f15df3bca5ac2f4df107ba632e3d5d1c9440b4678f522ee26a4ecb2fe7db039f

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260701-che7lscv2m
SHA256 f15df3bca5ac2f4df107ba632e3d5d1c9440b4678f522ee26a4ecb2fe7db039f
MD5 f528315143c996d66f1d4e44a6b37bf8
SHA1 02357a84d3ce08c0e9e5919322c09120970e2a09
SHA512 c3b248465c9b32125c1562bd02cf738b67eccfebef0be920efdd70924166c472a86cd40e777f324c6cd8cf6e9f0b3b4d555f84baff8520eda28492e3e9c24388
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3U:CebAjOKn3wRKRJ3U
TLSH
T198D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_328464745\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_403596306\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_397081352\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_397081352\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_397081352\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_1152607308\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_1152607308\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_1152607308\sets.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_1941877594\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_1941877594\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_403596306\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_397081352\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1208_1152607308\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3352	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{365700AE-0A60-4813-9266-2758BB70D94A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
256	wmic.exe
256	wmic.exe
256	wmic.exe
256	wmic.exe
2424	msedge.exe
2424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6016	2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	256	wmic.exe
Token: SeSecurityPrivilege	256	wmic.exe
Token: SeTakeOwnershipPrivilege	256	wmic.exe
Token: SeLoadDriverPrivilege	256	wmic.exe
Token: SeSystemProfilePrivilege	256	wmic.exe
Token: SeSystemtimePrivilege	256	wmic.exe
Token: SeProfSingleProcessPrivilege	256	wmic.exe
Token: SeIncBasePriorityPrivilege	256	wmic.exe
Token: SeCreatePagefilePrivilege	256	wmic.exe
Token: SeBackupPrivilege	256	wmic.exe
Token: SeRestorePrivilege	256	wmic.exe
Token: SeShutdownPrivilege	256	wmic.exe
Token: SeDebugPrivilege	256	wmic.exe
Token: SeSystemEnvironmentPrivilege	256	wmic.exe
Token: SeRemoteShutdownPrivilege	256	wmic.exe
Token: SeUndockPrivilege	256	wmic.exe
Token: SeManageVolumePrivilege	256	wmic.exe
Token: 33	256	wmic.exe
Token: 34	256	wmic.exe
Token: 35	256	wmic.exe
Token: 36	256	wmic.exe
Token: SeIncreaseQuotaPrivilege	256	wmic.exe
Token: SeSecurityPrivilege	256	wmic.exe
Token: SeTakeOwnershipPrivilege	256	wmic.exe
Token: SeLoadDriverPrivilege	256	wmic.exe
Token: SeSystemProfilePrivilege	256	wmic.exe
Token: SeSystemtimePrivilege	256	wmic.exe
Token: SeProfSingleProcessPrivilege	256	wmic.exe
Token: SeIncBasePriorityPrivilege	256	wmic.exe
Token: SeCreatePagefilePrivilege	256	wmic.exe
Token: SeBackupPrivilege	256	wmic.exe
Token: SeRestorePrivilege	256	wmic.exe
Token: SeShutdownPrivilege	256	wmic.exe
Token: SeDebugPrivilege	256	wmic.exe
Token: SeSystemEnvironmentPrivilege	256	wmic.exe
Token: SeRemoteShutdownPrivilege	256	wmic.exe
Token: SeUndockPrivilege	256	wmic.exe
Token: SeManageVolumePrivilege	256	wmic.exe
Token: 33	256	wmic.exe
Token: 34	256	wmic.exe
Token: 35	256	wmic.exe
Token: 36	256	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 2060	6016	2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe	87
PID 6016 wrote to memory of 1208	6016	2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe	89
PID 1208 wrote to memory of 4412	1208	msedge.exe	90
PID 1208 wrote to memory of 5144	1208	msedge.exe	91
PID 1208 wrote to memory of 3352	1208	msedge.exe	92
PID 1208 wrote to memory of 5144	1208	msedge.exe	91
PID 1208 wrote to memory of 5144	1208	msedge.exe	91
PID 1208 wrote to memory of 5464	1208	msedge.exe	93
PID 1208 wrote to memory of 5464	1208	msedge.exe	93
PID 1208 wrote to memory of 884	1208	msedge.exe	95
PID 1208 wrote to memory of 3504	1208	msedge.exe	96
PID 1208 wrote to memory of 884	1208	msedge.exe	95
PID 1208 wrote to memory of 884	1208	msedge.exe	95
PID 1208 wrote to memory of 3504	1208	msedge.exe	96
PID 1208 wrote to memory of 3504	1208	msedge.exe	96
PID 1208 wrote to memory of 5644	1208	msedge.exe	97
PID 1208 wrote to memory of 5644	1208	msedge.exe	97
PID 1208 wrote to memory of 5644	1208	msedge.exe	97
PID 1208 wrote to memory of 1888	1208	msedge.exe	98
PID 1208 wrote to memory of 1888	1208	msedge.exe	98
PID 1208 wrote to memory of 1888	1208	msedge.exe	98
PID 1208 wrote to memory of 2196	1208	msedge.exe	99
PID 1208 wrote to memory of 2196	1208	msedge.exe	99
PID 1208 wrote to memory of 2196	1208	msedge.exe	99
PID 1208 wrote to memory of 728	1208	msedge.exe	100
PID 1208 wrote to memory of 728	1208	msedge.exe	100
PID 1208 wrote to memory of 728	1208	msedge.exe	100
PID 1208 wrote to memory of 2560	1208	msedge.exe	101
PID 1208 wrote to memory of 2560	1208	msedge.exe	101
PID 1208 wrote to memory of 2368	1208	msedge.exe	103
PID 1208 wrote to memory of 1548	1208	msedge.exe	104
PID 1208 wrote to memory of 2368	1208	msedge.exe	103
PID 1208 wrote to memory of 1548	1208	msedge.exe	104
PID 1208 wrote to memory of 2520	1208	msedge.exe	106
PID 1208 wrote to memory of 5800	1208	msedge.exe	107
PID 1208 wrote to memory of 5800	1208	msedge.exe	107
PID 1208 wrote to memory of 792	1208	msedge.exe	110
PID 1208 wrote to memory of 792	1208	msedge.exe	110
PID 6016 wrote to memory of 256	6016	2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe	111
PID 1208 wrote to memory of 2432	1208	msedge.exe	114
PID 1208 wrote to memory of 3588	1208	msedge.exe	115
PID 1208 wrote to memory of 5812	1208	msedge.exe	116
PID 6016 wrote to memory of 2568	6016	2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe	117
PID 1208 wrote to memory of 3068	1208	msedge.exe	119
PID 1208 wrote to memory of 3068	1208	msedge.exe	119
PID 1208 wrote to memory of 5848	1208	msedge.exe	123
PID 1208 wrote to memory of 5848	1208	msedge.exe	123
PID 1208 wrote to memory of 5696	1208	msedge.exe	124
PID 1208 wrote to memory of 5696	1208	msedge.exe	124
PID 1208 wrote to memory of 4636	1208	msedge.exe	125
PID 1208 wrote to memory of 4636	1208	msedge.exe	125
PID 6016 wrote to memory of 2416	6016	2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe	126
PID 1208 wrote to memory of 2424	1208	msedge.exe	128
PID 1208 wrote to memory of 2644	1208	msedge.exe	129
PID 1208 wrote to memory of 2644	1208	msedge.exe	129
PID 1208 wrote to memory of 5640	1208	msedge.exe	130
PID 1208 wrote to memory of 5640	1208	msedge.exe	130

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2060	attrib.exe
2568	attrib.exe
2416	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.old_1782871466
  2⤵
  - Views/modifies file attributes
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x364,0x7ffdc716c188,0x7ffdc716c194,0x7ffdc716c1a0
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,17081727125193689467,13548949111666846407,262144 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,9772555828475730292,945377829099255495,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,9425610335994306851,13729477737869152228,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,9423073470027647028,1966153145740724971,2097152 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:1
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,17128197721120070316,12308688947893679750,2097152 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,10321171255761604905,3451924428894217460,2097152 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:9
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17353792599983090270,5818416577496901122,2097152 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5296,i,6103726182489182145,778686177558932351,2097152 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:9
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3832,i,18315860829430183058,17654803994855473279,2097152 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:15
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,15533789873789361481,15389477567149094968,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,7855948811714397070,7635882461826641352,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,12812152136396914811,11576163074159951650,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,16857685575578281954,7857424993454423263,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,16857685575578281954,7857424993454423263,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,12207440168320815514,15034168513457618546,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,13874754205509308217,9237984546184742593,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,6492823208552840401,17216489525483339625,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,4139616763194765726,9699464314322049914,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,16448617013187333488,5338366620320602568,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,10842839637053734589,1135311940740914314,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1454399610221183548,6832943599498525237,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,3660647737652897097,13054342279478838007,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,13579083917465002581,4985088484027219439,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6880,i,14220241067596844523,8959873185616244941,262144 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,2731195505726634994,3982291739562080372,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,6636616267176782421,2162631947512168415,524288 --field-trial-handle=2352,i,6675669128405246204,2264414759154891878,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:14
    3⤵
    PID:5640
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:256
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.old_1782871526
  2⤵
  - Views/modifies file attributes
  PID:2568
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.old_1782871586
  2⤵
  - Views/modifies file attributes
  PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 60997f0a6dbc2aa12a15688587419efe70147937ea1aa71bf87fc52420f16b25
MD5 5262ea0dbea3a0e99d0a032dc61761db
SHA1 bc65d5d2e7bd5eb20fb7407de4ec7eab3f81aa3a
SHA512 9cf196885964673b4f6bc849a13ffd71401c5c4d57d57ce80d95df14e98d978d458fa2fad7b4f4f21e4b99c47f998d817f1a0f9bffb6ae226b95c5504212a6ae
TLSH
T12461A5D5336449E9CB56F5F611EF60493FF4C89A43C36E1A226AABB4D88B30BF041310
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595b07.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595b07.TMP
Size 3KB
SHA256 7326510e3fb27e2ca5766845edf25e66405067a783a4bd40a3cd0e2f633fb745
MD5 383a2bcafbed006eec98b1114643a5fa
SHA1 07b765b35f710a51557d2e809f72a79035130356
SHA512 77193cbdaade858265eff4f1298bd0c34e87994188c99b473aee98fbbb8d16d9a4da49e3ab974585c436dfe6d548542b239c4c79a8550d1f8270330886caae03
TLSH
T1E16182D133640AD9C715F0F610EF60497FF4C88A53C76E1A216AABB9C88B307F052310
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 99dba963698dfb48039d1a78227038ac426a721498bf8a9ea67044478d0442f1
MD5 ddcf9f88d3766184d58a827b3b5dd46a
SHA1 dba64a17aad2568d19aec600a5e1f3a853d71f61
SHA512 7cc1121a0aa500fcb49747d58204c51b8c4475f4c242ab2d6b3ad67a5148de8e636675fac9a331631574d17126cc4813195fdd8f07bdebe8daa2a316d32f03a6
TLSH
T16A51CEF7C7E8866DC90156F0BA187E2BCE1D0914832C7D5A89E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19afcb79757015bcda1a92d425cc54e0c4fc5eb0e79c5e911d19a72a1ac7486f
MD5 35c9943bd7bdfebd14ad6aa7638396e0
SHA1 bb55ce0626d62cea7bd77fe8bbff92599c135b64
SHA512 ad50a683fb7ffb4458b963bc55de6771eabffadea6501146a484b6d570ab0a57772573ba6321e3714aa8aec587af59c92a0a1d4ca104bcf43cc326d203fd2b63
SSDEEP 192:sxRwiRIQyM/jK1Ml8wca/fKisysbVZB/SIzoA8p4Vq/g6+WNIYTYOwVWVlUG0Vua:sxRfZCa/fFsysbO5/5INODg3
TLSH
T19E62DA05AA3469378CDBD209FA557F53D6F81573A2501E44AAFC8A0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 837dca08065d8fa45c5ae87099ae7f3675a211389876ec37ba619be99852a963
MD5 1dbd65f74ee7847272329377f28c9171
SHA1 b2b4f167fd0c29a60c58a5fcc1c7fceee7cedb43
SHA512 6331650f166214c053b4710175f7f6b811bca515a5d9be8e87e1ff6b1582241683d2c6eee92f554bb095d074640c4042dd9567bd40b919ddf9aa6f4053a2411d
SSDEEP 192:sxRViRIQyM/jK1Ml8UQYfca/fKisYssbVZB/SIzoA8peVq/g6+WNIYTUOwVWVlUf:sxRUZqva/fFshsbO//5IvODgb
TLSH
T1BC62DA06AA346937CCDFD209FA55BF53D6F81473A2501E44A9FC8A0C05E7AED211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5b44295710fed02b1eb7edab4aa46e1d07626c19561b489a431eb8e942eca0a7
MD5 bde19f1c0246a610a88363398c9ad167
SHA1 db1b9ac9cd766df7a776a7e1f1908a6197050f4b
SHA512 0cd44f5487d7cb917b3df47eb945f456f0375b0d4bc61130b7fc554c3436f37b704e5d3beed3b9a8436208ef5e34d3fd25266a194179324787be69bd953230e9
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUZDzFY9roC8V:RGqOBfE7CrWgTvfiXu1jaLZDRY2CW
TLSH
T118E2EC7F680CCB7E4F80499CEC29BD9E6DE801CB56988D5447EA854C03C67FB511A4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6d13ca3827c790ef45ac5dcac097f603381bbb6594817954c7f9bf534cf86f72
MD5 49edbd71753f2d1f0a964b69fee0ecee
SHA1 4e4c09791b87cbe99b955ffceb0ec71c013ed248
SHA512 76c8a87df6ebc7dd2e5aae7af47f7acd944405d5865158258dc5b8a9b9f09aadf29ceb98364f38a9f4d136fb862aaa7a69adc53d3c17f44eef76c6062cfb43d8
SSDEEP 96:KMaQK7CSC64KriPnwVRnlV5WhOUgZ5K4QgX5cfXWJVKH+zC+J:W3/WnwVRnlV0hOlZzQgXGfXWJVKH+zCo
TLSH
T128911019377676C0383F394895A6969F4681B4A33015E43B7BB961E28F6BE00CEFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc3c9234-a95d-428d-a688-3d3d04e25ae7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc3c9234-a95d-428d-a688-3d3d04e25ae7.tmp
Size 14KB
SHA256 4332dd14c4500e2b2f0bf4b88eb7261137fab9d6beca625711de07d4c13a2ee4
MD5 bfa9bc7160bd4d056105dcfa2c462c7c
SHA1 a8f2020cafcd57cc6bfe4b26ab098553df9e1827
SHA512 86bbb87c5137ca5ac809e249e50ec7a8a1e223db939220010e773b518b24d13d9fcf717783996fa3ca4c0832e1ec5287ea9671bb8c002cb434c9e17ea32fdcab
SSDEEP 192:sxRViRIQyM/jK1Ml8wca/fKisYssbVZB/SIzoA8p4Vq/g6+WNIYTYOwVWVlUG0Vz:sxRUZCa/fFshsbO5/5INODgb
TLSH
T1E262DA06AA3469378CDFD209FA55BF53D6F81573A2501E44A9FC8A0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef5c1ac3-9a70-4afb-b887-d43b757db6bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ef5c1ac3-9a70-4afb-b887-d43b757db6bd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e4837c896f3354bd1bbd1265456ec24ca98d8f9a22042f1dbd57f2700400832f
MD5 792bf7304c01579da3087cce909b6a1d
SHA1 b71e3b1af4ddb4a4930bf6096dd552bac9c37aa8
SHA512 ae6cdd03582f1900905f1cab763b43c9848f2bbb1cadb3fba9a3258389c9e0e90277d18ad6567c8d3d33ed31b2b44ce37370c5409da2966c13e9d55990df0da4
SSDEEP 768:Wj+9b336u78d0XodOiIyN8Y1M1fmBnZmc8Kzt:F9b33Id0XodI11Zctzt
TLSH
T1A3F2BF72DC61CD734CF691C8B6573786AFF152A39AC56E58D9DC6B0E00837AE230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 35bfbae3d0e31361e64f81add6bcbf734c79a8b14aab4112e833b89305062e2b
MD5 f4f58b1d81f85172a38f7c8668a9aa4c
SHA1 a42616496e8fe6ecfa8b006538976e1d104595e3
SHA512 f0ca86f05ce8f4c4d201b156353e9f0c719cc6dad315a0b1f9d13bea4eb3f4c7678e3b46e457284f21c994aed030e2848cc83df8def95a5b555eac73273b645a
SSDEEP 768:Vrv+4UNbdn3I6I78dkXodOiIyN8Y1M1fmBnZmc8KzE:VbsbN3IodkXodI11ZctzE
TLSH
T1DC13CF72E864CE738CF79188B5573A837FF412A39AC54E58D9D92B0D05876AE230B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a8d3f02a6916390bc12d266ab174859fc8d681e9d7337d64f6a7f08cb2152b3f
MD5 b4105a6dde425e3c6f2d9cb15a6ccf75
SHA1 718d2f87909a253946fe93f3306643f8be61ab24
SHA512 ee3e33242dc63c0e02dca8684c2e985172fcba1220bed5882a5577c1926c644ee1a1e34d94629420504ad0f3f673aeb4c7c2fdea157b0b646fee32637aca5477
SSDEEP 768:Yrv+4UNbdj3y6Nh8BXodOiIyN8Y1M1fmBnlyv0B:Ybsbl3yJBXodI11Z8
TLSH
T16103CF32E868D5778CF38288B54732437FF451979BC50B84DADD2B0E4647AEE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 36c61f492b0f40a26a29020b1d8b2cf8453d274f60a50439d87042d26078052b
MD5 ebc67081f98ff3d10720b5914435a394
SHA1 42104d7982275c76d4dc4391cf2d167ee107453a
SHA512 66d76fee41a01a643fce662e1480002d1b18ef640b96d889d0fb541aef1e160bdb759090e32b7023488e8b2ef687363249cad6c3aeeb68c89ecb068592726117
SSDEEP 768:9F1j+9b3fwgw6uridyXodOiIyN8Y1M1fmBnZmc8Kzt:U9b322dyXodI11Zctzt
TLSH
T162039E77DC61CE6B9CF286C9B71676469EE051A38AC8ADD4DAD85E0D00C33EE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 6c504c6605fa2f8f3b16dd2f555424af3e3f03a22944d182a92b811669debcc3
MD5 4d4ddae0dd937d96d6c6d45817db1301
SHA1 bc6a36b3cf5d259398db3a74b468fc088cde8de3
SHA512 277d88491785f5f1d154f82b5cb13f7aef7b76acf5a7bf3d689e15cb8c18e7beb1205d32d1abf9769ec9d4fd25aa7d35dd16aa00d0aa474fb0513a83ef33330b
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ39:CebAjOKn3wRKRJ39
TLSH
T138D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.old_1782871526

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_f528315143c996d66f1d4e44a6b37bf8_akira_glassworm_rusty-stealer.old_1782871526
Size 2.7MB
SHA256 478c06592cfbdb4ba7f58e1d68e465525cabf0251f86eda82e1c521ca47c83f1
MD5 04ea243f79fdd831f1fe4855044e1bb5
SHA1 c99a5e8179aee2719e5fd08b6f06a2380ad23fbd
SHA512 9eb62e2961b81e90c00bca929582af7e533bb9576309e8811d3b32e8b2b49b9a9fce23623086b5ab979c3bdc7c8c0f86e75b1fd4ce80569609f28bcb300b69ad
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3y:CebAjOKn3wRKRJ3y
TLSH
T128D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1208_1022530072\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6016-249-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-309-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-277-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-323-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-339-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-271-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-357-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-254-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-365-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-382-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-402-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-232-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-196-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download

memory/6016-427-0x00007FF6D15E0000-0x00007FF6D18A1000-memory.dmp

Download