ef4956deb288de0ad9501b04ff217dbb8b40de958402b05e11538d16d7d516e8

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260629-c9dsvsbw4y
SHA256 ef4956deb288de0ad9501b04ff217dbb8b40de958402b05e11538d16d7d516e8
MD5 ce134b73790680a173886b97a4807e3a
SHA1 ebf13e9329707924c55daee379fb6c6932495bfe
SHA512 7bfd71d0222ca38e0db5e27812c3159036a037b8ddc9065aee8cc91d070402d7a0cab2e248b41f6c04d8dc004e8c807a1ea17f39de0f917708b6e4f2cf632a5f
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3y:CebAjOKn3wRKRJ3y
TLSH
T10BD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5788	msedge.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_118688894\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_319383887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_697609244\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_552019862\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_697609244\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_420346320\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_420346320\well_known_domains.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_118688894\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_319383887\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_697609244\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_118688894\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_118688894\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_552019862\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_697609244\kp_pinslist.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271747821430091"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3730367222-316663987-825798519-1000\{3978D8FD-8F19-4E32-9EBA-ED23AC68D7EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4896	wmic.exe
4896	wmic.exe
4896	wmic.exe
4896	wmic.exe
1628	msedge.exe
1628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6032	2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4896	wmic.exe
Token: SeSecurityPrivilege	4896	wmic.exe
Token: SeTakeOwnershipPrivilege	4896	wmic.exe
Token: SeLoadDriverPrivilege	4896	wmic.exe
Token: SeSystemProfilePrivilege	4896	wmic.exe
Token: SeSystemtimePrivilege	4896	wmic.exe
Token: SeProfSingleProcessPrivilege	4896	wmic.exe
Token: SeIncBasePriorityPrivilege	4896	wmic.exe
Token: SeCreatePagefilePrivilege	4896	wmic.exe
Token: SeBackupPrivilege	4896	wmic.exe
Token: SeRestorePrivilege	4896	wmic.exe
Token: SeShutdownPrivilege	4896	wmic.exe
Token: SeDebugPrivilege	4896	wmic.exe
Token: SeSystemEnvironmentPrivilege	4896	wmic.exe
Token: SeRemoteShutdownPrivilege	4896	wmic.exe
Token: SeUndockPrivilege	4896	wmic.exe
Token: SeManageVolumePrivilege	4896	wmic.exe
Token: 33	4896	wmic.exe
Token: 34	4896	wmic.exe
Token: 35	4896	wmic.exe
Token: 36	4896	wmic.exe
Token: SeIncreaseQuotaPrivilege	4896	wmic.exe
Token: SeSecurityPrivilege	4896	wmic.exe
Token: SeTakeOwnershipPrivilege	4896	wmic.exe
Token: SeLoadDriverPrivilege	4896	wmic.exe
Token: SeSystemProfilePrivilege	4896	wmic.exe
Token: SeSystemtimePrivilege	4896	wmic.exe
Token: SeProfSingleProcessPrivilege	4896	wmic.exe
Token: SeIncBasePriorityPrivilege	4896	wmic.exe
Token: SeCreatePagefilePrivilege	4896	wmic.exe
Token: SeBackupPrivilege	4896	wmic.exe
Token: SeRestorePrivilege	4896	wmic.exe
Token: SeShutdownPrivilege	4896	wmic.exe
Token: SeDebugPrivilege	4896	wmic.exe
Token: SeSystemEnvironmentPrivilege	4896	wmic.exe
Token: SeRemoteShutdownPrivilege	4896	wmic.exe
Token: SeUndockPrivilege	4896	wmic.exe
Token: SeManageVolumePrivilege	4896	wmic.exe
Token: 33	4896	wmic.exe
Token: 34	4896	wmic.exe
Token: 35	4896	wmic.exe
Token: 36	4896	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5788	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 1108	6032	2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe	91
PID 6032 wrote to memory of 5788	6032	2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe	93
PID 5788 wrote to memory of 7100	5788	msedge.exe	94
PID 5788 wrote to memory of 1812	5788	msedge.exe	95
PID 5788 wrote to memory of 2000	5788	msedge.exe	97
PID 5788 wrote to memory of 1812	5788	msedge.exe	95
PID 5788 wrote to memory of 1812	5788	msedge.exe	95
PID 5788 wrote to memory of 5592	5788	msedge.exe	98
PID 5788 wrote to memory of 5592	5788	msedge.exe	98
PID 5788 wrote to memory of 5404	5788	msedge.exe	99
PID 5788 wrote to memory of 2196	5788	msedge.exe	100
PID 5788 wrote to memory of 5404	5788	msedge.exe	99
PID 5788 wrote to memory of 5404	5788	msedge.exe	99
PID 5788 wrote to memory of 2196	5788	msedge.exe	100
PID 5788 wrote to memory of 2196	5788	msedge.exe	100
PID 5788 wrote to memory of 1920	5788	msedge.exe	101
PID 5788 wrote to memory of 1920	5788	msedge.exe	101
PID 5788 wrote to memory of 1920	5788	msedge.exe	101
PID 5788 wrote to memory of 4208	5788	msedge.exe	102
PID 5788 wrote to memory of 4208	5788	msedge.exe	102
PID 5788 wrote to memory of 4208	5788	msedge.exe	102
PID 5788 wrote to memory of 1068	5788	msedge.exe	103
PID 5788 wrote to memory of 5232	5788	msedge.exe	104
PID 5788 wrote to memory of 1068	5788	msedge.exe	103
PID 5788 wrote to memory of 5232	5788	msedge.exe	104
PID 5788 wrote to memory of 1832	5788	msedge.exe	106
PID 6032 wrote to memory of 4896	6032	2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe	109
PID 5788 wrote to memory of 5644	5788	msedge.exe	113
PID 5788 wrote to memory of 4596	5788	msedge.exe	114
PID 5788 wrote to memory of 3964	5788	msedge.exe	115
PID 6032 wrote to memory of 4340	6032	2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe	116
PID 5788 wrote to memory of 5936	5788	msedge.exe	118
PID 5788 wrote to memory of 5936	5788	msedge.exe	118
PID 5788 wrote to memory of 3824	5788	msedge.exe	120
PID 5788 wrote to memory of 3824	5788	msedge.exe	120
PID 5788 wrote to memory of 1100	5788	msedge.exe	121
PID 5788 wrote to memory of 1100	5788	msedge.exe	121
PID 5788 wrote to memory of 1816	5788	msedge.exe	122
PID 5788 wrote to memory of 1816	5788	msedge.exe	122
PID 5788 wrote to memory of 1444	5788	msedge.exe	123
PID 5788 wrote to memory of 1444	5788	msedge.exe	123
PID 6032 wrote to memory of 5812	6032	2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe	124
PID 5788 wrote to memory of 1628	5788	msedge.exe	126
PID 5788 wrote to memory of 2692	5788	msedge.exe	127
PID 5788 wrote to memory of 2692	5788	msedge.exe	127
PID 5788 wrote to memory of 2560	5788	msedge.exe	128
PID 5788 wrote to memory of 2560	5788	msedge.exe	128

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1108	attrib.exe
4340	attrib.exe
5812	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.old_1782701178
  2⤵
  - Views/modifies file attributes
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffda3aec188,0x7ffda3aec194,0x7ffda3aec1a0
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,14726254043076014448,9588814869385261810,262144 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10412798480468769395,3999673632693166891,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,14277235866624224808,290206693491451711,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,9567714064491932189,9929852757727203004,2097152 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,11913766649284096217,12126894129281724355,2097152 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5040,i,11679060412197405779,11586126924947412387,2097152 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:9
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5308,i,11845310649618043086,17016968094398495684,2097152 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:15
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,1040455102495948240,9560700990647547515,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,13565840779401010267,7133551413413399442,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,16088141067948286641,14526839527438917976,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,16088141067948286641,14526839527438917976,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,1650893921585789767,14633127470212517284,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,12631732292674955634,10887781079711611701,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,11976440454452949505,12774391738292015418,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,10947821453059337851,12528788132838434456,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,13040174962452594410,14858614384137275943,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,1228342986011577449,6735117540331469688,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,1000776403002873865,16696717830602234831,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,3586547256832840318,4503101848492195673,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6340,i,4999817855681926252,6273782972522139346,262144 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,3098774385773830032,2916552709531090013,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,18424769630680696331,17935480243201352801,524288 --field-trial-handle=2288,i,14462406385148012153,12903023039346617145,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:14
    3⤵
    PID:2560
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.old_1782701238
  2⤵
  - Views/modifies file attributes
  PID:4340
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.old_1782701298
  2⤵
  - Views/modifies file attributes
  PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:52

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7250e4ddb51fa53ec8c4b9199831864f7ff3c5cca1fbf2e4e5086ae0576d31e1
MD5 d67d9caab78f31b2ab2ae61fc88b12e8
SHA1 c439af9d2a4c79b1936d0b654cdf2b2a6da22a5c
SHA512 f8e3ffb5bbcb1740ce2b25ded24b3be72c6285c98433cf97d12acea2ff455dd8da18d81f9348060457962fde88e3e33b5654dc94e329100848cdec215f571788
TLSH
T1C3D0C0513B2DB402C1241330882343706D09C503E332C10635BD140CDCDA4C4A3C1547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fbfdc6639449912c7c98b931d8190c5dc58f3c2a0bf5687e437a1f10d8fb4d03
MD5 0648a8cda5509f4d21f145a8d2e85107
SHA1 0098998314a76ff86c61b0ea846ab42ba2d245f1
SHA512 d12c9f38e4b1be9f515149cbec2d53104d76f99eb87ea993bf787c888cea28fbc81e79244b64386a0c5a5111415c57c4251ad0e5528252f3302570bd3971bd56
TLSH
T1C1D0C0513B2DB402C1241370841343706D09C503E333C10639BDA40CDC9A4C4F3C1543
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a3f113a9f508fe3c7483f253fbaf4813baa28faf5d4da880effa0617b235702f
MD5 52d49d2142ce27e2261f026bc6bbc5ab
SHA1 f55feb4dd6911a330edd377930d4bed28941fef6
SHA512 ca7f5fba19af0aa918b87375b5972edd2c978fe207294ddb5976a9e5995e9d21c5602413a28d4e89e7e9f75e9f2e5a7c265c42d2340ba9967f0bd42fd8d94183
TLSH
T118F028B6D831AC3B18FC1B68A0A5074BEB9113172B80885F3A3D860D8FF567B458592C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b608882f66e35399dfa7b6a711506ec97ba3828555e599ec9c655878d9f10d3b
MD5 cb4d06217f56dbafa73154dbc7560b6a
SHA1 aead1c440faf143befd203fb0b719d3eeeea2234
SHA512 817be1a2ab86cb0a509a18a555cbcd970b74e1c474e4976b2ffd658be9553792de4f00b3a3ca1f4f13921a762ed480539b43e140fc7c3299f9f3e3ff7e97e33a
TLSH
T13971B390717702A5EB1246BC90E71DCAF7741D4947172EB934DC13B87802BC6ABAA4FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aac2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aac2.TMP
Size 3KB
SHA256 15ac09244b67f8637d2d727109a74656024538c19f6fa4315148dab5b16fc1c3
MD5 085600007ce00383b95109d77865b60e
SHA1 aad4bcd5e4250e745d4e25de00d70d266874f394
SHA512 ad570437ea55db91bf3a525efa6bb716a3b637bde7bfd1a111ecf8e079210b6d7bd235ae1769bf7428f1d6f5bddd97a3526892c2cd63ea56a385a9f446b01a78
TLSH
T1EB71A29071770264EB1445BD90E71CDAF7301D0907172EB934DC13B47802BD6ABAA0FB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3f150a5dac74b66ea80138f532c69b9546fac3f06e7b9c5020ffcf7b200bb589
MD5 1d985e88b113c8ca106497cab7ad2b77
SHA1 afdcd9c35a0d44a9bae684106500b9d09bd645fc
SHA512 f3b65f0c1c828954c2b5c07e0bc4dc2e164fd85c51d8d82eaba838453b572ca2714870f81d821166effc723aeeb2bf08c82f342e0f49a6cdc45f0d071f070ad3
TLSH
T1C251ADF7C3E8856DCA0196F0BB146E2BDE2D0914832C3D5A89E0AF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bbd24c365889295d8db8b581d2fbbfc20d944fd7be84c15bb9d9a4bb146b9ef8
MD5 6832d629ecfe5d4ebd2ccf4eca708526
SHA1 c6debe5e62567b89db9163c6ad7e63b8684c300c
SHA512 344993df54838c5abc580ec97f86340bfddde2368713d2e03b17273a84cc25600a657731ff532134f99cb197fac678b3106a6f697cdb8af2de0c3ad0e80e1caa
SSDEEP 384:sxRruCj/f7sBSz7QHVcKj/5IwOhTDfp+jHX:s3jj/fgS8cW/5ITHfy
TLSH
T1E372C819A938597BCCDBD219FA457F53D6F81563E2945E44AAFC8B0C00E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 856622c2385d6799db9a42fc92f3430f6b1d3bc756fb4d9c4766f6a240b012be
MD5 423acec9791ead6f162c6b19175a484e
SHA1 41ae5a62e3a4d77b6a57866a2423bf9090a94990
SHA512 60a1cbc9246447d36f96670389a51ace8050638a7ea6c89bbb1bfb90cefcc16b73c2ba9499740a4e212c94eed28389d71532a8652e42488ee8d98687aaf24bae
SSDEEP 384:sxRruqoj/f7sWwz7QHVcKj/5IwOhTDfp+9H1:s3Roj/fnw8cW/5ITHfW
TLSH
T1E172C819A938597BCCDBD219FA427F53D6F95573A2845E44AAFC8B0C00E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c57e18a571bcb07f187176b41aee3585ab201dbb868eb136e0128d3973e8f5ea
MD5 a5619ac784972be05ff16c303cdb2554
SHA1 daeca4a9172d637b2de391005d7f34f74d0c1a7d
SHA512 a21e12016ed03697077d0c4b199017a4db291f75cc8065023dcafd37de01ab8c70d6c5917025be9a7eba58715b3ab99134f5a465d3621479d6a4d42572c9a342
SSDEEP 768:hDiNNidNi/Jt7pLuL70DiEWg5Niuf+Xi08F1+UoAYDCx9Tuqh0VfUC9xbog/OVnC:hDiNNidNi/JbE70DiEWg5Niuf+Xi0u1Y
TLSH
T15AE2FC3B680CCB7E4F844E9CED29BE9A6DE801CB96DCCD5447EA440C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ac104e9ff7a4dd972947ce47feaf6d093c8603d519f1e612b497302581ed06e6
MD5 af343b281e87aef22754c4c92159c3d3
SHA1 ab03eed8954d92886e17dd5795a16b5cb5d581e7
SHA512 3f5bb19d2222e49ffa3f2c255adb529ef7a8bb495d59ff7324bd25f1877bdef09400f6334086a963b32360ff777d873aef7acd6d5fbf17726097e4cd53d051ff
SSDEEP 384:TFUxVXrvC7WZd5J5PClV2Hlftp113RFJlbDNOzhn9:TFUxVXrvC7WZd5J5PClV2Hlftp113RFO
TLSH
T150B23810797E224138FE690CE1A5951F274230B3305AA63B7B7D64E60EA7E005FFD9E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 45d1a872834888f373fee341accd1420dd79ba188175b5a193f577149e7694b2
MD5 9fc55b6d99cd46e07a8a7eb4d6f5cc83
SHA1 ba1c0b5d9da156e28e2b1f93389110a345347101
SHA512 18327946e9cd60d849391e8955ede4e4e5ebac0d94563c45f6b226cfb5d4fa784ebebca68180036a29d9e9ed746f0b38a79d398e2abb2b20c1deab05f189ed8f
SSDEEP 384:n9iF1tNn/s3n9Sd8Nm8TUNTUlIRBu64tjRXfLFol9j9Cs4tdNrITGT0IkXaf8LkS:0F1j+9YDwgi7ToT9Shri+0PXaRv2
TLSH
T1DEC24A72DC64DABBEDF69FD5B709770AAEE002A3C19859C8DAD95D4C00832DD1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d5d8f6d4763f047d97ed1a24d4746eb3090aa0673dfc8ca0bbfdf6af2422c74b
MD5 d83f3b8be00390e7458a55ee681e1c85
SHA1 d7b6b1e22b487a429f41124217ec8ae1bb5952aa
SHA512 20e608a1e6601ed52450d88538b692bc4eb2c9208e95afa4297a5f37e22fd5df40fe72b0063015b10229380b6e4cddb20650c635a1d5d9e773515ec90d5e0e4e
SSDEEP 384:nDiF1tNn/s3n9Su8Np8TUNTUlIRvu6GGiuRXfLFol9j9Cs4tdQXVmSmn15wbAjEm:uF1j+9PYwg4o/oT9S8VmSmn12bfJHM
TLSH
T19BD24A72DC64CE77ACE68BC9B34A3746EEE041A3C5885AD8D9D85E4D00D32DE130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4c6f28466379e0c03df05403aa5fb91e358da05bf58b2f0694ed065218abbb3e
MD5 46b4d6ada9bdf26cea23982574dc4492
SHA1 8e39eeabd092dbbdead3013e86f3799fa1931fc0
SHA512 22f596bae610e3e937e4b8a8455c4d250710bf7c67b7679bb16839a97d0bfd36bf038793525089f16990ef00eda472c6fd8d588576773932f8c5a54127e726a4
SSDEEP 384:nsiF1tNn/s3n9Su8Np8TUNTUlIRvu6GGiuRXfLFGl9j9Cs4tdQXV+Smn15wbAjEm:XF1j+9/Ywg4o/GT9S8V+Smn12bfJHM
TLSH
T112D25A72DC64CE77ACE68BD9B34A3746EEE041A3C5885AD8E9D85E4D00D32DD130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ec19502e4e0c44ffec9a3deb9cf4b38a5b819ca2dc68eb68c26fb92380deb112
MD5 98887b4ef89a6bde86be1883b50be93e
SHA1 64db162e5497ec616cdd79fd761b11012e17e6ea
SHA512 9fbe2d1637d4fdcc4dfa3b685005d07f3d697bb5140c76591ccd311d0e3f478f5832a820ab345f218055767439ddf35d52bf54d774dff4a32220b82437794a37
SSDEEP 384:nxiF1tNn/s3n9SU8Np8TUNTUlIRTu6IGiuRXfLFol9j9Cs4tdQXV5Sjb8Lk1Iz5U:YF1j+9hYwgQq/oT9S8V5SjUv8
TLSH
T15EB22A32D864CE77ACE68BD5B74A3646EEE011A3C5C85ED8EAD95D4C00C72DE070BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 43d9d7f422353ab6287101d7acc431a6c7e8bdbabfb18b33af64baa092b288d2
MD5 0d42f16d5d584cea6755d4dd93efdd67
SHA1 e161d9d869dc260514b4bb229c72391bfb6f24a3
SHA512 c340c0ccf898f5c643944358f3757813e4d002874babe65e7a4bfd88bc03ee75c56ab38d0811db0fb05b5059ce85ffd19465be588c614fe615e224d41c4484dd
TLSH
T1A93140E1583D1ED2C4BE0CAFA09B39FC94D8C326F5A470796894ED98563DA5E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4c99b32264b072075b678776596dc68b163c214700a9b29b6ae29682fb781408
MD5 1c717b0945f2b2957ac469ae1840bd9b
SHA1 9a67ffce7feaecf356929f21064b5f124ba4827b
SHA512 7dfe11afa18739272a6f5bd8a93a93451ee878a872181bb2a513b97dc59cdf7b51627765fc94018b0181b31e23dc2a2dcaa78683d7b8784bde7cc0c1f3cc5ee8
TLSH
T1E2312FE098382ED2C4BE0DAFB09B38FC94D8C726F594347D6864E898463DA5D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8f3f529ddcc30acdfcfae833343bdc0b63ed422f30e1e6277347faaaab6631d3
MD5 9bafb2ddffbf8758e8372efaf16ca836
SHA1 6848c227df7af60869b3332a92b22d7be63b3a55
SHA512 3dc125ed4c0da71e42265770ee65296052eb2bd7940aefef2759ac9f3a03c2fe61f3dd6c3d8e601422175d7b1170512666465ff7e0884988ad4d02946b1b723c
TLSH
T1E03141E1583C1EC2C4BE0DAFA09B39FC94D8C326F5A470392898ED58523D65E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 14462839ffd555bc98546f8d1b3e4dd6f030c03d221ee9448551c897d9a91e26
MD5 8434b4164633ce185686875427fefa9a
SHA1 a757fc320952c7ac5a3fee1b35249af99f4b609e
SHA512 e4cc648fe7a58cf0905bb3291e9ca95b28f316c781eb6503882ca524da3450d63ef339071b02954afb63c14a011d8696c39946ac0ec29cd0632a671654bcbe7c
TLSH
T12A3161E0583C2EC2C4BE0DAFA09B38FC94D8C726F5A4347D6854EC98463D55E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 e8df3525cfd0533401e1309d6ba7653a44cf6a0b989d5891e4447eb0247718a0
MD5 28832aed4a68fe9e1555dbb504fb2807
SHA1 049481e0fb3f713fdf9e4139d503dff58ab7ba23
SHA512 4642dbdd3fb1c2b318ccc970225814f6c70dd254e58e7bb01efc99fff10b3ad1501712ceb43f9af590af3ca9b00e4506a2f6618d26f0546663676a0dc9fe8841
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3Q:CebAjOKn3wRKRJ3Q
TLSH
T172D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.old_1782701238

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce134b73790680a173886b97a4807e3a_akira_glassworm_rusty-stealer.old_1782701238
Size 2.7MB
SHA256 d8cea116176deaa9ec25ad787bb68c9e079ea3882cb9c55cb9a8caf207220e74
MD5 55d8759779823f1ed4ae4d25021dd3d9
SHA1 d85a53f5c0abec215ccd340e808b33e0d63fdd49
SHA512 406fda725148ddb4dcf2df0cdd672febfd8415c88d11ff8dc90d57f6932f85fb7620712f565bf868f76e336559d5176fc50f90bef72795ce53f92631fc7767d0
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ31:CebAjOKn3wRKRJ31
TLSH
T1DCD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1743065985\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/6032-206-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-237-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-346-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-363-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-238-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-380-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-388-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-212-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-410-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-425-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-196-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-174-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-450-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download

memory/6032-257-0x00007FF759C80000-0x00007FF759F41000-memory.dmp

Download