f742d653f75500dfed165981b8c9834fd1da6ddb992ec86594996e464ec6b375

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260629-fxp7xae13j
SHA256 f742d653f75500dfed165981b8c9834fd1da6ddb992ec86594996e464ec6b375
MD5 8b154685cb4114a1efd539f359e6e731
SHA1 70b771c228ff95465dfddffe2179d8ef65cbbb0d
SHA512 fa55b2e29e9f93c918040011eb01daa553c9e235b5544ad03fa0081972413c8da044673321dce3738da8c18af5b5a3005a1e95ce85e4f0f530fa7d5b3cb94439
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3h:CebAjOKn3wRKRJ3h
TLSH
T18ED57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5044	msedge.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_456144246\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1650640871\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_353804382\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2013021136\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1650640871\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_456144246\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1650640871\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2013021136\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1650640871\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_353804382\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_719938179\us_tv_and_film.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5772	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271837289564323"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3246620872-1649211507-2285877732-1000\{88CFA2A3-A2E2-479A-954D-137E95A9652A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5648	wmic.exe
5648	wmic.exe
5648	wmic.exe
5648	wmic.exe
1120	msedge.exe
1120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5844	2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5648	wmic.exe
Token: SeSecurityPrivilege	5648	wmic.exe
Token: SeTakeOwnershipPrivilege	5648	wmic.exe
Token: SeLoadDriverPrivilege	5648	wmic.exe
Token: SeSystemProfilePrivilege	5648	wmic.exe
Token: SeSystemtimePrivilege	5648	wmic.exe
Token: SeProfSingleProcessPrivilege	5648	wmic.exe
Token: SeIncBasePriorityPrivilege	5648	wmic.exe
Token: SeCreatePagefilePrivilege	5648	wmic.exe
Token: SeBackupPrivilege	5648	wmic.exe
Token: SeRestorePrivilege	5648	wmic.exe
Token: SeShutdownPrivilege	5648	wmic.exe
Token: SeDebugPrivilege	5648	wmic.exe
Token: SeSystemEnvironmentPrivilege	5648	wmic.exe
Token: SeRemoteShutdownPrivilege	5648	wmic.exe
Token: SeUndockPrivilege	5648	wmic.exe
Token: SeManageVolumePrivilege	5648	wmic.exe
Token: 33	5648	wmic.exe
Token: 34	5648	wmic.exe
Token: 35	5648	wmic.exe
Token: 36	5648	wmic.exe
Token: SeIncreaseQuotaPrivilege	5648	wmic.exe
Token: SeSecurityPrivilege	5648	wmic.exe
Token: SeTakeOwnershipPrivilege	5648	wmic.exe
Token: SeLoadDriverPrivilege	5648	wmic.exe
Token: SeSystemProfilePrivilege	5648	wmic.exe
Token: SeSystemtimePrivilege	5648	wmic.exe
Token: SeProfSingleProcessPrivilege	5648	wmic.exe
Token: SeIncBasePriorityPrivilege	5648	wmic.exe
Token: SeCreatePagefilePrivilege	5648	wmic.exe
Token: SeBackupPrivilege	5648	wmic.exe
Token: SeRestorePrivilege	5648	wmic.exe
Token: SeShutdownPrivilege	5648	wmic.exe
Token: SeDebugPrivilege	5648	wmic.exe
Token: SeSystemEnvironmentPrivilege	5648	wmic.exe
Token: SeRemoteShutdownPrivilege	5648	wmic.exe
Token: SeUndockPrivilege	5648	wmic.exe
Token: SeManageVolumePrivilege	5648	wmic.exe
Token: 33	5648	wmic.exe
Token: 34	5648	wmic.exe
Token: 35	5648	wmic.exe
Token: 36	5648	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5044	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 5936	5844	2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe	91
PID 5844 wrote to memory of 5044	5844	2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe	93
PID 5044 wrote to memory of 3984	5044	msedge.exe	94
PID 5044 wrote to memory of 616	5044	msedge.exe	95
PID 5044 wrote to memory of 5772	5044	msedge.exe	96
PID 5044 wrote to memory of 616	5044	msedge.exe	95
PID 5044 wrote to memory of 616	5044	msedge.exe	95
PID 5044 wrote to memory of 780	5044	msedge.exe	97
PID 5044 wrote to memory of 780	5044	msedge.exe	97
PID 5044 wrote to memory of 6204	5044	msedge.exe	99
PID 5044 wrote to memory of 6204	5044	msedge.exe	99
PID 5044 wrote to memory of 6204	5044	msedge.exe	99
PID 5044 wrote to memory of 6200	5044	msedge.exe	100
PID 5044 wrote to memory of 6200	5044	msedge.exe	100
PID 5044 wrote to memory of 6200	5044	msedge.exe	100
PID 5044 wrote to memory of 3936	5044	msedge.exe	101
PID 5044 wrote to memory of 3936	5044	msedge.exe	101
PID 5044 wrote to memory of 3936	5044	msedge.exe	101
PID 5044 wrote to memory of 6524	5044	msedge.exe	102
PID 5044 wrote to memory of 6524	5044	msedge.exe	102
PID 5044 wrote to memory of 6524	5044	msedge.exe	102
PID 5044 wrote to memory of 7120	5044	msedge.exe	103
PID 5044 wrote to memory of 3944	5044	msedge.exe	104
PID 5044 wrote to memory of 7120	5044	msedge.exe	103
PID 5044 wrote to memory of 3944	5044	msedge.exe	104
PID 5044 wrote to memory of 4460	5044	msedge.exe	106
PID 5844 wrote to memory of 5648	5844	2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe	109
PID 5044 wrote to memory of 1236	5044	msedge.exe	113
PID 5044 wrote to memory of 2940	5044	msedge.exe	114
PID 5044 wrote to memory of 4924	5044	msedge.exe	115
PID 5844 wrote to memory of 4328	5844	2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe	116
PID 5044 wrote to memory of 5804	5044	msedge.exe	118
PID 5044 wrote to memory of 5804	5044	msedge.exe	118
PID 5044 wrote to memory of 5068	5044	msedge.exe	120
PID 5044 wrote to memory of 5068	5044	msedge.exe	120
PID 5044 wrote to memory of 1784	5044	msedge.exe	121
PID 5044 wrote to memory of 1784	5044	msedge.exe	121
PID 5044 wrote to memory of 460	5044	msedge.exe	122
PID 5044 wrote to memory of 460	5044	msedge.exe	122
PID 5044 wrote to memory of 52	5044	msedge.exe	123
PID 5044 wrote to memory of 52	5044	msedge.exe	123
PID 5844 wrote to memory of 3768	5844	2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe	124
PID 5044 wrote to memory of 1120	5044	msedge.exe	126
PID 5044 wrote to memory of 1516	5044	msedge.exe	127
PID 5044 wrote to memory of 1516	5044	msedge.exe	127
PID 5044 wrote to memory of 4296	5044	msedge.exe	128
PID 5044 wrote to memory of 4296	5044	msedge.exe	128

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5936	attrib.exe
4328	attrib.exe
3768	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.old_1782710125
  2⤵
  - Views/modifies file attributes
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8fa2bc188,0x7ff8fa2bc194,0x7ff8fa2bc1a0
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,5506205957866864711,14166799353515661157,262144 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3328906558240151035,13480725894761280881,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,4842633301550782066,571605660995097471,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,13538172988967587559,7749989221573084479,2097152 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,9357771970905896447,591157130264052982,2097152 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:6200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4484,i,11288866716273271009,2449177496582838740,2097152 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:9
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5344,i,17503132053942642492,2289130548478236387,2097152 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:15
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,6432219735293089578,8867380849609622120,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:7120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,14550710550092577782,3839158160986893959,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,8067988222099624309,5269499249915854095,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,8067988222099624309,5269499249915854095,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,13690235494049610662,2938434078781879847,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,7911185807831135395,12897643042869052435,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,17596679081741265463,8628955627294515026,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,4619787335018401233,11124045386552032024,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,1580952241471635285,13616277248095846256,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,15413598038887518131,12928241956489161910,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,17146178639477327117,3344882478737211081,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,17132950125925870537,9161907030901871771,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6888,i,1252933541394871229,15769900590816735452,262144 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,3563146954358363543,1911007787351210756,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,4130929192646265809,4238126477978765690,524288 --field-trial-handle=2332,i,11304323289162000115,8789151604008021530,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:4296
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.old_1782710185
  2⤵
  - Views/modifies file attributes
  PID:4328
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.old_1782710245
  2⤵
  - Views/modifies file attributes
  PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4519ee111087f538c263265602f50ded4fd0a8d30a1eb29782923b7ecf6f706
MD5 d977ed51ddea169ff3aaacb58cc9fc88
SHA1 1161e22350839b669f3e2b6cb5cee6ee9c25e467
SHA512 3be5b17585bc96cf349403e8b57f50691da3e8f841f657a12d21c7bac323eb584bb56037d190cf5f25e30923fa75219cfff261e56df71e06f9d9981a3fd990d4
TLSH
T187D022213628F001E62A10B34D30832012198A4A29A39A0A3C90804AE8A6080A2D244B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 01fc33638563dc8ab1a7b28573704bed2449b99eedc9bd38a25b21316506e8a0
MD5 11027c4e8a2219c9ce2e898ab0ee23b7
SHA1 035426b9d83735103c3507c9017885546a4bc3f1
SHA512 a538fa52093c0e8ae9c8760749e2905603b5390edd667d6d7eed03fc52795e15b07573b9fb01fe984851203afcec62a80bbc50d6e99f5fbb2fc0771ec7bb014b
TLSH
T1B2D022213628F001E22A10B34D20831012198A0629A39A0A3C90D04AE8A6080B2D2447
MD5 SHA1 SHA512 TLSH

Submit Download

562175b0-9432-4f19-a1b4-892180ade248.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\562175b0-9432-4f19-a1b4-892180ade248.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 263625b849aa2d6ede63f1e32055c61ab05893847146c66825796aa14c3d0eb1
MD5 300e44f99041efb17fae3825db8d0800
SHA1 299734b63b9563352e53ca35fd3ea4a1125b09aa
SHA512 ad6281dccca3ef6e5570e36d44f5e387b3c195537774607d6b34e59006b8273605de51841c22d3fb4323badd10cae8bfdbd0b0c4bc37b156e1d1c911f9fc04cb
TLSH
T1F3F02DB7CA24AC3714FD1F5970644786E75013572B40855B3B3D920D4FB567F4685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c8a55a56d6bb5a895cc235c945463d79751a4df424f4f1f563f710b352c701c8
MD5 1108c262b454d7d353e32e24e16bc0e3
SHA1 b2b5e158ba11c9bd36966d038a06b8a7067d37fc
SHA512 dec31aafad54c5c1a0bf60182b94cbb38c1bccc0890ff187e53935a0fd5b73fabc779e13b94383aeb9fce07c1fa0e4c2e2a5753fff4cf05fe5cc3a3f460ad4db
TLSH
T1D77183240BB60A61EB624BF960D248983773DF454B1F1F19D4972870FE0E7CDA4CE865
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dd1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dd1c.TMP
Size 3KB
SHA256 4842a0b37928dbaedd8989d6605c69bfb68e34885d520f0e3bdf968f35d6870d
MD5 fdb619a22b18360d6ae015525a684f2f
SHA1 a74d493200e97ed1c177e4ad34cfcc2350d9c575
SHA512 fd8ef7941fa15a645097068f41f1fd9d1e52d9b9ac104052629ffea4a676df634ea40ed3219d8b8bd3f9a55fdb3daca82e6cb6473382e99ad69f79473632957b
TLSH
T1677141240BB20A61EB664BFA20D214983773DF455B1F1F1CD4976874FE0E7CDA48E865
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5ce54a042fb63633167081b8d0349f0d6baa0351118c65f2d7a5d51330c95626
MD5 2dd0bc24deb0ffa52293fec8782a534c
SHA1 5fd5c764e478d5459ba2ffe00de63d31f7d995a5
SHA512 37b33725ca10ab0e1e48863036c18cfc5ee19c44a1d6d3edc3718274dc5a72893c79b466440719d2c2f27263b72d61fc277ca500113019ee7724836bc72fd70e
TLSH
T11A419DF383E4856D891196F0BB146E2FCE1D0515432C3D9AC9E4AF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 30cf98a8fd7c8b3d3b3fc2289ac02efbd482954743d4f1eff5017177d95b8b9f
MD5 eb0a9703a0f5f1314696fd5f555c5b60
SHA1 e0404d13fb23f949dd7f8f658af6e611f346c26d
SHA512 2b45600287a151ccfe182b472d58123cbbba30ec19b39fb804f5dcb18684d5bf6cbb1ee2c577cbe07c002cf40b9129ff47a499ffa31043b8a60fcb9b224b1333
SSDEEP 192:sxRWRfyMqZjK1Ml8wcG/f6sbaJ1ZuEsZBzoA8pe//g6+WNIY1SOwZZDDGrrIgjsJ:sxRWACG/f6sbaJ7QZ88/5ITOCDSjQ
TLSH
T11A72D8156A389977CCDBD219FA857F53D2F81573A2905E44AAFC8B0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8d33067c9b921cc9ee62b5411e0840aa63716a8c191c2a4375f998fef5ec2e0b
MD5 cbee9818d40b3a61eb9b281fe1386484
SHA1 d58210b5489136b7abb19040584fba0c5a6bd159
SHA512 4a8e59dff95124968733b9242f09b661fd1715d49a0f74f6f51db3cc74dc71f6f0b582a882e61ee86c26e5f620de7c0399922bdda766a40f3c03cfc5be3e69c0
SSDEEP 192:sxRWRfyMqZjK1Ml8UQpcG/f6s0o1ZuEsZBzoA8pe//g6+WNIY1eOwZZDDGrrIgDr:sxRWAq+G/f6s0o7QZ88/5I7OCDSwEN
TLSH
T14672FA15A9389977DCDBD219FA817F53D2F81573A2905E44AAFC8B0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6d7002f060703f454e5f06e23b00189e4f0490b39186df1c73cf231f5bb3a973
MD5 7bbe37719524497388326d61b1fd229a
SHA1 c8c64cc15c8602ec9f91819417c3830077670798
SHA512 80eba219b159ff17651687181cbed444fefcf682ec321aec7780b5ae8e614c10366734adf4db84d1c0e9716771ffa403c540f63f1ba760f316dd22ac05a3a464
SSDEEP 768:z2SIZz7pLuL7uTWgBdfLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVltbIvbgZvro1iZ:z2SIZlE7uTWgBdfLku1jaYcvkZ8MZ
TLSH
T11BE2DC3B680CCB7E4F84499CEC29BE9A6DE801CF96D88D9447FA444C03C6AEB52175D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 528d1f03e3a7d9d83013c02ddc1306d4d47a5ea910218fe55b7e9b3aa283328b
MD5 438b090ba432a40154a6b5b03cf83ba7
SHA1 8ffeebcb828883d425b0764ed6a84681eaaf6dbe
SHA512 37937b79d19ef9cfd7a8f23f486e9f76c8d3c2ed9e28b6936aa601b8fb39c813d5aa22c54e72db92475d94f3cf4d83cd3266c7778133ccaf24aff77d0b49e0ab
SSDEEP 96:KcucKzSmmD+KsoPjWKQsKGpSKSsx8gKVGeGbqKEEfxGK6giOrOKs4MduK2E662wZ:ijdt9ZpfpRBNwVnqxpJFBTPLG31U
TLSH
T115B22A117A7E120138BE250CE194966F674230B3705AA63B7BBD20F64EA7E011FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d2227475a9f959030887a374716adced79ab2ae380f74d31280ebdf154c73105
MD5 c73b3789e5828f5d3b8c23f721a7a68b
SHA1 2817058b034aecd78caace06bf9cbfc33109586f
SHA512 70c4913a0a0e453e6fe380eb73de5401762ee82181cbbfb93a7eb589d9e224aad597e96eef4a0b003271c040b1503f9327c66093ae853627e2402b1d91743e9e
SSDEEP 384:nwiF1tNn/s3n9SN8N78TUNTUlIRpLqYB8HXgERcCfLpG/yc0fZDkUh9mn15wbAjA:LF1j+9QCwgfsXgEXGvhU9mn12bfJHz
TLSH
T1F6D25B32EC54CE77ACE68BC9B34A7286EEE051B385C85A98D9DC4E4D00D72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f20daa2f5e93dce5359051cdcb29407b29697c536535978560894cd66176500d
MD5 5928dcfcee15d4509b7a7e3f4c93df3d
SHA1 fd40ec89bad8fee7aa7102a1a11b8f827fe43722
SHA512 80d9e354000b5f93d3eefb35d5af379e9cec38885715bb98ea1cc1fb2c38bbcb1794c612235043aeb5c3a25d1ba6d55383d398fbd86c0e3a42699d05934bfeeb
SSDEEP 384:nsiF1tNn/s3n9S58N08TUNTUlIRDLqYBaH/nQmcAfLpG/yc0fZDkE/W/Pb9oR8Wn:XF1j+9stwgFa/nQgGvhE/W/Aqvm
TLSH
T174C24A36D864CD7BADE68FC5A30A7B47AEF0116394D96AD8DAD86D4C00C76DC0347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ab5ebd63680c5868ac1bcad490d09e086d95627438524c496dd9f948064ec84b
MD5 1392dc9d525095e40b6f9fd4d2af130b
SHA1 4003ee35406b23dbcb3cf27e4a66841765450f5f
SHA512 d2b69bcbf08b3a524b77126041e5ef2d63d87a158cc07ad7dafab399be6d7779eb32f425592fc73ba889778877ecb96a1be3c8e8f938ed8cd506a997fb0c560d
SSDEEP 384:noiF1tNn/s3n9S58N78TUNTUlIRpLqYB8HXgERcAfLpG/yc0fZDkUk9mn15wbAjA:zF1j+9ECwgfsXgEhGvh/9mn12bfJHz
TLSH
T12FD25B32DC54CE77ACE69BC9B34A7286EEE051B385C85A94D9DC4E4D00D72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 167694039d0d9591ced8a6b9d67b0fc3bbe47708e7d51f65948d6a28009cdef3
MD5 16929a19e313ff4ed33225ac96397d26
SHA1 cfc6975ed4fc811c51819aaab2e9dcb43cc8f046
SHA512 8dc88e29623bc3b454f6706c1f97187929dc8ffb44c215086fc9f98431c41f010f5b9c71dfe3a1cae8aaecdd5c8c73e668dcc9d2ccd97058bed882fcfac22cfd
SSDEEP 384:nriF1tNn/s3n9S88N78TUNTUlIRoLqYBzHXgERcAfLpG/yc0fZDkUx9mn15wbAjj:GF1j+95CwgKZXgEhGvhw9mn12bfJHBvu
TLSH
T1F3C25C32D854CE77ADE68BC5B349728BAEE051B385D86AD8D9DC4D4C00D72DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6a4028bd7b0b46a8ff52c7885fe9023bfd9d76020870cc3d7c5d28c3c2a43a27
MD5 403c2c4efa023a37203bb0072d7b352d
SHA1 77382d8f47aa96bc0f27eb4229dc0e866981ca73
SHA512 f15759f4cb3511419ab2cc2b6261eb06fe55f9d8fdd3cba9f5254002defb7dffde10b4448b275d5499cb42e9b7ed76528e4f4a800b94c9f0b5e86343b483ae26
TLSH
T16E311EE1583C1ED2C4BE0DAFA09B39FC84D8D216F5A4747A6858ED98462DA5E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ce283875586f5e5735ed9b819fa43cc7bca7c21fa1a5bb00957ee89bc1efd7e6
MD5 081dfac928e5d42c566492541c4e9127
SHA1 038182522654a591493d554cc9121d25f5789372
SHA512 812d1b558f00549f7564ca64b00cc8a66c2194f4642a4479256f5f7cc85316dfee51c2bec9f186df2ef2238b5bf810f6030b05c31ba7d87f60f7c566fcb2640c
TLSH
T1194130E1583C2ED1D0BD0EAFB09B38FC94D8D726F594347E2858E998463DA4D658183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8d26df18616ae9936fa543648b2cd2ea3815e5d93603d68c3388432e34b653f5
MD5 32a26dd06ec5769b584a38ef5db2c981
SHA1 33bc45ab162e952e9ccea309f8d0247a6c7762d7
SHA512 2280e98d6c4cbafd98caaf46dc605bf88e0bcf153fb13177c53b443e297c7e52c50fadede60bbfa5abc60dbe52ce281db5a4004ebcd218c6ea84c69bc6a288e3
TLSH
T1333141E1593C2EC1C4BE0DAFA09B38FC94D8C616F594347A2854EC98423D95E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6a89c8be5122f9ffb4f6b6d538b042f3a9b17f05067a7af83b6be5cd7a4e588c
MD5 b21bd34ef867cae5d55156254b26e656
SHA1 e1fd6957cc85a2071058013966556a6365471414
SHA512 656a57138cb908d487db7539050cffa04a736570150051cfaab5b4a9750480b9928b5d6a9a6e78ba4573a8476798d6190d89420d19bbf615d155b06e4aba837e
TLSH
T1B5413EE1583C2EC1C4BD0DAFA08B38FC94D8C626F594347A2864E894422DA5D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 b3db70b1fae15fcc6e16df6756ea6e46e9cff068e087d46f5ac5a397a5252726
MD5 010faac900f57a1b4660985520006869
SHA1 dae851fb043de8f47a6acb4ef4bbb50ccebd3a8c
SHA512 8de0a393125853ee31b869a08c7ec2b26e6f057ad8de21f7dbf66d5e0881a2b75626d3401a94086d15aa1801fb449fdca1af087709e2e541b1de78f5afb89353
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3L:CebAjOKn3wRKRJ3L
TLSH
T1EBD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.old_1782710185

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_8b154685cb4114a1efd539f359e6e731_akira_glassworm_rusty-stealer.old_1782710185
Size 2.7MB
SHA256 7c7743b81304e872082f7799f9a45d5ac101104ef0940fbbf25ce6bed7735222
MD5 2350029fa0565501521fe728942a438c
SHA1 581874c4ec3746afca52da4120ce0e5d342376fe
SHA512 95570736ed3a08d3fbfe13ce0e9029a4a50eccba5bab21fb5452b39809fb75a92d584ec0ef9960d74046c4b939058df0a5459bef6f039ec7241ca4c8c9aec11a
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3q:CebAjOKn3wRKRJ3q
TLSH
T198D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1141126183\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/5844-373-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-237-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-339-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-356-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-211-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-206-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-387-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-313-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-410-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-174-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-419-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-196-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-236-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download

memory/5844-444-0x00007FF67ADD0000-0x00007FF67B091000-memory.dmp

Download