e472e66d3336442e26b3d37ce841506bab8d524a793d9dd2600e3abfd1d13cc5

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 50.0MB
Sample260721-af35jsbt4y
SHA256 e472e66d3336442e26b3d37ce841506bab8d524a793d9dd2600e3abfd1d13cc5
MD5 ad57967db1d9bb21e271887d32a82ac6
SHA1 6809d016d74c52cecfaff9db02867b7a779b829e
SHA512 9fd42856e70e93279d55de9499454515a75ce018fc3b2b9ae06d673217e9b221f350a43da593de07cabc6ed259101f4d626a0b7cf7228ee8eef47994ed5766cb
SSDEEP 393216:ifXotTnIV8hvDBb/1VdSUBGgL0YdzhsMqIbIN56Vu:c4tIV8hvDxPwgLBtsKY56
TLSH
T125B71721BB9A596DD19AC474834B4A725A3130DB0B35B9FF44C896383F79BF46B38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5012	Antigravity Tools-4.4.7-installer.exe
6044	antigravity_tools.exe

Loads dropped DLL 6 IoCs

pid	Process
5012	Antigravity Tools-4.4.7-installer.exe
5012	Antigravity Tools-4.4.7-installer.exe
5012	Antigravity Tools-4.4.7-installer.exe
5012	Antigravity Tools-4.4.7-installer.exe
5012	Antigravity Tools-4.4.7-installer.exe
5012	Antigravity Tools-4.4.7-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	antigravity_tools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_421230321\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_421230321\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_755509587\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_755509587\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_755509587\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_755509587\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_755509587\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1028_421230321\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antigravity Tools-4.4.7-installer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5012	Antigravity Tools-4.4.7-installer.exe
5012	Antigravity Tools-4.4.7-installer.exe
6044	antigravity_tools.exe
6044	antigravity_tools.exe
6044	antigravity_tools.exe
6044	antigravity_tools.exe
6044	antigravity_tools.exe
6044	antigravity_tools.exe
1668	msedgewebview2.exe
1668	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
6116	msedgewebview2.exe
1028	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	5012	Antigravity Tools-4.4.7-installer.exe
Token: SeImpersonatePrivilege	5012	Antigravity Tools-4.4.7-installer.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6044	antigravity_tools.exe
6044	antigravity_tools.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6044	antigravity_tools.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 6116	1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6116 wrote to memory of 2564	6116	msedgewebview2.exe	90
PID 6116 wrote to memory of 4624	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 4624	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 4624	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 4624	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 1788	6116	msedgewebview2.exe	92
PID 6116 wrote to memory of 2088	6116	msedgewebview2.exe	93
PID 6116 wrote to memory of 2088	6116	msedgewebview2.exe	93
PID 6116 wrote to memory of 2088	6116	msedgewebview2.exe	93
PID 6116 wrote to memory of 1892	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 1892	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 1892	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 1892	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 1892	6116	msedgewebview2.exe	94
PID 1492 wrote to memory of 5012	1492	2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 6044 wrote to memory of 1028	6044	antigravity_tools.exe	98
PID 1028 wrote to memory of 3508	1028	msedgewebview2.exe	99
PID 1028 wrote to memory of 4732	1028	msedgewebview2.exe	100
PID 1028 wrote to memory of 4732	1028	msedgewebview2.exe	100
PID 1028 wrote to memory of 4732	1028	msedgewebview2.exe	100
PID 1028 wrote to memory of 4732	1028	msedgewebview2.exe	100
PID 1028 wrote to memory of 2140	1028	msedgewebview2.exe	101
PID 1028 wrote to memory of 1412	1028	msedgewebview2.exe	102
PID 1028 wrote to memory of 1412	1028	msedgewebview2.exe	102
PID 1028 wrote to memory of 1412	1028	msedgewebview2.exe	102
PID 1028 wrote to memory of 3480	1028	msedgewebview2.exe	103
PID 1028 wrote to memory of 3480	1028	msedgewebview2.exe	103
PID 1028 wrote to memory of 3480	1028	msedgewebview2.exe	103
PID 1028 wrote to memory of 3480	1028	msedgewebview2.exe	103
PID 1028 wrote to memory of 3480	1028	msedgewebview2.exe	103
PID 1028 wrote to memory of 4832	1028	msedgewebview2.exe	107
PID 1028 wrote to memory of 4832	1028	msedgewebview2.exe	107
PID 1028 wrote to memory of 4832	1028	msedgewebview2.exe	107
PID 1028 wrote to memory of 5800	1028	msedgewebview2.exe	108
PID 1028 wrote to memory of 5800	1028	msedgewebview2.exe	108
PID 1028 wrote to memory of 5800	1028	msedgewebview2.exe	108
PID 1028 wrote to memory of 1668	1028	msedgewebview2.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1492.1412.1820166275109639171 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView /prefetch:4 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0xac,0x7ff8b9375fd8,0x7ff8b9375fe4,0x7ff8b9375ff0
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,2424589969795020120,900523196542955733,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1784,i,2424589969795020120,900523196542955733,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1784,i,2424589969795020120,900523196542955733,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=2026-07-20_ad57967db1d9bb21e271887d32a82ac6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3568 --field-trial-handle=1784,i,2424589969795020120,900523196542955733,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 /prefetch:1
    3⤵
    PID:1892
- C:\Users\Admin\AppData\Local\Temp\Antigravity Tools-4.4.7-updater-0xNNFA\Antigravity Tools-4.4.7-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Antigravity Tools-4.4.7-updater-0xNNFA\Antigravity Tools-4.4.7-installer.exe" /P /R /UPDATE /ARGS
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- - C:\Users\Admin\AppData\Local\Antigravity Tools\antigravity_tools.exe
    "C:\Users\Admin\AppData\Local\Antigravity Tools\antigravity_tools.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6044.3504.16117841435792191875 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView /prefetch:4 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x12c,0x7ff8b9375fd8,0x7ff8b9375fe4,0x7ff8b9375ff0
        5⤵
        
        PID:3508
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,1254844327727594274,9637760596759430074,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:4732
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2564 --field-trial-handle=1780,i,1254844327727594274,9637760596759430074,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:2140
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2620 --field-trial-handle=1780,i,1254844327727594274,9637760596759430074,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:1412
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1780,i,1254844327727594274,9637760596759430074,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 /prefetch:1
        5⤵
        
        PID:3480
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=1780,i,1254844327727594274,9637760596759430074,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:4832
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4740 --field-trial-handle=1780,i,1254844327727594274,9637760596759430074,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4728 --field-trial-handle=1780,i,1254844327727594274,9637760596759430074,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

accounts.json

Path C:\Users\Admin\.antigravity_tools\accounts.json
Size 100B
SHA256 ae3da53289e9653e21105c4bb306f9bee0e5d4802c2fc1496971d4a927575e7f
MD5 3cb1f9a56bb227c41c85b31074635284
SHA1 4398534995d75d48d6b10f4c69a9c65d04c42937
SHA512 2539f461bd6561b7cdb2a201b31a5860766e35480171523910ab6b16628fc0b5c7e324cb6e3a7acf2035b7b65c2f375ea8d08ede0ff5334a058fcfe1cb2c47d4
TLSH
T119B0121085310473E4D10A04204643EE82714E472300330C069F0C08034D6585373201
MD5 SHA1 SHA512 TLSH

Submit Download

gui_config.json

Path C:\Users\Admin\.antigravity_tools\gui_config.json
Size 3KB
SHA256 a2f66604c8a339af3030c5254a9c422fc58f1b592b5575d4c3dc29ffa7be9d15
MD5 5069758aa60a4b10a98a60404eabbba9
SHA1 9449e2ead0d922698c119081aca4373486dd2bc8
SHA512 f7d56c24f2c75c5b9427e880fd61778e064a0945d9e41d5907ead79152c23539c96bbc0fec75828b589df31ccfa26870b6ce14945af03e7f397633cad0149189
TLSH
T18F519B29D8790CF701C8D429E8BD92936261C9970F167C38B68C952C1F4E73E1AF9BD9
MD5 SHA1 SHA512 TLSH

Submit Download

app.log.2026-07-21

Path C:\Users\Admin\.antigravity_tools\logs\app.log.2026-07-21
Size 4KB
SHA256 d042c709f2da04dd4d84a527e2e018d67e93d5e3a907b37c4ce6fc9e95eb38d0
MD5 10c6ca5cfe639117ad53c8ec4529f3af
SHA1 792672862c81547851462af43ea4b122cd962534
SHA512 abf5f2ae746e9fc66405e1bac1055f8cd432c7e5ebf9db1a944812702c0d73b095776626ef9d00ac7e3fd8275958c42f037629747d5e17fd31d24dca5165bc8e
SSDEEP 48:KEazvrbsaGP5UmK5vB5qsqNWB5gA6Y57xsU25ogJ5n3ZXpR/Z34f1qGC/5M7gOtY:K1eUhjqwjso+3NEf2yhW
TLSH
T19981165459F58116DE5A6590F10EB7CC3DDAECDEB30C086C236B5AA88A4A4325FF9121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

security.db

Path C:\Users\Admin\.antigravity_tools\security.db
Size 52KB
SHA256 33d7d54b9d7894aae09a9c45d27377099fd8fa95278e8c5e23a9704de62e0528
MD5 339eb94985a676331dbd5b0b5df27f6c
SHA1 58d7d5fdb0e35e066366e658f762fd497ee710b6
SHA512 233cd7fa205ac0ae58f8474bac4182fd7ae370e92052ca1ec7626d7af4370a313413a29cfbd92408229439b493a239db01a6aa38a9ce000747ff950e84ce40e4
SSDEEP 48:Tb/ZVGZIB8mBKS4WszKZX2BIbDs/VscjmmZt2:XZVGZnmBBszKZmB0Y/ycjmmZ
TLSH
T1AF334CC64B683660D2D54273985206717229C85F9E633BC1B8AC51A92F8F08DD638BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

token_stats.db

Path C:\Users\Admin\.antigravity_tools\token_stats.db
Size 28KB
SHA256 19a3459924542f957947952b8883b65a12d98acfa15946986711627490f549c7
MD5 db579f008ef7c2fe5e2dfa710dacace7
SHA1 1c51cd533120f8e5bc875cae3dc4f485ab694b3d
SHA512 347b3a5728bf1af11cb59f6456bcbaae83281399b6bebbd5b38386847902cecf42038754d1e82596f1255171ade584d3df08b8de2dd406eef67fca2d974fcec0
SSDEEP 24:TTd4JTf6w+4b2l6sV1e4NsqJq3gI2BkQBkYhLi6wxsw:TTGJTf6wbb2l6MRtI2BJkYNi6wx
TLSH
T1B3D2064E1A142769D9FD1C71BCA4097B3A7CA10F4F437D5479EC03E2CFA851658372AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user_tokens.db

Path C:\Users\Admin\.antigravity_tools\user_tokens.db
Size 44KB
SHA256 c65c761d823de2627fa4dd9fca17087a794bcaf57a98b5df533fd69ebc1f9a52
MD5 ceeb9891f91451f998e2d6b98954233c
SHA1 5c7d15bf06b48070006ba7fa676cfa702581566f
SHA512 291727e517f1ca4197619747c4d9aef84d2652618931c06e7f01a377760db20e88a20505672222534be12ac69cd180f3f9c0c55dac4e94abf89591eff8972042
SSDEEP 24:TLzlqakdkcp7pRgFnEOc+cZRg84bfZgFpr8TFPMS1BGvzH6mwDM//2eww:TgBycGbeDsPM2BG7H6mQ6/
TLSH
T160135D9D2E245924CCFC4E32EC7249352938536F4EA33E517CAC43E25F5A056A8774EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antigravity Tools-4.4.7-installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Antigravity Tools-4.4.7-updater-0xNNFA\Antigravity Tools-4.4.7-installer.exe
Size 14.2MB
SHA256 b7d97208c200a2e892a1d4e88184cd1dbb1449d1e8a2aafab5e9a309c3521ff7
MD5 e2f0c64377edc82ba3822843e89dee28
SHA1 693f306f1a56f255255876d8209f70e3549e3e83
SHA512 36ae8a24d87f78366ef3aa8caa94cf88e787dea778516591cf1790caa162a9d73ab395e11146cec12803241a20de8eaac85e2ee30588359e940a0401935f7619
SSDEEP 393216:9RipANa8iCDI2qJmp4tEATOSmBUiQ28/jqdQThB3vNGbHt:9RWAN2CvTp8begmQ1B3vQbN
TLSH
T169E633D560A0C0A3FB2435325A6B54671DA3BFF630D9CEE9B78208364A16770361C3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw93BC.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw93BC.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 18d5ee5d82f8e847bf8e0548562610088663f20679b114740df47fb7c7e8b586
MD5 e1470a981e4b2dd9018432e3ea64df22
SHA1 c1116633cb242ff5a1af6b1e9d1c3fd580ad4869
SHA512 1dbf3389d6de8bac25d04ad5a6db95dde49d2d4edc7b1dd5b2dc5423a8a671e178993e11462697e71000e4f7ce55f2d562d6375365033d6c9c7fa3050b712222
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 22e4dcde523433ef90d09c18631e6bd7397baf1a4231101d9b15657d6b7f77a8
MD5 304fb0a1556c13992c35a00ce8e757b8
SHA1 9012ca34d8c1262413cdb40fd6eae76c1f3e44c1
SHA512 54f61c3ad7d698a64c73b38ed35db444831553fe452921efb549d5a2ee817f4f4f034ccd092ccce1082cd5ca6b97b5d390cf1ae69601672acb09d4e2aeeaff25
TLSH
T196D012363F064135C42020330102A14C0500D11F83054001543C991D1E140900A06C45
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1e27a330fe734f0845ccd7c5f636cfcd7d4c1373d3b231d58f9e350e934f11d5
MD5 03474fe6910d5d56cd34db313c499372
SHA1 f6facf21a4e76a4cbc08e01848aba162e3563d90
SHA512 8729a8757ad86cdcc001101752d0bb54470a176d266610837af9573d8a364cf735aa04de39d6ce7f177e4c2cdd8bede410e8063c41c16192a4d3f1a88d843c12
TLSH
T1F7D02B37FB15423FC42030720241E12C1B01F20F52024026943C8A1C5D190D70B81CA5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 105d22a87638fb823a5462836774dee5b61c44db980b570885cbef273ef3648e
MD5 060eb7eff3a19452d752daf3196f4f80
SHA1 8660a055ae4f20844624a237e9a14cfb12c79e15
SHA512 169c724a6851cf61e0ef38056c17b5c11567f9f70018469d6c8603623f1c7e99bafa6a98d0cdae4c7334dc40a2bba64bf9be6c646c637e9ea25c26e329489538
TLSH
T1C2D02222E601463AD050307106A2E1AD2A01B70E1002D155902D961C890A0C70B81CE6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7e0a4710c899fc5088410582157a887454477fb6c6be48a0b6e978ba1bd1c98e
MD5 d4287e5b416a312602858f348041c8c5
SHA1 e079c398f267906354a94f40c7d8ac3f26e608a4
SHA512 cd68e4955d5d4e5112af8eb0c9e6e03a87ca4a388b2fcbd38445e1d7ad0d151adcf5174094fdab47422d365aa7859014e7d2f8845e3d3bae8bebe37cc4a38f4d
TLSH
T1E1D02222EA01423AD050317006A1E1AD2B01B60E1102D255902D862C890A0C74BC1CE6
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3a4f7460-5326-48d2-a5ce-e1a79b8f1534.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\3a4f7460-5326-48d2-a5ce-e1a79b8f1534.tmp
Size 6KB
SHA256 ba15c475b4a16968a5b8e109082a97e5727f9865cbc07c3f8e47326eb37c2235
MD5 3b25613ed98f0741e5743be68fa3d11f
SHA1 51c283d676851d7a8220bfc8e4ac9f5cd0dc3eaf
SHA512 3879e5ab34aefdfd53d28ad90583b0de4c817bda8a074cd89a8de3d43b7f54481397834a5b4bd9cedaf031083356d49ea934b956a24d1fdbb0d7e3ec68dd40b2
SSDEEP 96:stf/d4xFmx4I7mbD8k+do5h16Z0Ps7/x+6MhmuecJRZMkkje6K+gkI28XM1C7K:stnIBmBJonPsV+FdRZwjShG6K
TLSH
T1B8D1A5065E28AE7F4CC7E659BA39BA13E2F95022B1D51E48E7F84B1C04DB6DC6303907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 77d6789165ee83a636c8b00c4aa62dcd4136d0c3740f9da77b462b61be7ca6d7
MD5 7b2b0de423aa551046895fdb6797b215
SHA1 b0891b4d8560a4e7b8eecc1d338bd10cbfb3e89a
SHA512 4e2cf8119c152740550de7e7dce492d4ce0891bfd3f9cfab33db5eeba3e485859d7559b9af5ae43e76143392cbd26de0278c5c9cc308f0ecf6508ecdaf60d197
SSDEEP 3:LstlNllkll/lzK9Kllt:LsX3lEtee
MD5 SHA1 SHA512 SSDEEP

Submit Download

c7adf8782aa0de19_0

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\js\c7adf8782aa0de19_0
Size 256B
SHA256 4fda000738338825326d1dc91d64cc2e01bd880e94a2fd13f4a564ac5cb8e629
MD5 90af008ed84238be52254a06f3b20bf8
SHA1 1143ae1a74030503d5290d2132c9c521b58648a5
SHA512 04e36d477d8779a8f164ae792d99e01201fa04f2dc5487746fe0f9db73b110e3e0040a462d06bca177b0ed75fbb0a4574d46074393131a14a54efda4fcd2abdc
TLSH
T1CAD0974F75084804DA356AF0C3A70C5F430A41A4402CBB008100EC2122C36BD610E710
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e639876c8ccbe03d3b3dcf9073fd7cd63b7159a059600fbb5f230652f834cbf2
MD5 08b0d87a082454d42102eb0c36794c21
SHA1 5501e74ea719dac8edeb178c9129587af889494a
SHA512 044d5819da62247bd9d211c545885136a3bbc8bd887ba1660aa0c114eacc742e6ee6546b588555462206cbe3b171228a1a3b483fb67a519c53fd505fecad15fb
TLSH
T1F5A0022901501851D51042B85AD55595B32A5C35A14B162580E445A489613895627110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 ef3d2c00ddc5dc4550a79ce8fb6dff7a34698a1ed12b96158dfa222a47cb78f6
MD5 1067d8da2d8836bcba67f498ec212381
SHA1 5f541a97b5ae6248ab309a151959f91dcccb6c00
SHA512 4151127121f3d6e3d58e8d68149d5475a0fb75b430f9f7094100730250035b1d250432a71969e157c73e87ab243876192a56c7efe3cf7ad67783d1c2a730561e
TLSH
T18CB0112A00A20003C200A2B02BC20080F2302C20220BAA08C0E0A038A2A03A28A22000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599188.TMP

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599188.TMP
Size 48B
SHA256 1cbf0a44abee669a3ba5277c9c74088133494cde72ddb39cf5079e6ed5fd68ca
MD5 9f7cd9f7f09d8aaa333978355e069781
SHA1 9575bdcc00f9ba6eb6897556e619eebd77f12e36
SHA512 22f4c94e61465d3cc4a3232e0e5b1469e7fc9ee0ccb398910eb444ab747791b9f3dc51a1aa72ab0adab466bebd703f3204dcd7f09ed9e7afc02fbaf9ca38d1ab
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 1578c188853a0e0d14926ffcb2230a55adf707e13c2facdf51ce181b54bf1320
MD5 0f61208e524e2a044f39e00fc11151f7
SHA1 3948c420ea4e0c49254d5415cfacdcae09df990b
SHA512 f20ccd9efa98f968ad584c1e2c5aef72cfba7cebf2ac68ef04be10c3a8d7e09e172f92e45d5ae4116476e7ab1b1f08501dd10ffbfa4289f8b8531c257669194d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Favicons
Size 22KB
SHA256 10eaad3f4b54985ceeb06496f5be27847f80399692f10c3c900daebbd04306b9
MD5 bc35bc4247b68c14752de2161849b71a
SHA1 740d6cec6721b224abeffe1672b91b17883f13c0
SHA512 b17ec990bcc0f190d97328338f55bc18916a01a4b53c4b41e1898c8040d39a77870d24fb372679d3107d7728c8c6131d8399913a01199b2311beab3f1b01de57
SSDEEP 96:nBCyuWXtTX5MgH/xYpUQ5tiL2kTczD/UkdI83JIEVKPGYn:BNuWXBJMpz5gLfTkM8ZDVK+Yn
TLSH
T14EA22B6F2B353403DFC51E7E66AA5836CE7B92AD9FE15D04705848118CF824EA0381AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\History
Size 164KB
SHA256 3153b4331e2ae1a98dc83edac38d3a4bdff5f458e888083ad4e4303989f84e61
MD5 11a1b319068604a70a3835db3aa34279
SHA1 d25530b4f8779bcba083c808718ccb75144f84e3
SHA512 6c2937282897a2c6e5881bd7d1550ed9756e3d9512b4375c929a3d7b93da28b83fdec83707a288a6bf8f5503a38c14845266e82c6825b2e12ad0ebcc2741b417
SSDEEP 192:8BOpA/5qL/tH+bF+UI3iWGV+WNVVV63d888TV:it5qL/tIkUI3ijV+WNAaV
TLSH
T142F3FB5E5F643312CDBD923668E749B3597DF03F872366866C6104B1CEE2652B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5991f5.TMP

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Network Persistent State~RFe5991f5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 1f74e3b609156894a41ae38d04087e41b6c13336f9f66b3ba1a4a8f562b6a006
MD5 ff159c06350869e3d5d3b71fed82f056
SHA1 27f6e835c96e06f2ec1e5bc88a2daad1d3fb038c
SHA512 0b93f5216141dec84e65cb268a36612ba00da7d86c4f31ad8f9cf6c40456067be18738f3c51436a36a326f3e454f33749e947d2359d98472cfdbe4a7ed35c608
TLSH
T16DC02262003DE03620780D252880BD449E3AA0300083A8ECCA83812DD1904B64307062
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 4be6a89399b2516dce2d5c44d2f53b2e0b36e33c8bb86fc79b6422b5ea825f8f
MD5 6b02f91e0aeac28bf973cbee89c5fd1a
SHA1 d421adfac56e679da5c68e148187383aa864e69a
SHA512 3ce9028c0021520e0ab606e57033e1255654311339443fb96014a8e3eb9974e12a1244acb39775cfa88e8e1c4528971bed1feabc858562d3049dd2233763aa54
TLSH
T1C4C02262402FE47210B806216988BD889EBEA1300042E4FC8282812CD0744AA4207022
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Preferences
Size 6KB
SHA256 0e0f30cc47fb7cdfcac8e515a6fe59766ceab10503e67a760c79e40b1e4fd628
MD5 e156d339e104efbd1f87d39458274997
SHA1 140aac7164e808fbdbf74818efab54a84d7be697
SHA512 083454a4bcd79ed304382ad04f1f8a962f0170c50363930a449b3b47bbd0ee252626dc9ba239628402a9a082d35eca21b88ffc855b52067aeca44f9f9467d306
SSDEEP 96:stf/d4xFmxL4qb98k+do5h16Z0OXs7/x+6MhmuecJOTqM1eje6K+gG6SI8XM1C7K:stnI77JonisV+FdYvQjSGg6K
TLSH
T199D1A6065E28AD7F4CD6E619BA39BA17E2F95032B1D51E48E7F84A1C04DB6DC6307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Preferences
Size 6KB
SHA256 328a719aa1516213421f9c97c39584536d08e3a7b1eb67fe42d9201bfb1afb70
MD5 0145ff4508786ea8436a943cd543ece6
SHA1 da901ed9198954feb0932efc325bd3736d0c79d1
SHA512 a45991f5a0e2f18a942c9fe243d78293c24e6bc808e32e08243e057540cdb7c9d30daf3058281449e6a4198914e5cb9fd00da3d172fe324d0ead58bf6daf3d97
SSDEEP 96:stf/d4xFm4G4I7mbD8k+do5h16Z0Ps7/x+6MhmuecJRZMkkje6K+g1fb28XM1C7K:stnIvmBJonPsV+FdRZwjSnG6K
TLSH
T1B8E1A6065A286E7B4CC7E659FA39BB13E2F95062B1911E48E7F84B1C04DBADC6303907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599188.TMP

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Preferences~RFe599188.TMP
Size 6KB
SHA256 19643fc79e96ba6e31caf2f540f5140c78891267a0ba1791a85ad049705de69f
MD5 7f7e354beb4bcde4ed525748c7785a93
SHA1 dd9b0cbd7fc1c700791f518f062846bdacf22e98
SHA512 f7b937ff0f327b9bb163024d52078288e75d9aeb9dca137e6daeef5af3722b49de8f833436169cdad4c5ab3f5cd849053c42263226bb2a848238327b39a62ba4
SSDEEP 96:stf/d4xFmxL4qb98k7o5h16Z0OXs7/x+6MhmuecJOTqM1eje6K+gG128XM1C7K:stnI77IonisV+FdYvQjS8G6K
TLSH
T1C3D1B7065E286D7B4CD6E649BA29BA07E2F96032B1D51E58E7F84B1C08DB5CC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 98d1037b3f28d716e40467c0ba378c3e8c632154462ab0398e04c2c8fa44784b
MD5 f5740fb62bb59d5eed30d9081f152d22
SHA1 a6e1a1548e7ecf82f13de44f3cbea1534b5e4b82
SHA512 ddadb1144b1020ab44ce35850cc75faf10ecce71e244356655577b9f20ad0e0a09e789fb51f1bf98e8cbd98b8199910da731aacf831afeb50b254d25c9eb125b
SSDEEP 96:veiuPlf/ROo1pkF5d1eiD7VaTEv9V5h5pg5+e096rYi82sJCgX7umd:DSvqF9ld68i82y5uy
TLSH
T192C195A7092DC575AF448FEBDC287ECB99A601CFD9D54C0A96E2C54806C2EFC21DE8C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 9cee69504016396669dd0af4c13597772728b2045707ae580aabba08903828b8
MD5 347343b286d4db16e1fa4df85d2b4e75
SHA1 3305dcc7439417246415deb149d9457e198c5202
SHA512 3104248a1b87b43acf1ea1919446c705f775346f4cb3b566cf704829803d4cb0088d61b54a746cc838e2f2444c03106821f11c1ae8a5c2c9d6d58a1087a98167
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Site Characteristics Database\LOG
Size 337B
SHA256 e9b6ce4ea117538aecca7474ad95489c24dc017a36ef890ba6e7e03434d9acbe
MD5 ba606b9dc06776d0ef2557b894bffac6
SHA1 1246732fa7697cd8d8f688a29a4b7aec5433978a
SHA512 fb5588e55b0a1907d19cbc769fed88da6e4e56feeaced29f1c7a9cd9d2c0d24566b9e8e77a19563fc23c68dc8fd89fa3e987dafe1012bc41a556a02526bf54bb
TLSH
T1A9E0D83065C6C27B098705EB5136E34DC666B405EBCD25255F16EB84558B4447242710
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Sync Data\LevelDB\LOG
Size 313B
SHA256 579927f0a96a8e081cc0340308d931eaf8200e166820a90a138c50e3f2e0bbca
MD5 eab4a99ce5306f96eef23861dd34ae3a
SHA1 487921595814c088ca9a4788f45cb8d8f7e21e2e
SHA512 ec56cd745096283f2994cc5fa74e9dc609bfd73d7a5837983cec89bcd279d79b46bf28f5181bd9e930ba3bf40ca1c896c3e59dce7970c4ff25006e33258f7559
TLSH
T133E07D30A4D6C27A0CC589D7417AD38EC7B4B84997CE3A098B08DFD46D430047331650
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Visited Links
Size 128KB
SHA256 42290bacb5d1858019e72e984c3c235e6ab01121158f5c5a4db1d5b6f14e0665
MD5 b6b4536e9cedf601e73d26ab9075acb3
SHA1 ec57a7b95b141007d7f5f01009dad003a7766992
SHA512 9c1af86aef147c5c3bb1b5c61549b41eb6ddd81cfff793cc20ab6e807a883ee99a7f88677b6fe8a76bb86c7a40e30a85d46719a99ced297c64706f683ba9e009
SSDEEP 3:ImtVu5M90XlOgYUtl:IiVuOyXYAtl
TLSH
T18CD304444355C440C30C04314C14351D543FC44100310C01C37504414C4C1174513C50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Local State
Size 2KB
SHA256 d5c5970f5915aeaf7c67aef99220e017c90c4d4e722e567affbb39d4fd4a3ec9
MD5 3885f99cbd7b4c67fff6b97b19e3e844
SHA1 85000ea17046f3cfd91cff9383df97353b3e1fba
SHA512 d92206e8ba5ff0e8f65b59bfdaf89a11e6d4d946909168be6167b1bbbd2c27991dde614e1424e77bad2d288e64721845fc7e24676ffb70e8627b91c47ebc46df
TLSH
T1EF51A6739C106F3786B28B49B94A7F93CE7451A5DA922F94A6DC1B0C00DB55C270BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Local State
Size 15KB
SHA256 e79cee8db46ef90046df02e025ef26809fb707d8e6b92fa8a73133f288666c73
MD5 8f4aa4a3157eb4b9e2d09da8c5b14da0
SHA1 3c14f4a651a32bdd6374e45e2cf523ca8d94394e
SHA512 1cf2c8fc0b61ecf92c67c34e9c0209fa1157fca0ccb24392a8f4697bec3d8a7ef49babf8be62c2c22785d53a0b5b1f63e6667a74f9eb1b93e1cf51300bc10048
SSDEEP 192:TsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7v6NBSZ1iXeoDUhQ:Tsrv+89zHqlDNP9oidbNBSaJb1mu2Lk
TLSH
T10B729E33E538AA779EB28504F48A6E0B3B7860A7D5C21AE4D5982B9C518F4C9231BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Local State
Size 15KB
SHA256 b5ec30021159f180556ea5dfd36d5ddfd1d7922a84e5f3c281840409679aa12a
MD5 d03ae1dadb4dfff0f6a59c70e76bb676
SHA1 d1cbc5c26cc5ae2f9618e5e9ffe876ef00203b2f
SHA512 8d930f14a0c7fec18af6740f37d2477d935ad76ab2ebbdb4438f2c7830023b273a650f347fa487cc1f870ce7963f723d45e0f539ed29663ea6a9cc5f14a13acb
SSDEEP 192:usrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vJ3NBSZ1iXeoDUS:usrv+89zHqlDNP9oids3NBSaej1mX2Lk
TLSH
T166729E33E938AA779DB28505F48A6E0B7B7860A7D6C25FD4D5982F9C418F4C9230BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Local State
Size 3KB
SHA256 75f1700a7f24b7f1ae306d8b59f4fa842361de5afb3df68b35200ad833ca8569
MD5 5eabbe5b729dc46b8477774e7a39a033
SHA1 3e6984c6f5870bb364ccb3bc9aa8d2daf33d55f8
SHA512 2e26c4afb0805d35b20c92bcd76cdd4347e66f64517ee7629277b946e6de73541274008f1e8398feefff6487a6e2e4dd25dd27a621cc71acd34a64921e4800e1
TLSH
T16871A67B9960AE374EB28B09B98A3B46A7A45137E9C13F94D5EC0F0C00CB2881357C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Local State
Size 16KB
SHA256 8496ee08dcb9d3cb2a9ccf27a359973a318fece3ea225222192fb8bb5a9e5ba7
MD5 1447cc92653f2492267f295e3ed873de
SHA1 6663aae2e64d1955b3ea4b05a5408439c2abcf71
SHA512 9863daad11cd996412350e3c4030635063d30b1d60ba1bbbc038f0993f85be564674ed18452622e202d94781c1fd22039bf24eb12f4c7a1500700b7b534de2ed
SSDEEP 384:isrv+89zHqlDNP9oidMR3NBSPJc1HwyuuDzsLB:trv+4UNbdIhRwd
TLSH
T1DB729E37E938EA735DB28504F4496E0B3BB860A3D5C11EA4D5D82F5D518F4DA230BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5966fd.TMP

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Local State~RFe5966fd.TMP
Size 1KB
SHA256 4930426048424a5b907f5f0a602c0ca6ea01e5d5d4af6e15f2dcc7fdc71c199e
MD5 2ce6d7c2478dd4da46adffe44541081f
SHA1 aea47b8c08e17308064672daf88eebfa8d6472bc
SHA512 96d90d98bf707e620884be2fa657906d84344b58b85ce951b9930a8152823ca7bba8b54cc9284da6359b623b025d608a67c6e22ce192d68fa9806501a224623c
TLSH
T1FC3152F6C9516B725CA2574AB106BAD78E6061BAC6410F4871DC0B0D51EB58CAA2FC32
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\ShaderCache\index
Size 256KB
SHA256 4252a20b2e338c0dfefcc7dcf5dec9453ea365ba06e8da8d1036d3ca9c7e6ac0
MD5 7a3b9f2ccb8887593fd32482d1a7924d
SHA1 0dfbb9fa428c4e0eb22acfacc4dfd1ea27143151
SHA512 b77208d006e2dc479575ef8a6dada13ce05f397d13b32caad09b6cff2ea38d83bcf44d7961a8d94099c00cae535ef6eba25ed3aaa39bb90e3ce7df0c6c93048a
SSDEEP 3:LsOllllklkXl0NX:LsUlPsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1668-638-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1668-636-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1668-635-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1668-639-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1668-629-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1668-631-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1668-640-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1668-637-0x0000020F04600000-0x0000020F04601000-memory.dmp

Download

memory/1892-114-0x00007FF8DA5C0000-0x00007FF8DA5C1000-memory.dmp

Download

memory/4624-31-0x00007FF8DA5C0000-0x00007FF8DA5C1000-memory.dmp

Download

memory/4832-580-0x00007FF8D9AD0000-0x00007FF8D9AD1000-memory.dmp

Download

memory/4832-591-0x000002BD54E70000-0x000002BD54E9F000-memory.dmp

Download

memory/4832-579-0x00007FF8D9840000-0x00007FF8D9841000-memory.dmp

Download

memory/5800-620-0x0000011C31D30000-0x0000011C31D5F000-memory.dmp

Download