7bbb7af89baf2c954ebb4e426c6f3f691dc025e343eb0966f1aad930ab623a75

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260602-cray9abw6w
SHA256 7bbb7af89baf2c954ebb4e426c6f3f691dc025e343eb0966f1aad930ab623a75
MD5 5a2c62d80520c7a62a3a6e317afb77bb
SHA1 ce3ae939bd39100c7e72c6550da15b43307bbfdb
SHA512 4e931a2b4a182afccc3d2c550a399fcf5e05afc15d2e1454ed4451a04f4804e50a884e4294c5b6efe5fe74b5c9f86d5581480b627a5c3d2b7854406b32a3bfc0
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ39:CebAjOKn3wRKRJ39
TLSH
T129D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2744	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248402936617675"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{73C31108-8B3A-4D8F-9D89-4A541DF1AAC2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5184	2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2616	wmic.exe
Token: SeSecurityPrivilege	2616	wmic.exe
Token: SeTakeOwnershipPrivilege	2616	wmic.exe
Token: SeLoadDriverPrivilege	2616	wmic.exe
Token: SeSystemProfilePrivilege	2616	wmic.exe
Token: SeSystemtimePrivilege	2616	wmic.exe
Token: SeProfSingleProcessPrivilege	2616	wmic.exe
Token: SeIncBasePriorityPrivilege	2616	wmic.exe
Token: SeCreatePagefilePrivilege	2616	wmic.exe
Token: SeBackupPrivilege	2616	wmic.exe
Token: SeRestorePrivilege	2616	wmic.exe
Token: SeShutdownPrivilege	2616	wmic.exe
Token: SeDebugPrivilege	2616	wmic.exe
Token: SeSystemEnvironmentPrivilege	2616	wmic.exe
Token: SeRemoteShutdownPrivilege	2616	wmic.exe
Token: SeUndockPrivilege	2616	wmic.exe
Token: SeManageVolumePrivilege	2616	wmic.exe
Token: 33	2616	wmic.exe
Token: 34	2616	wmic.exe
Token: 35	2616	wmic.exe
Token: 36	2616	wmic.exe
Token: SeIncreaseQuotaPrivilege	2616	wmic.exe
Token: SeSecurityPrivilege	2616	wmic.exe
Token: SeTakeOwnershipPrivilege	2616	wmic.exe
Token: SeLoadDriverPrivilege	2616	wmic.exe
Token: SeSystemProfilePrivilege	2616	wmic.exe
Token: SeSystemtimePrivilege	2616	wmic.exe
Token: SeProfSingleProcessPrivilege	2616	wmic.exe
Token: SeIncBasePriorityPrivilege	2616	wmic.exe
Token: SeCreatePagefilePrivilege	2616	wmic.exe
Token: SeBackupPrivilege	2616	wmic.exe
Token: SeRestorePrivilege	2616	wmic.exe
Token: SeShutdownPrivilege	2616	wmic.exe
Token: SeDebugPrivilege	2616	wmic.exe
Token: SeSystemEnvironmentPrivilege	2616	wmic.exe
Token: SeRemoteShutdownPrivilege	2616	wmic.exe
Token: SeUndockPrivilege	2616	wmic.exe
Token: SeManageVolumePrivilege	2616	wmic.exe
Token: 33	2616	wmic.exe
Token: 34	2616	wmic.exe
Token: 35	2616	wmic.exe
Token: 36	2616	wmic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 460	5184	2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe	80
PID 5184 wrote to memory of 3900	5184	2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe	82
PID 3900 wrote to memory of 4460	3900	msedge.exe	83
PID 3900 wrote to memory of 2744	3900	msedge.exe	84
PID 3900 wrote to memory of 3968	3900	msedge.exe	85
PID 3900 wrote to memory of 3968	3900	msedge.exe	85
PID 3900 wrote to memory of 3968	3900	msedge.exe	85
PID 3900 wrote to memory of 3436	3900	msedge.exe	86
PID 3900 wrote to memory of 3436	3900	msedge.exe	86
PID 3900 wrote to memory of 4668	3900	msedge.exe	88
PID 3900 wrote to memory of 4668	3900	msedge.exe	88
PID 3900 wrote to memory of 4668	3900	msedge.exe	88
PID 3900 wrote to memory of 1092	3900	msedge.exe	89
PID 3900 wrote to memory of 1092	3900	msedge.exe	89
PID 3900 wrote to memory of 1092	3900	msedge.exe	89
PID 3900 wrote to memory of 3576	3900	msedge.exe	91
PID 3900 wrote to memory of 2384	3900	msedge.exe	92
PID 3900 wrote to memory of 3576	3900	msedge.exe	91
PID 3900 wrote to memory of 3576	3900	msedge.exe	91
PID 3900 wrote to memory of 2384	3900	msedge.exe	92
PID 3900 wrote to memory of 2384	3900	msedge.exe	92
PID 3900 wrote to memory of 2396	3900	msedge.exe	93
PID 3900 wrote to memory of 2396	3900	msedge.exe	93
PID 3900 wrote to memory of 2396	3900	msedge.exe	93
PID 3900 wrote to memory of 2052	3900	msedge.exe	94
PID 3900 wrote to memory of 2052	3900	msedge.exe	94
PID 3900 wrote to memory of 2052	3900	msedge.exe	94
PID 3900 wrote to memory of 4620	3900	msedge.exe	95
PID 3900 wrote to memory of 4620	3900	msedge.exe	95
PID 3900 wrote to memory of 4620	3900	msedge.exe	95
PID 3900 wrote to memory of 4480	3900	msedge.exe	96
PID 3900 wrote to memory of 4480	3900	msedge.exe	96
PID 3900 wrote to memory of 2892	3900	msedge.exe	97
PID 3900 wrote to memory of 2892	3900	msedge.exe	97
PID 3900 wrote to memory of 2892	3900	msedge.exe	97
PID 3900 wrote to memory of 5916	3900	msedge.exe	99
PID 3900 wrote to memory of 2488	3900	msedge.exe	100
PID 3900 wrote to memory of 5916	3900	msedge.exe	99
PID 3900 wrote to memory of 2488	3900	msedge.exe	100
PID 3900 wrote to memory of 724	3900	msedge.exe	102
PID 3900 wrote to memory of 2236	3900	msedge.exe	103
PID 2236 wrote to memory of 5716	2236	msedge.exe	104
PID 3900 wrote to memory of 692	3900	msedge.exe	105
PID 3900 wrote to memory of 692	3900	msedge.exe	105
PID 3900 wrote to memory of 5988	3900	msedge.exe	106
PID 3900 wrote to memory of 5988	3900	msedge.exe	106
PID 3900 wrote to memory of 6048	3900	msedge.exe	107
PID 3900 wrote to memory of 6048	3900	msedge.exe	107
PID 3900 wrote to memory of 1864	3900	msedge.exe	108
PID 3900 wrote to memory of 1864	3900	msedge.exe	108
PID 3900 wrote to memory of 1860	3900	msedge.exe	109
PID 3900 wrote to memory of 1860	3900	msedge.exe	109
PID 5184 wrote to memory of 2616	5184	2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe	110
PID 3900 wrote to memory of 5640	3900	msedge.exe	112
PID 3900 wrote to memory of 4208	3900	msedge.exe	113
PID 3900 wrote to memory of 5604	3900	msedge.exe	114
PID 5184 wrote to memory of 2104	5184	2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe	115
PID 3900 wrote to memory of 4948	3900	msedge.exe	117
PID 3900 wrote to memory of 4948	3900	msedge.exe	117
PID 5184 wrote to memory of 5700	5184	2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe	121
PID 3900 wrote to memory of 1544	3900	msedge.exe	123

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2104	attrib.exe
5700	attrib.exe
460	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.old_1780366690
  2⤵
  - Views/modifies file attributes
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2fc,0x7ffcae22c188,0x7ffcae22c194,0x7ffcae22c1a0
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,2426166329237648205,129429140026860017,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16232936951748145760,6962556434755526687,262144 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,13873379033826728295,14825010014938504604,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,9702795382575452290,9935808202284357033,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,17774081771260011848,17218901247659857705,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,8996294357290332604,2439919836631764167,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,1989042463179920643,10556218322216838783,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4348,i,3063969798734237803,5629532345816893990,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4344,i,14410955125743238669,3785535127442701839,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5400,i,15695079326892943971,1185239983513910104,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:9
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,5854675742601779016,7432462749911779238,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5792,i,16830416941681090614,1648419440938606613,2097152 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:15
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,14628977967164179353,7132727129999439380,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5445583943755592083,17672604179866882077,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,2958091847170980107,11206567567317817085,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,2958091847170980107,11206567567317817085,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,655756309938541675,12979141138948534940,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8737683447873142336,6357699942718226300,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,8994455647341389499,5698029904352607665,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,15761815142562437171,9095502419716886059,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,6052085024710138419,17687738128879366884,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,4041496217608068836,17758429951284362318,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,12297749984156840966,15913599639728550858,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,5482415863377969163,11689262176992732040,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,8293522220216021666,13143738687538973308,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,17194256726013374048,16926014980390143035,524288 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6032,i,2153393543946277868,17968179139496057462,262144 --field-trial-handle=2360,i,10763104618171327794,6204408315951248637,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1544
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.old_1780366750
  2⤵
  - Views/modifies file attributes
  PID:2104
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.old_1780366810
  2⤵
  - Views/modifies file attributes
  PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

60892e66-9552-49d3-8f52-57615f81655c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60892e66-9552-49d3-8f52-57615f81655c.tmp
Size 14KB
SHA256 6db01701e743f1e62ad8df22d1565e555a66d96d0868afa1279f74542d31c60d
MD5 5c389956cd4e4b8204d5ded33ac0c80f
SHA1 8160c9069e8a9e25ed33ced7f9ab3bbfbbbc7262
SHA512 e0b29abf3db1b8121c0f0bcc472b44a9182ba59c275c98ba3d9681066d17b149452a39101790712e17b1004391962d1900892726b943932af610450d94cbfc47
SSDEEP 192:sxZ5QUnzRPyM/jK1Ml8McY/fGsvKLDypp3zHgCodpyb2/W6+WNGY0oKOwSc7Ig4J:sxZxnzp0Y/fGsiLDMZbMo2/bG5/Oyc
TLSH
T1D662D816BA346977DCDBD219F946BF53D6F81572A6900D44A9FC9B0C00E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d300fd6b67c4763c754147c27816829085197bf050c3f9e8019ae6e034349cf7
MD5 177201b59591e5a647881005c9eba0fb
SHA1 d82669a1326748292c15ff9a5abddd79004bd2b1
SHA512 4c8ee9416653ccd9144a0c12c79e355658f0c4b679fd679301d36aaaf82353b4fb8fea60db453f269cdfbc806907fa7604389de4bf3c070eb92e324c9247651d
TLSH
T18271713481BF6E43DF612137E4C102CC35B1849A4B074EDA5A589DB76912BE7FDDB408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d03c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d03c.TMP
Size 3KB
SHA256 c670ccf0a4d2a59c070b18532d0c14e0caf61044f51d26839c5a899626a094db
MD5 60b9523acf57390e039996dd1118b1f5
SHA1 3d34cdd1cade3ec1229c25356d918eab90f7da8e
SHA512 dded7696dd05d08264507b6836467c1440de61efb5620dfb524d6052ecd12d39d7a58ccbfb1e4e01c85365bef3045f189997f43d92630f6099a92ca850564ea6
TLSH
T1C0716F7481BFAE83EF602033E0C102DC35B184995B478ED95A548DB77906BE6FDDB408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 961d3505fc2acdbeb4b74e3ed352014b82c9572c222399efa6d5a48710afd1ea
MD5 e3379d93ec63298a032c643b20f332ec
SHA1 c205aedb4541c97ef78a576fcd1d8296d78c7ed6
SHA512 b14a13cad19ba0b97f2ecc3b8d87296b2550e96bf85bad38bd20cc9a70e52ddc412242d34b1d1ff03eb9646b264af585c6066f9c47242c36b7e37a325cf7abe5
TLSH
T12841CBF3C2E8856D8A0196F0BA187E2BCE1D0A54832C3D5AC8E4EF1B93F2470E10194E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7f75190d2f98ef4d29b56a7b9761b57b0ee303555af38601ff3d1865e4e86608
MD5 2b52b90c0f32e2386af136ef88e98f81
SHA1 3dc6c5cd335f7b123c77e6d79307eff23fcaa231
SHA512 01a10c154ebc570b8faa87a2c4ced47216dbc4cc6ddf9cb49ccb52eb7be76a0aad8ad425fb6ea2c7238b1b3870e765ea3518e4aa119679f2f7f64cee4109c7df
SSDEEP 192:sxZ5QUnzRPyM/jK1Ml8UQCcY/fGs/K/Dypp3zHgCodpEb2/W6+WNGY0oOOwRc7In:sxZxnzpqxY/fGsy/DMZbMm2/bG5fONS
TLSH
T1DF62D816BA345977DCDBD219F9567F63D6F8157296900E44A9FCCB0C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 50db205ae1db6acfef5eaecee338563d6f4341b549f218a139f97d626471ac4a
MD5 9f64f4477c451ed44632f103dfa820ed
SHA1 f710072fa3c97ba32c16f61eba49293bbfacbf2c
SHA512 0deb86a0eeb2eda71424a3db2bbeb827e95c9e55dfc6843b89edbc1ced2b642af81e96ad7564e72baf3e0966d74363f091b1bc82acf395729a12c8d4ffc2cdd7
SSDEEP 768:soc0s8Ww28R7pLuLX/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV38u6OLlp:soc0s8Ww28HEX/fWRm/JQg1u1jaK8u6I
TLSH
T17A031B3B2C0CCB7E4F844E9CED26BE9A6EE8018B6698895447FE444C03C76EB55164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f81484472cff4dc48ed116fbaf3af821a953a49476dbb9cb8f1b0cf783de8660
MD5 71b3be3156d11880403ec8de159c5b34
SHA1 50e371e5ea6500c9a834ba8aab0a28156c90041c
SHA512 722678e6ec8afde95e4c84a398009c7499f15205c55920722927331efdca5bb998a2a6297029ad070e99c878555e70fcdddc57a82326ff673592ff7f1680f38b
SSDEEP 96:KkWwK/qiaogKhSWaOEKzyImtmtjtFtttB:GfPjfZmtmxjHT
TLSH
T1C7912B92317A02423D3E2909A2D5EF5B5585B2933074F42B77D804B21DA7E642FFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59579c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59579c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 06901c7162093965250c6af32bdef23f1882e9af8b0841e41e8d051fc7ad9044
MD5 1d6b62beee7c61c37a4f5b07f400dd23
SHA1 1ff06fde7903885ac7c0a298fe919133c637385b
SHA512 b3f726b4c16502af656bb557c79d99186a4a73000fb59c0fbc0fbd416d15e9cbd2bc3027a2ee042ddb07916575bea60ffc7e2f5ab0a9a54284f65937d340ab14
SSDEEP 384:yTetNnNnb9l8N5VB456q7Uu8Ytusnju1F/SA+jXaRnPOgy:AejZbbW4V4Ct1nj2F/SAt1Ogy
TLSH
T109926C756978BC6769A3A254F65B3A53AF7811BB8CC03E94DAEC5B0E00D724C2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cde2f18bca2dd1d378f3ea3ffb72e4def1aae4ada193e0110204e15aa2239569
MD5 397e0d7e70241987e57b10aac1712d8f
SHA1 b72c8b113733c3a4ffa259517de4f8e058772309
SHA512 39464b43c019811ee07fd9ce1ca88a3e1819dc71f651929300c1743d61b8f0302a633a580aca9652cfca02cb694b4373e34cf848829b2a13743589ba58186b76
SSDEEP 384:yTHiFctNnNnb9Q8Nb8TUNTUlIl6B456q7qDfQ/u8YtusnjuUjF/SA+jXaRnPOgy:ACFcjZbWGwgo4VN/Ct1njLjF/SAt1Ogy
TLSH
T178C22976D8A4EE2BADE39785B70B36979FE401A789C86DC4DAD81E0D00D329D130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d4773dac20da8b4424106285dfc5ed456298d24d7964b6ccf6a3df6f4f25186a
MD5 ec0889ab0675656fe4332d2669ecf3bb
SHA1 16eaf19fd354842130730847d1598db258f245ea
SHA512 ddc125d5c278492cb1339d58a5781e8680a8cc7441c48d19334e63dd83b71ec364f74bc859323463d254e3476e04b192782e63784db170cb6fbbc2eaae25c865
SSDEEP 384:yTttNnNnb9l8N5JB456q7Uu8Ytusnju1F/SA+jXaRnPOgy:AtjZbbG4V4Ct1nj2F/SAt1Ogy
TLSH
T12A926C756978BC6769A3A254F65B3A53AF7811BB8DC03E94DAEC5B0E00D724C3307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3f037799b1c8dc234041a6a6808d900d4b7595438b345d8a6153ad73ea591c67
MD5 31c9e17426784cf84273cee4723cfae3
SHA1 ca5bfbea467d258e5ed956d9daf55aaf843c5c20
SHA512 f6dd20ebeb7e921fd4d2346ba5b1d78ef577fd264362b77ce7396eeef9cd10c7508bd1389170ee038fc37832ddddfef416f148179fcd269a2d453db3e02ae193
SSDEEP 384:yT9tNnNnb9l8N56B456q7Uu8Ytusnju1F/SA+jXaRnPOgy:A9jZbbN4V4Ct1nj2F/SAt1Ogy
TLSH
T100926C756978BC6769A3A254F65B3A53AF7811BB8DC03E94DAEC5B0E00D724C3307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 da360eeae00ae42a7b049a8b8086c5ab7b020bfa61ab802a3a438f5e2c5ebd1b
MD5 a4b8c0162fa0cead4cd844b2aab7e8fb
SHA1 13dc2b8870f0955ea0eebd87d66c9f6dad738cee
SHA512 4bcf8d42e64f4c056de64c322d35f1901c030832a25628204a23248faa3e0b103cbdb3f27338c72cf00d7f11b1d0e3ba0e112b3cfde235ecf1dfff913207afc2
SSDEEP 192:XGNL6jCQmiUyVIgf4SufoPxzYSSus6nImsCSngxDU6:XGNL6qa7fju8Ytusnf8DU6
TLSH
T16E02C9756C687C6BAFB36E45F9873B135FA4212BEA852F44CAE81F0C00D725C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 05a19bbb3f6b529e42a5f909dcab5467bb5f7d74612c726d90beda7824751f81
MD5 58e667b7151022cdb7eb5e2c780916ac
SHA1 daf899907037a2e070ebfa788f39873ecd9f9795
SHA512 7a2eb26b83c7265aa054ea998a63ded876edc84f09620e29440f069494a2a8d25c19acf428f07f76b3b2c58ad62c2fa70501696c2d6a80dc3a496f6ebbf9adf6
SSDEEP 384:yTHiF6tNnNnb9v8NE8TUNTUlIl6B45fq7qDfQ/u8YtusnjurKF/SA+jXaRnPOgy:ACF6jZbNjwgo44N/Ct1njIKF/SAt1Ogy
TLSH
T1BAC22976D8A4EE2BADE397C4F70A36979FE411A789C82DC4DAD81E0D00D329D230BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9fa65fb5894f4a6addefb2aab7033702dcdc147abe5a852583ead1c3aa112a49
MD5 e97b216f54300206fbcb52bd39c43335
SHA1 1c1c02165e9a9283112cc527dc558e98dec06673
SHA512 7f715589a4a4e4699b914810e85364def21acc5752586a0b7c95028b25cdf70087878692af7909564806f5b04abb4af787fd70d875cdcbc18112894fcdc46c28
SSDEEP 192:XGN86jqQmiUyOgZ4SufoPxzYSSus6nIms4SuyUOMPqn8LU6:XGN86KYZju8YtusnjudFU6
TLSH
T11212F975A86CFC676EA37598F5C736639FA92037DD856F44D6E81F0C00DA258330AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a868d60e-4c64-41a3-a14f-34305163e5b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a868d60e-4c64-41a3-a14f-34305163e5b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 1227fd486fef9420d2ddb716351e930264f1beb55b45e332cf4eb714930fec64
MD5 673d103566bfb5ae15c7c1afa56daece
SHA1 6aee7ce195503cb5d5e5ed7158606c2485096b01
SHA512 8e71d5e1f0845846cdd657069da980d01d8eb5b21fc83b3a90bc672402a66313969c617af424845b59869471e35669d34d9a612e6e83b5b837849a86bdef43ab
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3Z:CebAjOKn3wRKRJ3Z
TLSH
T101D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.old_1780366750

Path C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a2c62d80520c7a62a3a6e317afb77bb_akira_glassworm_rusty-stealer.old_1780366750
Size 2.7MB
SHA256 15f073a3c510b55a92b72636963fa93e9cc41d5a033b0f45463f2b05fd46d97e
MD5 f4dcc02c9022d5ee5a3a02a71127d915
SHA1 31bd50cf0312918e354df406838a46642f997fdc
SHA512 19ffbe5b9e06c5e2d20d80337fb6bc2f6ebc5c68b86a03d596be643de5a35c45a392e04c52eb1e598950edf1847f9ee8afdfb0b2a6e6756a2763bbfd60e8c213
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3v:CebAjOKn3wRKRJ3v
TLSH
T170D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aceb1e23-aff5-42d2-9dc2-75acb83a4302.tmp

Path C:\Users\Admin\AppData\Local\Temp\aceb1e23-aff5-42d2-9dc2-75acb83a4302.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabc5ce7-e053-40b2-b1b5-3a110398d040.tmp

Path C:\Users\Admin\AppData\Local\Temp\cabc5ce7-e053-40b2-b1b5-3a110398d040.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3900_1181664601\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c325aca8-4fde-4256-9a92-d44fd1a79e50.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3900_1427935614\c325aca8-4fde-4256-9a92-d44fd1a79e50.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5184-430-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-332-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-294-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-413-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-357-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-378-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-432-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-441-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-442-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-453-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-385-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-361-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download

memory/5184-470-0x00007FF682900000-0x00007FF682BC1000-memory.dmp

Download