bfbe67d99ca60aa756df45d73136f695551203d2b0f078dae69dd013cf0b79e5

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260530-b2ws2acy8s
SHA256 bfbe67d99ca60aa756df45d73136f695551203d2b0f078dae69dd013cf0b79e5
MD5 9924cebc8a6b0251175223205b7b7555
SHA1 10378f47327d37d6d49c19e547d2b90ceccc758e
SHA512 f8c48fbfdf797c6f65389471578dd5703ffc4d23cebb238d80ed99f32585036e7d987ca01e7313b33f9487d691532ee2955f249f8c20632ceb4d17e678f4a9cd
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3l:CebAjOKn3wRKRJ3l
TLSH
T1F0D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1760039373\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_523413981\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1939580839\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1939580839\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1939580839\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1760039373\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_523413981\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1939580839\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1939580839\_platform_specific\win_x64\widevinecdm.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3620	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245787464026704"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{1C7278B8-0DFE-4FE2-A8B4-31279FCF8448}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5500	msedge.exe
5500	msedge.exe
5500	msedge.exe
5500	msedge.exe
5500	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3616	2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1980	wmic.exe
Token: SeSecurityPrivilege	1980	wmic.exe
Token: SeTakeOwnershipPrivilege	1980	wmic.exe
Token: SeLoadDriverPrivilege	1980	wmic.exe
Token: SeSystemProfilePrivilege	1980	wmic.exe
Token: SeSystemtimePrivilege	1980	wmic.exe
Token: SeProfSingleProcessPrivilege	1980	wmic.exe
Token: SeIncBasePriorityPrivilege	1980	wmic.exe
Token: SeCreatePagefilePrivilege	1980	wmic.exe
Token: SeBackupPrivilege	1980	wmic.exe
Token: SeRestorePrivilege	1980	wmic.exe
Token: SeShutdownPrivilege	1980	wmic.exe
Token: SeDebugPrivilege	1980	wmic.exe
Token: SeSystemEnvironmentPrivilege	1980	wmic.exe
Token: SeRemoteShutdownPrivilege	1980	wmic.exe
Token: SeUndockPrivilege	1980	wmic.exe
Token: SeManageVolumePrivilege	1980	wmic.exe
Token: 33	1980	wmic.exe
Token: 34	1980	wmic.exe
Token: 35	1980	wmic.exe
Token: 36	1980	wmic.exe
Token: SeIncreaseQuotaPrivilege	1980	wmic.exe
Token: SeSecurityPrivilege	1980	wmic.exe
Token: SeTakeOwnershipPrivilege	1980	wmic.exe
Token: SeLoadDriverPrivilege	1980	wmic.exe
Token: SeSystemProfilePrivilege	1980	wmic.exe
Token: SeSystemtimePrivilege	1980	wmic.exe
Token: SeProfSingleProcessPrivilege	1980	wmic.exe
Token: SeIncBasePriorityPrivilege	1980	wmic.exe
Token: SeCreatePagefilePrivilege	1980	wmic.exe
Token: SeBackupPrivilege	1980	wmic.exe
Token: SeRestorePrivilege	1980	wmic.exe
Token: SeShutdownPrivilege	1980	wmic.exe
Token: SeDebugPrivilege	1980	wmic.exe
Token: SeSystemEnvironmentPrivilege	1980	wmic.exe
Token: SeRemoteShutdownPrivilege	1980	wmic.exe
Token: SeUndockPrivilege	1980	wmic.exe
Token: SeManageVolumePrivilege	1980	wmic.exe
Token: 33	1980	wmic.exe
Token: 34	1980	wmic.exe
Token: 35	1980	wmic.exe
Token: 36	1980	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5500	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 4916	3616	2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe	80
PID 3616 wrote to memory of 5500	3616	2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe	82
PID 5500 wrote to memory of 5040	5500	msedge.exe	83
PID 5500 wrote to memory of 3620	5500	msedge.exe	84
PID 5500 wrote to memory of 2228	5500	msedge.exe	85
PID 5500 wrote to memory of 2228	5500	msedge.exe	85
PID 5500 wrote to memory of 2228	5500	msedge.exe	85
PID 5500 wrote to memory of 6140	5500	msedge.exe	86
PID 5500 wrote to memory of 6140	5500	msedge.exe	86
PID 5500 wrote to memory of 2360	5500	msedge.exe	87
PID 5500 wrote to memory of 2360	5500	msedge.exe	87
PID 5500 wrote to memory of 2360	5500	msedge.exe	87
PID 5500 wrote to memory of 4740	5500	msedge.exe	88
PID 5500 wrote to memory of 4740	5500	msedge.exe	88
PID 5500 wrote to memory of 4740	5500	msedge.exe	88
PID 5500 wrote to memory of 4488	5500	msedge.exe	91
PID 5500 wrote to memory of 4488	5500	msedge.exe	91
PID 5500 wrote to memory of 4488	5500	msedge.exe	91
PID 5500 wrote to memory of 3028	5500	msedge.exe	92
PID 5500 wrote to memory of 3028	5500	msedge.exe	92
PID 5500 wrote to memory of 3028	5500	msedge.exe	92
PID 5500 wrote to memory of 3848	5500	msedge.exe	93
PID 5500 wrote to memory of 3848	5500	msedge.exe	93
PID 5500 wrote to memory of 3552	5500	msedge.exe	94
PID 5500 wrote to memory of 3552	5500	msedge.exe	94
PID 5500 wrote to memory of 4868	5500	msedge.exe	95
PID 5500 wrote to memory of 5420	5500	msedge.exe	97
PID 4868 wrote to memory of 4064	4868	msedge.exe	98
PID 3616 wrote to memory of 1980	3616	2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe	101
PID 5500 wrote to memory of 5052	5500	msedge.exe	103
PID 5500 wrote to memory of 4416	5500	msedge.exe	104
PID 5500 wrote to memory of 2460	5500	msedge.exe	105
PID 3616 wrote to memory of 1104	3616	2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe	106
PID 5500 wrote to memory of 4520	5500	msedge.exe	108
PID 5500 wrote to memory of 4520	5500	msedge.exe	108
PID 5500 wrote to memory of 5832	5500	msedge.exe	111
PID 5500 wrote to memory of 5832	5500	msedge.exe	111
PID 5500 wrote to memory of 1876	5500	msedge.exe	112
PID 5500 wrote to memory of 1876	5500	msedge.exe	112
PID 3616 wrote to memory of 3636	3616	2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe	113
PID 5500 wrote to memory of 1436	5500	msedge.exe	115
PID 5500 wrote to memory of 5276	5500	msedge.exe	116
PID 5500 wrote to memory of 5276	5500	msedge.exe	116

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4916	attrib.exe
1104	attrib.exe
3636	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.old_1780105141
  2⤵
  - Views/modifies file attributes
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffbda30c188,0x7ffbda30c194,0x7ffbda30c1a0
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,1294451147607601157,1993195875481836830,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5810598107146844885,6941737347744235866,262144 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,1213893202438905641,3083447924353884019,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,10624586487217543165,5447357792191974390,2097152 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5278898396290665273,5708850111514737985,2097152 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4896,i,14078126572271837121,7730086002930327331,2097152 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5084,i,11511291059813905690,14819743177595914196,2097152 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:15
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,11212683356190136234,5683407008246963030,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,15460733030424381048,758418873871386007,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,16245092693999721895,10023607838108189078,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,6098579456878958305,15004771064964767050,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,6098579456878958305,15004771064964767050,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17406340178697223911,14209519129957904245,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,1353076394487612559,13931816600068427103,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,203813572557153233,5332001296079898297,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,15080717989652370653,14228322834215142482,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8706249030865101203,13372409321883054758,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,13036730392306058138,11246165913433474622,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6860,i,12867550740464129688,497195656306680604,262144 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,4588103575708822940,2467278552780706121,524288 --field-trial-handle=2176,i,12671010467878094067,17516422523203133078,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:5276
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.old_1780105201
  2⤵
  - Views/modifies file attributes
  PID:1104
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.old_1780105261
  2⤵
  - Views/modifies file attributes
  PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8481a726823bfd70c9080830033dcc6f0bb5e4e79b9d71176ac447e6514b22c4
MD5 f4912faf0e8009822522b888a5de12b5
SHA1 809a2f6e1bcfe375c11cb116d077440b5859491b
SHA512 e4f8e25d075548d291d9f40a15391e634bd3ef68acbda8b262bb5d6d60b28cb3b2fdb1d9afb3675a32e8fadd631cb86bf3bead968520597ec7dc65814b18c3ef
TLSH
T1DCF0CDBAC931AC3718FD0B2971A9174AE75513572780845F3B3D560D4FF573B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8ae6dcaebc0f32f59533b01c255c8ab5814c2783d3545269f76864a9d57ea90c
MD5 67a907ea462689309114bbd3bad8e46c
SHA1 a77a8467d06432bb14b1f190c2e715ccacc9f987
SHA512 0e4994d15f6d2a633ce27ddd66914d0fdcb7361ad7bfa0895c91164a533efca0ea459f234a2a81368db2b493e97e79c0fa5886a7c3c5e15c55e4822c96bf749e
TLSH
T102713D5D04917703EF2D123CA0E419393172646B3A573F6B22B078755427BAEE95EFC8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589cc8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589cc8.TMP
Size 3KB
SHA256 13a4bbfccd704f51868d5bba9f7fbafc8e6a6e17bf78ed0079afc3430234cabb
MD5 56250fb614607afe5d1c18f89b9145e1
SHA1 ce33aef0bb22fd4236b07fb189b1b8e9c7bceabf
SHA512 f47e99d7d1f66d69940995ddd49162a2b91e8294cd1768f787bd0321fd1574660f612d356772ee80a59e946a7f97cba2cb140204ae8ec98413067f48b8507ec1
TLSH
T16A712B1D01917703EF2C163DA0D4253871B2A45B3A973F6321B0B875542BBADC95EFC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 884a8be8b8842858ae423d176ee3a5135f34e7fc79d8f61e05847e121d49f9b3
MD5 98685b1c3abbab6e7b6e885fbfa09156
SHA1 27896ae617fd3f7e031690dc790bc806deca61fc
SHA512 f2ec00e7d0b0da953736ac42b474a54f33126a4f0e0af218553d9f771dc209dea3d34b5c6ca08b6166e54fba7879b8c28cea8df067d9d00d977f22def551d26c
TLSH
T1A841AFF7C3E8856DCA1196F0BA187E2BCE2D0914432C3D5A89E4AF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c9a27225237869923aeb65bf42ef7d2ff076d68675c50a7ee2b46dbf20eb89f6
MD5 99aa0d154411ca545490ad2ca26ed2ce
SHA1 00ccbad21bda2ccf1e2aa4d24b9437a81f1e8e0c
SHA512 498088b32e1a9087427d9f266e5b8497f06057c7c3eaf6d38a8994ab726b2091ca1d7b5bf1cd42c7fd891f485b587f89cbfab7b907c2442d1c13d74bbd88f394
SSDEEP 192:sxZqRuyMqZjK1Ml8UQZc7/f4sMDYHE0CXUyynDHzodpE5/W6+WNGY0ddOwtKuA1B:sxZqbqO7/f4seYk0Ly8Mg/bG5fOyAi0
TLSH
T1F772F816AA38597B8CDBD319F6457F53D7FD152292405E48AAFCCB0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7ab16ad608e62f1ef121ade7748b739caba585f40ee36a7126c8371d20d6dbb8
MD5 aa5f19e757b5faa8bea2c31143050560
SHA1 81ee85aa13613fb9961b6134f9e5b406ad05e9f7
SHA512 f6454bee5d93e07d10d10f1549e639391ca52334ea8e1709a7711a20fc152d81e33b075af2d62b992ab622fff0ccb95c95517b4d56b866289a312cea6c973acb
SSDEEP 192:sxZqRuyMqZjK1Ml8Mc7/f4s8ZDYExE0CXUyynDHzodpE5/W6+WNGY0dnOwtKuA1+:sxZqb07/f4s8xYE60Ly8Mg/bG55OyAjC
TLSH
T18B720806AA38597B8CDBD309FA457F53D7F9152392405E44AAFCCB0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 17da63599219cf4cd6ee92ad9494e387cd45cf5d0870baf1743df7aeb2a4f516
MD5 9715de88d5859d877332418dd2579cce
SHA1 34ef3ace8b7a3c7cff3a9d9884329e2fe097dc21
SHA512 207d22e1231cc1f42297a61ed30234a01e417d942ed1e116abd364ff9ce0aa8ab284d3e246931ae23ef2471ae4d4387ecdf4635960b9ecee1150c5ea9bed3ea3
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3B3pQLlH:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKB3pw
TLSH
T132030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4f8a867215cf449531ea7462d2ec83e1aef78ab2af44f0886c3c0f33d6b0758f
MD5 03c830a58310904cd725298fae17e78f
SHA1 6f84c0085f74e00dd3ecf496a81d15ab3bf6edc8
SHA512 e63387d2f118526974760fee8c54bbeb3bdb18783852c3b440a6dbb02cebefe8f54d1c6fa245195b3aa04ecb378318ff1f258f705a681a9fb92c74336b93d1c3
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7GxVFGpld:AFBHhTofhno2mB21q3Llbfe3sLDdeEpT
TLSH
T143B28056717B12023C3D290CA7969B370E8272A33458A56F7BB900BA4E67E615DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 448dd668bf618a6ec6cde59562ca75581ef752b9fb765f118fb2e581e1954a62
MD5 2020fa886a4596eadd04f347e902b04a
SHA1 ee7b31aa7d1f907f1a9010e4de50e02f14c8bb27
SHA512 8ae2f5b508388f47679504523c2fd1576aae3712889e2679c3d2dfe43bd77c7ae083bb280f731865ff30a46c3e885dc784852fb49c98cb089d25ccb0caad0741
SSDEEP 384:yoiFltNnNnb9G38NF8TUNTUlIRJ0y6b/9jkpfb7oV9Ph7OSmdlye8OHbgltok7V3:8FljZbs3awgIKJoPMUe8O7gvok7m0
TLSH
T1AAD23A32EC64C9BBDDE75F96B30A76139FE50193858C5AD8DAD85E0D00DB2AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5b7d370031c0a6bab791b79b60cf20ca2e0996a4ded1ceb7fd5dbe44cbd6370b
MD5 ebf26498d3250f62cb728d518b74ea70
SHA1 1d90d6ea123bbd31702715cfe4ac990c0642f4b3
SHA512 5877e85aae2cc6d9f6d186c097aa9b068a50d276bba7e88e87caf3a5fc287a3f9ae7138bba13b0314f795bb15a41165ce7c365ef952e8a4b50696b996cfbae5b
SSDEEP 384:yj8iFltNnNnb9q38NF8TUNTUlIRJ0y6b/9jkpfb7oV9Ph7OSmdlde8OHbgltok79:kFljZbg3awgIKJoPMHe8O7gvok7m0
TLSH
T180D24B32EC64C9BBDDE75E96B30A76139FE50193858C5AD8DAD85E0D00DB2AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b75d9cb0b71f6b74d8c9c064a11f465c349d8c88e62223bddfb500eb63fcc250
MD5 66bc006aa689c69306f1656a5b225014
SHA1 7e6e995b655da8ee616448ca395a2d22fc4065b8
SHA512 f2c43b1ab66e31cdf103c7360c88a37110252768cd9b5075775516efd56b3f3ec343b16af7d2a37a0637e2027845fb5eb2aa715367ec9c0bfc8f5aa7f9b87220
SSDEEP 384:yoiFKtNnNnb9G38NLm8TUNTUlIRJ0ym/9jkpfvLoV9Ph7OSmdlfte8OHbgltok79:8FKjZbs3Qmwg+KVoPMbe8O7gvok7m0
TLSH
T1FCD24A32EC64C9BBDDE75F95B30A76139FE40193858C5AC8DAD85E0D00DB2AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3789ad90cc6ea52cec7def37399191d0742238b930f7995007d55d6dc8af6363
MD5 bab7d7fc8b9421484aa78c533cbc6090
SHA1 5b03c65697a1341625e2839579c6148f9cd3d35c
SHA512 f5f64b4a8e3dd54f19d924c0c308831484688d4196600ed6d3d4138ef172adc7ef87d1f08a7393c3608d76b03212799d857a14a555ce568a10a713d32f862b84
SSDEEP 384:n58iF9CcmyWCs38NzA8TUNTUlIxBydvYoaajkpfb7oV9Ph7OSmdneEhkP+lFYS/r:xFccps3CAwgx17JoPMneEhkoFYS/r
TLSH
T1CCC24B32ECA8C9B7ECE75FD9E74A7A06DEE011A385889AD4DAD81D4D00DB29D1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 521a903fd0cae31fed801fda7920c11f500570b9430eed8384d7193e2fc8120d
MD5 38fc80a8169af33b1db6ab860d8534c0
SHA1 cc92f5321453c7a74a95ba29442b7ad34a5c6bbe
SHA512 21ffb8f75af52f8080d1c9adc93daa3ea17010878302f9b2e1d7ef52ea4f17667120cf07546857549f004aa6e63a5b3c94f8c9610076a6b7e387b1ba8405afb7
SSDEEP 384:yj8iF9CcmyWC138NF8TUNTUlIRwy1/9jkpfb7oV9Ph7OSmdlge8hkP+lFYS/TsHV:kFccp13awgRKJoPMCe8hkoFYS/+
TLSH
T177C24B31ECA8CDB7ECE75F99B64A7A03DEE101A385889AD4DAD81E0D00DB2DD1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7f3d6db5f9340a008cd227f7e1ff1780ded89b54c66dea7b7298cbf11dab4576
MD5 ebab96968f6f7aaa10bcd482cfa3dcc2
SHA1 cc2da51937abf2408690b43f37447c9f4c7c0e16
SHA512 d9551b9dea3a1e1c4146b79e0729907b01fe24d2f90538e6f23169331b1aa6871b912e47e4bcd958ec1f725a847303c20657ad620931a7e581bdbf96c67c024b
SSDEEP 384:yViFltNnNnb9q38NF8TUNTUlIRJ0y6b/9jkpfb7oV9Ph7OSmdlde8OHbgltok7V3:7FljZbg3awgIKJoPMHe8O7gvok7m0
TLSH
T1D1D24B32EC64C9BBDDE75F96B30A76139FE50193858C5AD4D9D85E0D00DB29D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77e70e8b8743a25be5c59f81e522c4ff36a644045bc2ac516b55c20d92ebe356
MD5 c4b0d590ee04da586d12ebc5feb88ba6
SHA1 33e3f5b81fd46087b3774706cadb29c7f2f0d216
SHA512 8f84250c6ca92a38693bcf3125eac4f7ac8a7492e09f3424d24e14dda3b42348d897f9fbe6b93c5b4a0e4a889dca7822dcc924dc6a332f0e796240e7989fc3bd
TLSH
T1BB5160E05C7C2AC1D0BE0E6FA48B38FC82ECC325F4A4357D6818EA88097921D748083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 32928efc456d8009f0ee5241cb69b1b39b138c47ac1cbd09483afada9ffa74a0
MD5 9072900bd29f29e99664f744b3155f92
SHA1 c5293f4d1ec7cc57c98f40a3bb3ce090c44f0a69
SHA512 d81d7642b8d4d7405088f0be1b8c3482ef1c8098fd83a5e7d6940e03b1b9f481db520f664a734a788906e1e478105c4ceea568f461c89323e5a22b18b389663e
TLSH
T1DF5150E15C7D1AC0E0BE0A7E608B38FC81ECC725F8A4307D6848EAC9097972D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6a4aecd4ed148884a63e4abae2168c52414a1142610b58465aa6bdca459952a3
MD5 73c8164afa45fac88a61daee9f231ec8
SHA1 4a8d70370da9180edb84ed7527fc645da7e6baaa
SHA512 6f4f439006a7fb81fcd68936c2d3baf32e2abf509eae7e7e7e57e694a1818bd5c0fb783d1c3f84bab342dcf6fa8765809a161b3a28f55b6d068315418f35c28b
TLSH
T1A55130E15C7D1AC0D1BE1E6E648738FC81ECC726F4A4347D6818EAD90A7961D648087F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 95545baeba6411f693a6218f89724424712e70b48a7c5c4cc3128e5284ed7920
MD5 a959a12ea6a6d6dd46575a00c4837fec
SHA1 a5c810b2489ba4833c66b920d2aa3afe865367a2
SHA512 828992f9015cbf45747db542ae3639dd112c613c366eb6cccb9559afc0b32645bb5c3b16a1f3a4c39775af8c9fa98631822a46d4d8ae3dac0cc9990b0dc99974
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3H:CebAjOKn3wRKRJ3H
TLSH
T1C8D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.old_1780105201

Path C:\Users\Admin\AppData\Local\Temp\2026-05-30_9924cebc8a6b0251175223205b7b7555_akira_glassworm_rusty-stealer.old_1780105201
Size 2.7MB
SHA256 a359489912b7d86f824c5cf84d3e7949268ab75c6349b4d554c64544873a0654
MD5 493426e2466bd83a0c19d432808ed433
SHA1 d273dd049c3186a7b99d5cc98eebf1c241df89cf
SHA512 4208141f41b115b758c1083a01eba416bfa99dfbbb19a0532f549b27a74d724a80bfbfa005a18cbcf9a4df7f31dc451e51de5379019f7b7900d03903a2fbdd26
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3G:CebAjOKn3wRKRJ3G
TLSH
T132D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1760039373\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1760039373\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1939580839\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_523413981\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3616-199-0x00007FF7DFE80000-0x00007FF7E0141000-memory.dmp

Download

memory/3616-173-0x00007FF7DFE80000-0x00007FF7E0141000-memory.dmp

Download

memory/3616-261-0x00007FF7DFE80000-0x00007FF7E0141000-memory.dmp

Download

memory/3616-304-0x00007FF7DFE80000-0x00007FF7E0141000-memory.dmp

Download

memory/3616-321-0x00007FF7DFE80000-0x00007FF7E0141000-memory.dmp

Download

memory/3616-252-0x00007FF7DFE80000-0x00007FF7E0141000-memory.dmp

Download

memory/3616-245-0x00007FF7DFE80000-0x00007FF7E0141000-memory.dmp

Download

memory/5420-189-0x0000018B00000000-0x0000018B01000000-memory.dmp

Download