4b23c59a034915ee669b1b5ea5d3d9a353626d16c2f58507abb0b6ecfbe5d9a8

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe
Size 25.2MB
Sample260518-e6bkfafz5w
SHA256 4b23c59a034915ee669b1b5ea5d3d9a353626d16c2f58507abb0b6ecfbe5d9a8
MD5 beee06ddf40c19379f071e172dc01ddd
SHA1 5477e4d26eda04cd20dfd7c3d6278215ad90e174
SHA512 2dc05371f48690a2d5e0fc8044dd84df9d60ccd7f2502bc0d557d6c75e1b54bfa45c5ff69b4f0b676230dd14286fd5ee20dc812f7d6c352e9c1b332c760c6b84
SSDEEP 393216:WmGyY2MD3+L5ngMKP7jeoIdTHY4veGNo4x:lGyY2ML+L5ngMKP7qbjYwo4x
TLSH
T1AF4717617A5A996CD09AC47483478A724E7130DF0B35BAFF449896383F6DAF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237940040438569"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	msedgewebview2.exe
4312	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1168	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1168	1668	2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe	79
PID 1168 wrote to memory of 1740	1168	msedgewebview2.exe	80
PID 1168 wrote to memory of 4776	1168	msedgewebview2.exe	81
PID 1168 wrote to memory of 4776	1168	msedgewebview2.exe	81
PID 1168 wrote to memory of 4776	1168	msedgewebview2.exe	81
PID 1168 wrote to memory of 3968	1168	msedgewebview2.exe	82
PID 1168 wrote to memory of 2280	1168	msedgewebview2.exe	83
PID 1168 wrote to memory of 2280	1168	msedgewebview2.exe	83
PID 1168 wrote to memory of 4668	1168	msedgewebview2.exe	84
PID 1168 wrote to memory of 4668	1168	msedgewebview2.exe	84
PID 1168 wrote to memory of 4668	1168	msedgewebview2.exe	84
PID 1168 wrote to memory of 4312	1168	msedgewebview2.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1668.3060.14432823761670483824
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffe25b4b078,0x7ffe25b4b084,0x7ffe25b4b090
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView" --webview-exe-name=2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,17261503194259904731,6566535643081848590,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView" --webview-exe-name=2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,17261503194259904731,6566535643081848590,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView" --webview-exe-name=2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1656,i,17261503194259904731,6566535643081848590,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView" --webview-exe-name=2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3504,i,17261503194259904731,6566535643081848590,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView" --webview-exe-name=2026-05-18_beee06ddf40c19379f071e172dc01ddd_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4328,i,17261503194259904731,6566535643081848590,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eb42aef7de4f9a3f7c568219d84ac70b43352632e2775581d52c3c6ce8dd5d89
MD5 724848fb56a99260eb4b95a9117f0247
SHA1 151ca5a7e9eeb848f27fd0ea374cfea7001525b4
SHA512 b9be71572445ec572c41f81dfbb54bc35e8670b3173f9e0af45af8ebd9f8b8e2caea2dce245b70b24bb7d2afeeebb020f717ca2941d42e1634ed3ea1b25eff46
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a4737f40a0980b77404e9f9b36d409bfdb5aaca58295481ab7df05a1c6374ee5
MD5 08b35f60ab8a3d7d8bfc3f68982162ac
SHA1 c101c1b938646dc7831170b774c2e7b3c8e7007d
SHA512 644eb05b0b69194d46880f86db41bb80b1b692be2906e8061b67ca821b035b312f322fdce05ee10ed6aad4196fdc398421a76662475f45a0fb62755e3e59147a
TLSH
T1A5D012237A0F0538C01022730043B11B0401D75B44464201D828851D1A440B00913492
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7a5517f8-7185-49aa-bd1a-6ce0c8d86644.tmp

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\7a5517f8-7185-49aa-bd1a-6ce0c8d86644.tmp
Size 6KB
SHA256 a29c6c5b03d34469045e619681b94725b1898650713091ae45e486e940bc87db
MD5 647cbbc867ba9d860479d9d7345126fb
SHA1 380b9d40aee94c03efed79bd4928fc618dccd92d
SHA512 158586c7f147f4ebb5494eb24a64be71c95ae02a1d4989bcec3fe328ee1b386f18a2329a0e822d6b67e2caa08e163e1007f28e5808f496f8a4e575f3a10d7600
SSDEEP 96:stN052V0Tb9RxffqgZ8i0vhE8ktim/7qx+WVHMSm+uecJ/g1iYaQjP+gzlhyMEB:stN0kOfhZ8pa///S+WiT/gwYampyM8
TLSH
T1BDD1A703AE68A97B4CC7E6197D35BB12E3F910227AD40E58EBFC861C05D66CC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f609b999e5c08233b4345f7514152a334389dcd80d20fcdb6f4246f619160815
MD5 d6a2cbd6323d92079354e9641b18c399
SHA1 847feb8bbc9f01de8893d262c5084262c275612e
SHA512 312b9541d5b15b8c6c019dee1c5d92251c0e40d4578bf588fe1419267dc02e9520feba6bac074504cf1f5c7cb5a2d4db66874234decf1c5d84c5d66e71a2bcb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e65156d2a2134d33147369b973ab45e333b8102938406d3b5ed66028cf1a7201
MD5 3e2e914ad6fbc8fe5a6c91d283948390
SHA1 08446c4a1fe678a4123fcf2782d40afa92cff99c
SHA512 47775b497f22ba71b5f0a72da0ea44463c3c92f5411dbbc2d9186a4e8edcea85b145e3822771e5e001ac8fceb76134871abc0a553b6d25e6109696517c9f2241
TLSH
T115A0029499500242C24003B457D58B71337A6C16034F671540A106E88C517645951005
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 588ab255ce92015f3bc9b4bf31e8d0c823d03bd8a3d28481c94067a0b0cdc33a
MD5 d5e90eb8f7393f4030e877621f9352c8
SHA1 428b5018cf5c3770667200fcc81749dee5d2f7e0
SHA512 bff81650ad9d48ec35d829d7b9a965a439ab0b85bc1d52e14be614c9f1f3873c0841f13ece01633b4f378e7f24a1db19003816fd91b5e08f2d57831d4cac7d03
TLSH
T1F9018EA3C3E8C67D8A4117E427347C13CD2E0519A3282E27DDE9EBDA57E1475D21150F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59ac92.TMP

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Network\Network Persistent State~RFe59ac92.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Preferences
Size 6KB
SHA256 019fa576839dcdbb2c2bb72bba0e25e72283ef6a34b0df83d53bac66a88a0431
MD5 57029bf9e3282b8cfa0d83cb8cc9a848
SHA1 918047514dc180eb424ca2330e22159def1db788
SHA512 9d3d9f31a0a38c3f44b1378d26e5f7562b3371cbaeb177a03c1227e992bc1cb24e46c1d33c9affe95367c7737743a46cc688e17d6d899d7aac2f214c518b7aec
SSDEEP 96:stN052V0Tb9exffqgZ8i0vhE8ktim/7qx+WVHMSm+uecJ/g1iYaQjP+gHLhyMOB:stN0k3fhZ8pa///S+WiT/gwYambyMC
TLSH
T193E1A803AE686D7B5CC7F6197935BB12E3F5102266D40E58EBFC861C05E66CC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Local State
Size 1KB
SHA256 85fde4ab4b02f5de45ff6274863df88d86aa47d6225c81ae26b2e2c3bbacb409
MD5 c03ac226c37893d382703e986b86f84e
SHA1 df71af2c52b1222c9eb3d75e17a6425b1b605fcb
SHA512 5f99262adfcddafcfa990131da7d1e1346fbd1cf19744c057da3144c263210413c843b6c3f17c8fbc810de1af0064e3825a6d368e1b2bbfc47589afda153f718
TLSH
T10631857368D85B369CA1A545B1063A876EA11429D310DF48A1EC4B1C02EE7CCDA37C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Local State
Size 2KB
SHA256 33f7d15db059e9adaa8d6a0c41643af74b919fe5879cecd91603d554a5da9f20
MD5 e7f797307114dbbb41c416cad4e5ab57
SHA1 03bd934f5f09719f3d88ea2732f3bda9cb35baad
SHA512 d0054cf5f6be1622053bf089c7a7c1ddcff688b5a1645045fa1b7d460b2e192621dc2a919140f91f2d2d9ac450d2be9134679739c2ae975f6f59f0a3e32900e5
TLSH
T11651C4337C589B378DE29944B90A3F03AAB65064EF516FA0A5EC0B1C01DF79C2312C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Local State
Size 16KB
SHA256 f2b8bd0dfce6f42b293cedc9514bc9355c6b70af9aedb36c49b4a0ccd37ebb1c
MD5 4b07c278fc1b0201ac7c86dbe9e6f010
SHA1 ae74184692325e0bf4307d5faf84e165f1791976
SHA512 89ef6a61107a2feb7f1fea01757de91cdb5657f333018754d1ffed1b6bd2d94bd43b17d38da3de265e775083bd44ea189dbe48d4551a45e4b25484bca475e6d2
SSDEEP 384:zJvsrvyOiyp4+IWA1eUVWGfvvL7NbFsY2Yj+2UMS4Y:l0raxyp4sQe6WGfvPR+2UM4
TLSH
T18A729EB216785A378CE2A84BBC4E3D07BBD158569ED02FA8F5E49F0E014F2CC1746C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Local State
Size 16KB
SHA256 487ba971b025d36ab4f77a65318fdf1e309179d7f404cc151549a710c4971f0e
MD5 633358697052f17a3e49d6b0ff554b9f
SHA1 94b26d6dc617ec3b15fa087ad4b15816bb43cfa6
SHA512 915b1be71bb72d92509ba88cddd2450614e0a1931a66c8a9004e28c9d68efac4c718f3d3a26fe762d4bcf75a8e9eae2d6590953368121a6e7f2813d24d1e0e71
SSDEEP 384:zzvsrvyOiyp4+IWA1eUVWGfvvL7NbFsY2Yj+2UMS4Y:X0raxyp4sQe6WGfvPR+2UM4
TLSH
T1C5729EB21A785A378CE2A84BBC4E3D17BBD158569ED02FD8E5E49F0E014F2CC1746C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5889ad.TMP

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\Local State~RFe5889ad.TMP
Size 1KB
SHA256 65b0edfb127d0b45d0512861acb2cf7c4dbc60f6185bb1e00106b058064ba7d9
MD5 c835ad79999aa8a39dd6193270b33b27
SHA1 de892f44dae624fddfb769a21c43377dd0e44cec
SHA512 2302ddb4bee381157f29eeb0516de7cc6d1c5073dd7f6d094527ccde97a7eaaa103262d1bb37a268b786299dbf0cc90202088e9e6f1e864f123e229a60ae5f31
TLSH
T1BD216273A8DC5A36ADA1A855F1067A872E905829D310DF08A1EC4B2C12DFA9CC633C73
MD5 SHA1 SHA512 TLSH

Submit Download

fa44576d-8b69-44a5-97ef-0cc6f7b28afc.tmp

Path C:\Users\Admin\AppData\Local\com.tomkent.windsurf-switcher\EBWebView\fa44576d-8b69-44a5-97ef-0cc6f7b28afc.tmp
Size 3KB
SHA256 1fae1b6a2974402e6a030a21e4f9f51f6c554d0d7e280c6669179004305ec373
MD5 98c11c8d90d62950054c9d561e52e2d2
SHA1 bcb90296f85f10f93eceb98acdbf8f16ad4d7206
SHA512 e0983586f4f8fc41e4e3b5dd36c8919770d31f057e31660e2aa623add5dfaa0531642d5a43838e329860ea5d02ca80167a8357f6738430a39abbd623db0bc0a2
TLSH
T16E71833369A8AA2B4DF29944B8863B06B7E15126EA817FA9D5EC0F0C01DB7DC1352C17
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.db

Path C:\Users\Admin\AppData\Roaming\com.tomkent.windsurf-switcher\accounts.db
Size 4KB
SHA256 204f9b3c487346c1a41195dfb82bb3014d9725af5bc2ac3cc4fa41f63bc03565
MD5 066cd4d239c8d96f6c6f0754f98e6d9c
SHA1 9eb0308dc7c0862d85b651a689dc05ea24218827
SHA512 47232e9c4f526df3577982437fcd9edea777e55cc446a81c0a6f14bbee0ce9d194000d60eed52e239ca95b027e3d4dc607b40ce7aa304b79bcb1d717208a545f
TLSH
T156810240534440E1D0A506F294A113081E07D19495410B036511004188416442860A84
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4312-333-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-332-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-331-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-329-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-330-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-324-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-334-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-322-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-323-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4312-328-0x000002DF025C0000-0x000002DF025C1000-memory.dmp

Download

memory/4668-221-0x0000027D5B5A0000-0x0000027D5B643000-memory.dmp

Download

memory/4668-296-0x0000027D5B5A0000-0x0000027D5B643000-memory.dmp

Download

memory/4668-144-0x00007FFE344D0000-0x00007FFE344D1000-memory.dmp

Download

memory/4668-269-0x0000027D5B5A0000-0x0000027D5B643000-memory.dmp

Download

memory/4776-220-0x000001E632340000-0x000001E6323E3000-memory.dmp

Download

memory/4776-250-0x000001E632340000-0x000001E6323E3000-memory.dmp

Download

memory/4776-25-0x00007FFE344D0000-0x00007FFE344D1000-memory.dmp

Download

memory/4776-339-0x000001E632340000-0x000001E6323E3000-memory.dmp

Download