b07a4b8be8278c5348aa43ca8021977c7dff561e5e019c66041c21f9a944ca20

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
Size 13.9MB
Sample260816-rtl7mazekf
SHA256 b07a4b8be8278c5348aa43ca8021977c7dff561e5e019c66041c21f9a944ca20
MD5 54608a6d44902bb18bbcc73f49816727
SHA1 d27920c004543e27ef3b7329aedb1181de96ea57
SHA512 a06ccece8de1ecd22ed105250995b2f96808434a719e91041cac9482c21ba83b477ea1c5d01aebb052e42470b0a3e601b3e1f983112ee3560734bc4bedc2583f
SSDEEP 98304:CXm9sWpxzEC2e+O9cjLbwnBJOJrxw/7eLjeFs1SPnhR2aoB:COsHeujXwnBJOJrS/6LhN
TLSH
T196E6D616A6795099C1BBC0B8D2879F22B92170DA07382BF775DC82761F20EF8AD3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2116	powershell.exe
2116	powershell.exe
4884	powershell.exe
1632	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5732	cmd.exe
2228	cmd.exe
4132	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4132	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2116	powershell.exe
2116	powershell.exe
1632	powershell.exe
1632	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 35	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
Token: 35	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
Token: 35	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 2372	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	90
PID 5132 wrote to memory of 2116	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	91
PID 5132 wrote to memory of 2496	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	93
PID 5132 wrote to memory of 4884	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	94
PID 5132 wrote to memory of 1632	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	95
PID 5132 wrote to memory of 3364	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	96
PID 5132 wrote to memory of 5260	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	97
PID 5132 wrote to memory of 5732	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	98
PID 5132 wrote to memory of 2228	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	99
PID 5132 wrote to memory of 4132	5132	2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe" --exact mcp::tests::orphan_run_lock_holder_helper --ignored
  2⤵
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500; Start-Process powershell.exe -ArgumentList '-NoProfile','-Command',\"Start-Sleep -Seconds 2; Set-Content -LiteralPath ''C:\Users\Admin\AppData\Local\Temp\cc-job-orphan-5132.txt'' -Value orphan\"; Start-Sleep -Seconds 30"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe" --exact settings_json::tests::process_lock_contender_helper --ignored
  2⤵
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "Start-Sleep -Seconds 30"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "[Console]::Out.Write('x' * 1200000)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe" --exact usage::tests::process_usage_lock_holder_helper --ignored
  2⤵
  PID:3364
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_54608a6d44902bb18bbcc73f49816727_akira_glassworm_rusty-stealer.exe" --exact usage::tests::process_usage_failure_writer_helper --ignored
  2⤵
  PID:5260
- C:\Windows\system32\cmd.exe
  "cmd.exe" /d /s /c call C:\Users\Admin\AppData\Local\Temp\cc-probe-redaction-5132-1786890586413023200\probe.cmd -p /usage --output-format json
  2⤵
  - Executes a command shell one-liner
  PID:5732
- C:\Windows\system32\cmd.exe
  "cmd.exe" /d /s /c call C:\Users\Admin\AppData\Local\Temp\cc-probe-env-5132-1786890586436556600\probe.cmd -p /usage --output-format json
  2⤵
  - Executes a command shell one-liner
  PID:2228
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\commander-ka-provider-env-spawn-5132-20\keepalive.cmd exec --skip-git-repo-check -s read-only ping
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

claude.exe

Path C:\Users\Admin\AppData\Local\Temp\cc-claude-pe-test-5132\claude.exe
Size 392B
SHA256 73db998cb222950e8fa7fecac51ddd38224194a8ea3e38fbd44fc784e288772d
MD5 db85067abe6e9d01684901f4ec8fd6d9
SHA1 6df6790e1c6e4f229d20651c780174c45ba7ab93
SHA512 b819500071f76c304cb93e88c5a07df79dfb0103a47b550df4bf4fbefdcf6e12f19742acc5562cece608828e75108feb964830e9db9712d16073928fb0b6ed94
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-gemini-auth-5132-absent\settings.json
Size 36B
SHA256 b16179de2f95ec26e20cab6845807a8e07ea80a855e4520dbd069a6f7d301074
MD5 e6772c2e1c12129dd6045080074ab0f0
SHA1 cddd08050aebdea944ece6a12335d9a43a675b87
SHA512 567471d41981af1424735dee72d5b590007288e405edf94367f146c7ab1e7771824eb0b242b057f4cb5b13e816d2686996777b9c75f13ca3cf93431f28ad2595
MD5 SHA1 SHA512

Submit Download

commander.db

Path C:\Users\Admin\AppData\Local\Temp\cc-gemini-auth-5132-boot-error\commander.db
Size 340KB
SHA256 afddce01456d4c2965080d1924ca342967418ecf8be38e082f9e517691a638ff
MD5 ed284b1f586ba278c910370b2b512d40
SHA1 e79f03671c25a6672f3a728b32313df7b4e8ae2d
SHA512 6b0145ecd7bee0e4d849f20ed702f8f4f708ea3f509a8864362c5f58ade646b04e592dc5a4b2a5780619a6d9a3a964da2c08e3ef4299ec0916f281448a5cf048
SSDEEP 384:K5tzqoTe/ZZXvvhaEn9GxnoVEklKGePJWiwkDPouMwW1Of3R3PEzXzpt4Azns7:K5xxT+n2HwkMmMsAs
TLSH
T15C74A3CA2B64C111E0AB7277EFB29233D879181F1E91369478DC50C68F2778E937B4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-gemini-auth-5132-boot-error\settings.json
Size 7B
SHA256 be302461cda285db3ed2d45fb767b23e08ca8808b35a638009937df22b332d73
MD5 284e5d781ac5b15ed1ae7a5ceaa6e449
SHA1 1f8c8a3ca0b27f6e871e8086fdc0b8b9cf30c17e
SHA512 34a268b47fca103b781fcf5c2e6657c9d5cab9d56c163139225b6f92c5519ef76caefea713e62b3da4188ac4425e3bfa150e9fed5e4e9dc90f1ada3a9b04e8ea
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-gemini-auth-5132-named\settings.json
Size 62B
SHA256 fb80f74f3b55dc53ed93a0b6f7a7682571e03938f5a5186bac1dd19d759606ad
MD5 1f9655432c8f000f03e6dcaca8739acf
SHA1 4b105c86b7554afa1672590136767904176d989e
SHA512 8a1bc4f216e2e8cedbdb54135e151708d8a7c294dff3ea11c8a5d224f6f9afe3a1194d81f5ded400a3a212d6f78b49cdbe455f67f7f2d8222b9a5ab218d7bb59
TLSH
T187A0024111158FB0CB1ED09B58AC59EC85A88956C0E6435919C80324916DD494114A47
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-gemini-isolation-5132\healthy\settings.json
Size 55B
SHA256 32902a6358e88c9f42fa51bd68fc09970917c2ab8173617fa45cebf1a1d39add
MD5 55274519e06689146838a51f375a2adb
SHA1 29dc2166a070f5f6f1eadc50763bd7d39c012342
SHA512 657fe6089342e66be6f19576d8266186b43b6d75a05c1db754b00cfd904916e3c45c88ac5f2e3fa491ad46be9008e2d33e747d8bb5827a3d55d6d1f0b07782db
TLSH
T1EA900201191855F0DE1EC14754F045B841414807D1B5074D04C80118D889A0C4619685
MD5 SHA1 SHA512 TLSH

Submit Download

commander-statusline.json

Path C:\Users\Admin\AppData\Local\Temp\cc-live-usage-5132-1786890586\commander-statusline.json
Size 1.0MB
SHA256 154b8ed3c2383ce429058768595935faf7851b5c38db2b1732594be1d88bc05a
MD5 39ab1dfe1a0d0cd8c80781abc46701f4
SHA1 a2d3a328b12c27f67b151556c235e48bcfc4fd06
SHA512 dc397372a4e00b7353fff79ed80140bac7f2bf800f742bb9c1456db7ab7707628f667c3622f12c7ac7bf797aa3bef600a9311461125de7975ef56208d1e521f7
SSDEEP 3:d:d
MD5 SHA1 SHA512 SSDEEP

Submit Download

child-lock-held

Path C:\Users\Admin\AppData\Local\Temp\cc-orphan-locked-3510ddb819997c04b22397f9e4184423\child-lock-held
Size 4B
SHA256 c20dea4d876b5b8fb0a1814b43017030cea6d4ac30b2d9ae71b404d2faba49b5
MD5 0eb29f5d6149e84750bcd6f6e741a7a1
SHA1 2c034395963ed14c03b16e3b6e089a1aafb603f9
SHA512 e1ec6f1dd8e6e73f622bdc7c43a010fbfd46e0f7db899f2dc874c8909dbacab9466f157fad518418a9750e0cb6f7d44d7265a055c4c0dd8fcd6263dd67de9243
MD5 SHA1 SHA512

Submit Download

release-child-lock

Path C:\Users\Admin\AppData\Local\Temp\cc-orphan-locked-3510ddb819997c04b22397f9e4184423\release-child-lock
Size 7B
SHA256 a4d451ec23463726f72c43d64c710968f6b602cd653b4de8adee1b556240a829
MD5 123fead50246387983ee340507115ef4
SHA1 01f561ac4ab15d6a23a57976bba4dbcc423b9cbb
SHA512 694c24c429f9bf6f358ef0d0c276b2a53475c4d3033a33813f8f3bd95382ab31e0c48dee407f8e63eaf87f22b2474acc27b3719003ead6f23cb9c67af8e68396
MD5 SHA1 SHA512

Submit Download

probe.cmd

Path C:\Users\Admin\AppData\Local\Temp\cc-probe-env-5132-1786890586436556600\probe.cmd
Size 468B
SHA256 349e23b3ac8273ec5fdb2aede0371c6f8dc7e852477dd767082dfec80c4f7d04
MD5 8281641e77a88b6702aa7bfe93f8db9e
SHA1 7661ca98916b3262b66264eab9f428d00fb9860d
SHA512 8eb22daf9077a3bb6b9782a233673fd611f41bb8af3c7f68df12bb62b5e2fe5287ba1515d76d34beed9dae0347cd0585bc9aee49b84d89ba872c15e33a79fb03
TLSH
T1BBF0E94A6E841533C6A31D384A7040D3D5366B6F36162C9093E2CC68AC280B5DBD538F
MD5 SHA1 SHA512 TLSH

Submit Download

probe.cmd

Path C:\Users\Admin\AppData\Local\Temp\cc-probe-redaction-5132-1786890586413023200\probe.cmd
Size 79B
SHA256 96817d7ab5af561190d71f0fb122e3aa17c0acc8e4ad96346de6487d4a2a9a7c
MD5 a26fa03b7f2f527237b9fcffc5042671
SHA1 5347b17eb65e908b166cd48a8118a19c09554d7a
SHA512 b3d5dae4e92fa17157ecb1e38f695270fa5bcde9c7364f14c7df15f01738ba8cf6c2536d5af748f10d724178e79d1bb81385d3eef4e2dd773345aef5450a6c8a
TLSH
T1B6A02413D0401F37C3430F7317337440310143C5151754C04003D4350C40040D7C74C3
MD5 SHA1 SHA512 TLSH

Submit Download

commander-statusline.json

Path C:\Users\Admin\AppData\Local\Temp\cc-scoped-one-window-51-5132\commander-statusline.json
Size 77B
SHA256 bb8099c6863ff5661f5d484a9d8b218f4e73f967d1c997e40393365b70c61e69
MD5 5469a158f8f40ade19aaaa59eeda149e
SHA1 5b343e1ded0d366df6f9bb365d0b16f8f1e99805
SHA512 0c78d429e1093e637a340655d5939a26a3cbc0f540775c376a54baedb1dde6a91e4d17407eac64b7f68ee96bef7d6f7f63c86e8561d1500fd000dbf51c24791c
TLSH
T14EA022A02E8C003BCE23F80E200088E02033C23000B08FCC23F2EC00280FA0F000B0A2
MD5 SHA1 SHA512 TLSH

Submit Download

commander-statusline.json

Path C:\Users\Admin\AppData\Local\Temp\cc-scoped-one-window-52-5132\commander-statusline.json
Size 77B
SHA256 19b935d18828c95f113252fd090a78c16ceeb7f1bfd559eaea2b3f8bb1a5205c
MD5 496c8b9464b5d674c8a70bd1beecb57b
SHA1 e0b2c593da474a651b653dd50807b7d2383eaeba
SHA512 9ad591773a89f0bbeed158f649b98c96417559165e459a209998cb5b86f029e17ca02503396776145d5665b5a83cc858fca9edd746ef05b6cf4f075acab37f4c
TLSH
T178A022E00E0CA03BCC2FFA0F220088A00033C03000BE8F8E03F2B800200FC0F000B822
MD5 SHA1 SHA512 TLSH

Submit Download

commander.db

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-final-save-5132\commander.db
Size 344KB
SHA256 07c6c5ad9df22b3621a9d458737457b1159ee53e298e0abb81a4fca0153e16ab
MD5 9ff57d4ee704749aaf231094a22397ac
SHA1 9c01ae9ff34417fe9e7ad457910b3da3abe71b7d
SHA512 f913bc4fe0ca1ddff39234102e1ec83978b94e717b5b34d4957f9a4e248375e9e03bd284559c4b0c9674b9b4beccbe21fa91c8a1f8e2b49831b0c800142b93bd
SSDEEP 384:qg6v/U55YF55kkMS53v05y05qH6mBYE4mQnAM4KBNnoyesAiwkDV9cOlEk3/zptx:N6nDykM2v/Tz9KzwkBqAJ
TLSH
T1BD74B4CA2B64C111E0AB7277EFB19233D835181F1AD1369578DC60C68F2778E93B74A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json.y3Dowe

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-final-save-5132\gemini\.settings.json.y3Dowe
Size 83B
SHA256 ba57692c3c2bb2a9b43389272e8a16b512351826d0d728eeffcf153d7db5c6f0
MD5 9f7c747159a3f2f058757ab0152e096a
SHA1 ac4e31bf56279eb30a1b2773139925f02cae3819
SHA512 096a5a73d9b0388d8307b6a9e9ccf93a3f315041cd7e5e987be4c4426f3cd00e634e68ec4d8567179b83fe99cecb354f867a40727889b0294145d51b4dce9cd9
TLSH
T19CA0122054644873461F000300784040A200C81790640D1A34CC005CDF48800098F5C1
MD5 SHA1 SHA512 TLSH

Submit Download

.settings.json.bDk02b

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-prior-crash-5132-after-config-written\gemini\.settings.json.bDk02b
Size 101B
SHA256 79bbcc98586c3bd81501cf84eeaca70951976b8b147c6a1bb060f58a9f96da1e
MD5 a8a42f627824fe64310acca06c91d530
SHA1 bb24d1fe044fd08600c89f90d8ed5328a9459fd2
SHA512 5da008205b9e74aabd640982b14a253ba56691d71913d2b31b2f46a8175a4dce81d91cf0597a4ba09a64ecaf8dbb3279f4821568dd971f32a1b2289421a9ce89
TLSH
T1FEB0123050F40833451F006304FC1041E900CC1780A81C2F34C9009CDFCEE0018DF6C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-prior-crash-5132-after-settings-commit\gemini\settings.json
Size 69B
SHA256 62858db96be396842b54f8d5c3153b9327d105c4ef6787d43015935293d9aa24
MD5 2d182aa46d0c52d571618b1b24ca46e7
SHA1 d74caea30827c91c94ea6f4182fa265ce179aff7
SHA512 645f48d8245142165ab63cc048e4e7cbc0eb386decef8c1c607e281f21e9bd4dd256c9f70881fbc0de008bb11a10f810ab8b6bfb786cc8fc920f21aa63e2bc34
TLSH
T1F4A00213115565B1DA2FD097D9E82DB884614815C0BD16CD14C96159DCDEC4C4D35746
MD5 SHA1 SHA512 TLSH

Submit Download

.settings.json.VzJGED

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-prior-crash-5132-before-settings\gemini\.settings.json.VzJGED
Size 85B
SHA256 26d3ade2e8e92cbf899a368adc678ce993e31f6fb243dec42fc0a9fa03852f7a
MD5 85b07e87d5ca53cbd5bc6619fd7850d8
SHA1 6188de24356450e5f3e01a0b01a65f9483b63404
SHA512 4346c1d5e4b1c7cb4cf4d81baf844c8be2490e928d53439b7ea66b22ad772051280cd73992c8cb21b56eeaa4aea90997a52b2287e5d27795f15e9e5217e1d645
TLSH
T149A01130A0A008338A0F002300B80082EA00C82B80A80C2A38C800ACEF8AC00088BA80
MD5 SHA1 SHA512 TLSH

Submit Download

commander.db

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-production-race-5132-rotate-remove-wins\commander.db
Size 344KB
SHA256 6fff89abe8fec0606aa8ae37e6a07b3596ffaf0e7269b0e1673c12d84ec826a1
MD5 8088dcc44a7f41e31ff6ffb8b1887bc0
SHA1 8ca892566f44de413758ba3b741ee5f2c1516951
SHA512 dc48c54bfe3c890b53cea7f9d22554a00617772420bb5986a3f5f2d83744b9cd99c9d60b341d8a7d08d3cb88407717381f3db7ecb9a87934500c21881727a26e
SSDEEP 384:TtUi76vzG778ITV61706mBYE/eRQnAM4KBNnoyestiwkDV9YO6bk3ozptVAhOows:W06rnIQWz9rAwkq/AMAU+
TLSH
T14E7493CA2B64C121E0AB7277EFB29233C875181F1A91369578DC50C68F1778E93B74A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json.nebeju

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-production-race-5132-set-set-fresh-wins\gemini\.settings.json.nebeju
Size 83B
SHA256 301f11a940ca669bcb3b00e483fd697619a5c3699b9f2d129608b509dabbe4cb
MD5 d0734d05431f434615cd6bb98d1f956d
SHA1 0400c933039c9b5f05fc2795e2c35ee956c53111
SHA512 3f1a1d9e282f29d5cdca55e7596accf616d93803c7c17ffada97cfff4baed18bc872d27796a7e5d9876989a293390912891f4f56e2733f0c1d38c5d0a4d9d460
TLSH
T1ADA01214B0680873050F400304785051B500CC1740484C2E38C800A8EF0240404CD684
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-production-race-5132-set-set-fresh-wins\gemini\settings.json
Size 67B
SHA256 7f50099c4f6799287cdaccbbd5f56868c2eae1a6b5617d03d9521e889ba92ad8
MD5 5faa7ae429277728c83b1a13854b867f
SHA1 75e4c1edd8d777ea41861a91c31073f9598047ff
SHA512 d38f28dc16f45461b10b6ffb48189aedd14963ddcae4e5c8cbab2c601c4c1eeab519868d69bbbe46e96f12e1d6adcd3ad9d0403ad64b647b5f2e30949d344619
TLSH
T153A00202191865F0DA2ED18799F86EB841514817D1B9078D04CC1118D8DDD0C4E29686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-production-race-5132-set-set-fresh-wins\gemini\settings.json
Size 99B
SHA256 a000b755a220491e07033a53c55de0460638563b54fb0cf1177dfeb00063bfff
MD5 86210ca35fc16aa7a045fd3e2fcefe06
SHA1 5c189298c6ac3735c6f137a6644f874010edfdfc
SHA512 ad09603ab662a0cdc268d256cb54da939596f1cf7b165c77e724807de00810f5fecf4acf3d8855b6ff539548dcaa4a93bc0b6c217d67e6958207ceb277463683
TLSH
T19FB01214B0BC0873051F404309BC6051B900CC1780484C3F38C900A8EF4B90514CE6C4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-production-race-5132-set-set-fresh-wins\gemini\settings.json
Size 57B
SHA256 f03a920849d739903c262caa74916d441dd7b879c9b19c199b03bb91d9aff394
MD5 8b4ff7cf4e81b4797512ea0226c51fef
SHA1 588c1ad1d36624623ce38f401ea169ff607ba705
SHA512 a426f812fb342c78c31d84788c21b1bbd24eb8897530eded1086370354398835ae83e7931d10baa0ea3e8449905361cab3a6cebbd871a2034f61953081ef1860
TLSH
T1AB900211115555B1DE1FC05794E004B884514805C0B9168D14C55159DC8A94C4525745
MD5 SHA1 SHA512 TLSH

Submit Download

commander.db

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-remove-race-5132\commander.db
Size 344KB
SHA256 14a490d0afda79bb6094658810f1dfed72dc9f110096991fd48a0c43b7410ada
MD5 3aa3a62bc87ca61a148c4e2f1b4f830c
SHA1 e58f1d7bbd03ae6bb14223d611daae6f4a155888
SHA512 d164155465e1afc50014eb84bbf8cdce64044c1586457faa504ba74e60faaad53a207a8920002b5aee014e5113be21b84d0aef18139fbc01a010f38c2878ab29
SSDEEP 384:BlL6vzrz4z4jBEz4/mz40Oz4Oz4u36mBYEnLYQnAM4KBNnoyesOiwkDV9cO6bk3x:fL6r/C6Bm6MvERJ3z97xwkG/AMAU+
TLSH
T1D174A3CA2B64C121E0AB7277EFB19233C875181F1AD1369578EC60C68F1778E93B74A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commander.db

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-set-phase-5132-prepared\commander.db
Size 344KB
SHA256 3b7e5599a8c364bde4fd063a4a32262d9863e70419acf5fbbc609294ad07d539
MD5 27df5f34975b378f7bd9f39c2a6b9d35
SHA1 b965d53f6e5dd5b6540c1960e2efffcea3d6efa6
SHA512 9bfa28f4e61f91651b183e8cafe62f9f63e92399f36eb1dcb61cf2bd041cf0e8b2b874424cf0c8cdda480359e16244914994274a66a9c7247440c6c8b5400293
SSDEEP 384:wxGJHQ6vSq55D05+45k9P82e5Ae5kJ6mBYE44eQnAM4KBNnoyestiwkDV99O6bk2:3Jw6qqb39P82z5Jz97JAwk//AjAUi
TLSH
T16C74B3CA2B64C121E0AB7277EFB29233D875182F1AD1369578DC50C68F1378E93B74A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json.wbweFQ

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-v13-5132-rotate\.settings.json.wbweFQ
Size 99B
SHA256 ca2aa272fb2f7a27dbd700da95a5a0975771348322738da48f6e33d73cb9dd52
MD5 7bd0849f99cfe0eb41dfd04903e643b5
SHA1 fff37068d4c7d7e0ca0ec1eb437fc9689a362caa
SHA512 eb194a654632260c9594b6fcebdffb9e2d0a56489442e42476fb3653e4b7fc4006895caa02e30d9c717467da916204bafc97c5d7c4b6b5ffd5d96a147854d31a
TLSH
T1B2B0122054B84873462F004304BC5040A610CC17D0640D2F34CD005CDF8DE0119CF5C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-secret-v13-5132-write-failure\settings.json
Size 67B
SHA256 dc5873d4077ea298599f79e0165706132019c32e2472e691fc4d2dc5841e6bb3
MD5 42138c38d13004382eb028fafd133952
SHA1 823d3c2165e23e0b36451445ca0d9a7930760bfc
SHA512 d554f810bfa4ac54f1bbe4ea88cfaaf659de598b94145b0c944ccace04b3d3e6d2aa5a6ee88e2ea4858877c135d3e4bdf04f74bc74722a353e3aa380c25cddef
TLSH
T19AA00201191895F0DE1EC18758F85EBC45658817D1B5075D14CC0318D8DDE0D4629A87
MD5 SHA1 SHA512 TLSH

Submit Download

child-attempted

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-child-process-lock\child-attempted
Size 10B
SHA256 c8c116fcab765c715f2cc65a68ddab07a9feeed2f268036811556f636febdf9c
MD5 e6ce08eb039e0049534145621cf08c64
SHA1 203bd7578169b38030b6fb2b617206f1a2388113
SHA512 f0ce82170ad91ac0363afd76f69d91d343fb2631c8b44f58e59d812bae02404bf057099627ea37f2457694178b81d9e1183a05aba2499e833856183b9f6afae0
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-child-process-lock\settings.json
Size 38B
SHA256 80ecf66b8f345c5094a2ab611de26e19453764fe63d8aa15cd6a0f87cfa4663f
MD5 94701acc223ef4b951c6ba45cc6abe0f
SHA1 58e1412fac5ce41dc9687faf2c06e4c739c0b8d4
SHA512 d4be0d8dbe7c50952cf3c0e98d914b8a04c30cb687cec457fbb1e51b93bc5a49e83facb101edf121794901c2e55688cbba9e01a09200757b6629fc657a7561a8
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-child-process-lock\settings.json
Size 21B
SHA256 0b19d921fdd12ba62c1f4f96749782e4c375eac93f68d68a274acb6d0da7d9a5
MD5 249a0fe0e5da3b245e7da4ccfaded281
SHA1 db8fbcd9aa1309fa2aaa0c29ed51785c056d9ca7
SHA512 455bd579bdaf92b796090c9cb565cf512d96fcd093ec3c41e76d7927a28479d77ddebf5497a9c2b97a834623a539b2f8e8dc15023e17cc3a1a0e1ecd44641d37
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-completion-lock\settings.json
Size 22B
SHA256 046dffe28472ba61ea2c0eb76d876167157be9b891ea7944661c6e5414134a03
MD5 e75a765fb6e7fdec4e70541663f8611a
SHA1 7b9fc0d1e86967ef691ff6b9a8363f11a9b2e40a
SHA512 3480f4b53e150c32b3c1575062de78d9a28af82706f6bee5e8389ac0f777cbe0924143667188fc06497bc231c7c6c39dd1d8e0c5fb6e76bdb8dd810f0e446108
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-create\settings.json
Size 13B
SHA256 c5e1c113d5c75240d109ea470244fa988c5d9970f26bdbbb885876ae1da9d2d7
MD5 7444c511ad190031fc1c73723d3bab22
SHA1 d9d8147e7f7c0ed75df13a105c6966a27cd56ed0
SHA512 b306185bbc8ae56d323a7a1d0445455013c07756120b08a11835f947694b6d6eb15602f7b832dcd3f00093019359a700f8fab83087da8e44580028a117f7d4e4
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-invalid-shapes\settings.json
Size 4B
SHA256 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
MD5 37a6259cc0c1dae299a7866489dff0bd
SHA1 2be88ca4242c76e8253ac62474851065032d6833
SHA512 04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-preserve\settings.json
Size 10B
SHA256 49c09fe65edbde7b454785e5ae8c8c687a128aa9ce051faea122b5998a920aa0
MD5 0f88da42beb003df78e23dd449637717
SHA1 5f0fe095d3324af73831c0252cc4f209821037c3
SHA512 313b74bce3a0cc2320edd5e825a61aeb57ff159a2b208edec1075740dd9fbee8a55cfb04f890081481a22cfc7967a74adb3f47425c3c4b37bea06d87edf5da90
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-settings-5132-preserve\settings.json
Size 49B
SHA256 7dde727289a61d1a66993a6911c151ce84bedfcc0c96d5ab7d822ad3e4981616
MD5 b08532fc9e8ebefbb876693d6f72b959
SHA1 e96f9f21aad2ca3aa6bd8b0f52b346a5bf4e5a8b
SHA512 6098ea972baae1f648e5e5d99c1b2254051ef9bfb7ce6103bc2f2026c400ebbf54bc388a9becbf1b99060beeaf3261371f1bbe744777dd83509cb08deb3f4779
MD5 SHA1 SHA512

Submit Download

.commander-mcp-abcdef0123456789abcdef0123456789.tmp

Path C:\Users\Admin\AppData\Local\Temp\cc-shutdown-late-register-bdc767f4a3980135666d16446cc6174c\.commander-mcp-abcdef0123456789abcdef0123456789.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\cc-sl-5132-invalid\settings.json
Size 3B
SHA256 8855c6119660c614d285554e51769066e94fcb75ff215ccc2fa6b4838b18756b
MD5 2c744dffd279d7e9e0910ce594eb4f4f
SHA1 9aa23bb69d6a07ff8bac5ee2f86f600939ed47b7
SHA512 273f657f512693340d8d1f1f5a257ae7bb676f7e9887b9b79e15ab0084ee9c0562e3a93153762480522168867eff2acc0a4ce22406a18cd84382f8498a78369a
MD5 SHA1 SHA512

Submit Download