b62a3906aa47e5d320c633ae3903f199a1d5b8ec547b74f09b3bcdc9fa5822919d38015bf736
SSDEEP 192:sxZKQUn4R3yM/jK1Ml8Mcq/f8su+XQYx9bIgCodpyq/W6+WNGY0uBHlOwZBnIg4J:sxZ8n4p0q/f8su+geIMp/bG5unOcc
TLSH
T1F752E7126A345977CCDBD219FA56BB53C6F81572A2900E44AEFC871C05E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2a9328dbc343e3d4b5ddad9ad13ee53c2aa5733a4759ea28c37338c31297a7b
MD5 17e7f4375f9aff2e38825310664d5797
SHA1 f135da5aed3734226fbc87a4cbf18cd6706a0e76
SHA512 c91856edf8f90f1dcf00db44023ffb722ec5fa21797279bb018f93d3ab36c3f1c4b891b4ea61b55ef48b76a693f8ff51995dcee6a063ac99e4205cd4062d5db0
SSDEEP 192:sxZKQUn4R3yM/jK1Ml8UQecq/f8sWi+8WQYx9bIgCodpEq/W6+WNGY0uBHjOwCBM:sxZ8n4pqdq/f8s9+8eIMr/bG5uVO1M
TLSH
T11062F9126A345977DCDBD219FA56BF53D6F8147292900E44AEFC8B1C05E67ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 43470231a6a50bc69f7a358b3059931c02763ad8ceecb47a500195fd80df6b15
MD5 d9aef211beead61381680459bf81c01c
SHA1 20be152da564ffb42e89192f8e1ea38e45e0c80f
SHA512 145df5e4be8cf2f9f063b340bffabeb0100bec958c24d366a7a90a559d236212be648041e9d22fd17e0e98408aed840f4fdadfe3420d20a0bcc5433fb989e979
SSDEEP 768:PG/Lh8dF2So7pLuLXAkWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eVwjLlw:PG/Lh8dF2SUEXAkWRmAcQ3wu1jaKeVw6
TLSH
T130032C3B690CCB7E4F844E9CEC2A7E9B6EE801CB5698895447FA854C03C66EF05161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aeb548a07810f35e1a72818a804009248820161cd0c9c22103c8f84c9b3f7e7e
MD5 128bf0699e8bdb797ff0ac16e5e8d988
SHA1 8ce55439b92e3c108a7d7106efeef2c7bb897a4d
SHA512 be4ebe23f3e2a7275a69c9e6ebadc7e26f4ce3a0ef3bd0151447a43d6a88f33b02da0fa70508a7832002969c1669a3c9c22834a4e813030abeaa121c01a924a9
SSDEEP 24:KdHfel8a5dttd4pl+QIjZdKiqhaXd1EPNSm3MnmfnJn6n7anodncnInk4ncno+nb:K08I/KFGszLIJKIocjyRaIPK76wXyZz
TLSH
T12391216B31BA53023C7D251CA291862B4F4235A33055BB6F3BB850B60E67E251DFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5638bd21-2b3b-4fdc-8526-9e2944d61cb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5638bd21-2b3b-4fdc-8526-9e2944d61cb6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 71494a430bd4e8e5d37bb8d866979c0cc9a2a5207bfc79ee6cf39d9b027d5713
MD5 534edb75373d2caf037dc74747165e34
SHA1 b03e589b2cee41c602b69eb4476c20c3355d8eb4
SHA512 fdb7167687d0213f00521d57928a90662f876a6d5a7f7d531fe457fe22a66627b1eff8cad41ef42c4bbe59173df5bf7164027c0002f26bfbb927cc898ebdf973
SSDEEP 384:nRtNnNnb9/8NdSi40HogbLE0FptgSQ/s+2qX3n1d93dXhgurjc/:RjZbp+BbbOVUlg3n1lFjc/
TLSH
T102927D3658396C376EABA955F14B37476FB8106F9D842F80E9D88B0D01DB39C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ef5c735362c3d24a3c112821e13a3ae4d77915e41e06d833a0ea492345d4e50c
MD5 0159ef33184ecdbc7e8c17233d4e57ef
SHA1 18a363166c16c66d54d7204842ccec278bc46a52
SHA512 92e3272dd7e66e036ba145ab1fee06bad3a7f1042106a3bf9f54f06279dce04834eaaee798cec715576547887cc4b25b41feea573bf0ec1f6e604d23524dc1cc
SSDEEP 384:ndtNnNnb9/8NdOi40HogbLE0FptgSQ/s+2qX3n1d93dXhgurjc/:djZbp+BbbOVUlg3n1lFjc/
TLSH
T182927D3658396C375EABA555F14B37476FB8106F9D842F80E9D84B0D01DB39C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1bcce1ef0a56d5a2f293bf0d79568833f5d3b20ca130a534e5219f16a1f53220
MD5 7ba8367b1970af6a822406131991fdec
SHA1 a26dad041d2c70c3fa23667cd4fdb1cd194323d0
SHA512 ee69d4ebbe70e1ac7cf2c6a34b73c5d9200d059042e959c7bd9f6deb6ff45b3c28328e307fc081e7fca336462180ce6895a0bfddf4c54d1eef50f0c850b107fc
SSDEEP 192:qGNV6d9402QmiUyJvYTBF2oP1gSBm5Gw3jSYU6:qGNV6740SCgTBFptgS83JU6
TLSH
T12C02E9356878287B9EB3AE49F4473B176FD5216FDA842B84D9E41B1C41DB38C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d399adb8889aaaac93d480483fcf9d75cafab89a187c0c7c8bf6a85bc899c47
MD5 8dec5d3df6d9467548261b465d9d3994
SHA1 fe9325b14bb7eb2e378993c74059868283ec6ec0
SHA512 47f106d8718e7273f402cf996e9aa4fce2154f0e719ba73edbff11f0124157a590276fce704a53916fdc63da402d11e4ad675c90f0bc170be8a5455ffe850ad7
SSDEEP 192:qGN46d9403QmiUy3YEBF2oP1gSBmN/s+2qfiD3Y/sbZU6:qGN46740ZJEBFptgSQ/s+2qC3n1U6
TLSH
T1771219756838AC2B5EA7A945F0873B136EA5217BDE846F84E9E40B0C05DB34C270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 02a0c4356976b4bf147b6274fc9136f62d1938cd1ebc098b15ec54d05b684206
MD5 67a91edc58390e63717005857b3304db
SHA1 96913f87ffe815f156b68d3d470aa23de0c1d7eb
SHA512 6f3782aeb723f91c342761839b046592e953f0c307a113fd6f675b202e0dbc9dd9b0043572e6ac5dafff37bafc119445dcc687c93aad503eb1840a8ef9012714
SSDEEP 384:nQiFxtNnNnb9P8Nn8TUNTUlIlFi40HogbLEBDfQQFptgSQ/s+2qY3n1d93dXhguY:rFxjZbNOwgoB5QbOVUlh3n1lFjc/
TLSH
T1EBC22936D864D93BADF79BC5B20B7787AEE411A789886EC4DAC84E0D01D72DC130BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6168dde525de31f1e6e4a7cbcd413467b6cb117f1343e905b0ddbac5e2338d9f
MD5 2f3bf666de39e977af65641d74a101a2
SHA1 6998213a481e3ca056d7331036129782f2dbd54d
SHA512 eed81c7125160673b22ef371b7331d43b4ef9826587d8031cdf62e3cf3c19e5e8bd30222fd3bc8b73a3cc97dc742221985e536b3d78acf98f149224f5b0067f7
SSDEEP 384:nDtNnNnb9/8NdFi40HogbLE0FptgSQ/s+2qX3n1d93dXhgurjc/:DjZbpRBbbOVUlg3n1lFjc/
TLSH
T1F9927D3658396C375DABA955F14B37477FB8106F9D842F80E9D88B0D05DB39C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0172a7e2-4b67-4c97-b871-23db58642644.tmp

Path C:\Users\Admin\AppData\Local\Temp\0172a7e2-4b67-4c97-b871-23db58642644.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 ef93392016516ffb6710544ac72728d0945ac4b961a8394cb1864d63040eaca5
MD5 d26cb322192924f1287900a04cbd30c8
SHA1 4e803b38f7eb73032b2a408d753e75bdc4fbcc4a
SHA512 6785f316e98e0531539600e79dc3eda1ac325cfd2cb4cde1a93865ffa3232ceb2b657b335be323f690a6bdfa9f741b2b464c0388aec2a7e6855008c06ad42980
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3a:CebAjOKn3wRKRJ3a
TLSH
T1BCD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.old_1779716950

Path C:\Users\Admin\AppData\Local\Temp\2026-05-25_91fce4a62117fc8ad34b92807b3c1b31_akira_glassworm_rusty-stealer.old_1779716950
Size 2.7MB
SHA256 dbae79356e02019effc8460c73eb7fcdd9feef94792438d817a716c4f408de7c
MD5 8869a203ed9316e4ff0c3104aa3144af
SHA1 79d7e748a1f13d4001d5734a421f04504e564276
SHA512 badaa8094d48139176d21f943deb63866dda3dd0ca94a5d47ebab834cb642f568060cd91c1fb829fd042cde671b26549dccb3239a1d88bcbc7ab26fdcc281fb1
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3G:CebAjOKn3wRKRJ3G
TLSH
T10FD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3596482-b4bb-46b1-81bf-38a370d53154.tmp

Path C:\Users\Admin\AppData\Local\Temp\b3596482-b4bb-46b1-81bf-38a370d53154.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e893d5d4-ce07-48e2-840f-bc5ec310eae2.tmp

Path C:\Users\Admin\AppData\Local\Temp\e893d5d4-ce07-48e2-840f-bc5ec310eae2.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2216_1883696360\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_539241507\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_823932935\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/3260-552-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-637-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-604-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-605-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-471-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-620-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-557-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-587-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-638-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-648-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-508-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-535-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-533-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download

memory/3260-667-0x00007FF7D3E60000-0x00007FF7D4121000-memory.dmp

Download