67cea7efd52dd067f0968f3c66bace0da756ab6a4d95f320573401ad2df5002e

Analysis

max time kernel
299s
max time network
297s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
antigravity_tools.exe
Size 47.4MB
Sample261020-t5ctfacd37
SHA256 67cea7efd52dd067f0968f3c66bace0da756ab6a4d95f320573401ad2df5002e
MD5 9a223762e8819045bdc428c28980a7a2
SHA1 f7a80e826d47d24fe14e837b89eee211e597666c
SHA512 0c88d637a90978b2e43aff1b2e093ef18251fbe7f78c5655958877917bc140dd24c699050389a26e68289d204e2c2f7bc86dbf44df72b60b68ebec35774751e7
SSDEEP 393216:1dHRFgGfs2ETWrfnK1BaIKY/fQDOASSsgwQZdG9ge1LcHkhwW:1dHRFgGfs2EKri1Bac6OhgbQ1Lq2f
TLSH
T187B71721BB9A596DD19AC474834B4A725A7130CB0B35BAFF44C486393F79BF46E38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3580	Antigravity Tools-4.9.8-installer.exe
2904	antigravity-tools.exe

Loads dropped DLL 6 IoCs

pid	Process
3580	Antigravity Tools-4.9.8-installer.exe
3580	Antigravity Tools-4.9.8-installer.exe
3580	Antigravity Tools-4.9.8-installer.exe
3580	Antigravity Tools-4.9.8-installer.exe
3580	Antigravity Tools-4.9.8-installer.exe
3580	Antigravity Tools-4.9.8-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	antigravity-tools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	antigravity_tools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2018797282\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_412503711\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1649283182\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2018797282\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_412503711\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2018797282\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1649283182\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2018797282\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_412503711\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1649283182\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2018797282\LICENSE	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	antigravity_tools.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	antigravity_tools.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	antigravity_tools.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	antigravity_tools.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antigravity Tools-4.9.8-installer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5536	taskkill.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	antigravity_tools.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	antigravity_tools.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	antigravity_tools.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	antigravity_tools.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	antigravity_tools.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	antigravity_tools.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	antigravity_tools.exe
2032	antigravity_tools.exe
2032	antigravity_tools.exe
2032	antigravity_tools.exe
2032	antigravity_tools.exe
2032	antigravity_tools.exe
3580	Antigravity Tools-4.9.8-installer.exe
3580	Antigravity Tools-4.9.8-installer.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5868	msedgewebview2.exe
2396	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5536	taskkill.exe
Token: SeImpersonatePrivilege	3580	Antigravity Tools-4.9.8-installer.exe
Token: SeImpersonatePrivilege	3580	Antigravity Tools-4.9.8-installer.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2032	antigravity_tools.exe
2032	antigravity_tools.exe
2032	antigravity_tools.exe
2904	antigravity-tools.exe
2904	antigravity-tools.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2032	antigravity_tools.exe
2032	antigravity_tools.exe
2904	antigravity-tools.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 5868	2032	antigravity_tools.exe	89
PID 5868 wrote to memory of 5004	5868	msedgewebview2.exe	90
PID 5868 wrote to memory of 3500	5868	msedgewebview2.exe	91
PID 5868 wrote to memory of 3500	5868	msedgewebview2.exe	91
PID 5868 wrote to memory of 3500	5868	msedgewebview2.exe	91
PID 5868 wrote to memory of 3500	5868	msedgewebview2.exe	91
PID 5868 wrote to memory of 5876	5868	msedgewebview2.exe	92
PID 5868 wrote to memory of 252	5868	msedgewebview2.exe	93
PID 5868 wrote to memory of 252	5868	msedgewebview2.exe	93
PID 5868 wrote to memory of 252	5868	msedgewebview2.exe	93
PID 5868 wrote to memory of 1172	5868	msedgewebview2.exe	94
PID 5868 wrote to memory of 1172	5868	msedgewebview2.exe	94
PID 5868 wrote to memory of 1172	5868	msedgewebview2.exe	94
PID 5868 wrote to memory of 1172	5868	msedgewebview2.exe	94
PID 5868 wrote to memory of 1172	5868	msedgewebview2.exe	94
PID 2032 wrote to memory of 3580	2032	antigravity_tools.exe	95
PID 3580 wrote to memory of 5536	3580	Antigravity Tools-4.9.8-installer.exe	96
PID 2904 wrote to memory of 2396	2904	antigravity-tools.exe	101
PID 2396 wrote to memory of 5744	2396	msedgewebview2.exe	102
PID 2396 wrote to memory of 5908	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 5908	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 5908	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 5908	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 4952	2396	msedgewebview2.exe	104
PID 2396 wrote to memory of 984	2396	msedgewebview2.exe	105
PID 2396 wrote to memory of 984	2396	msedgewebview2.exe	105
PID 2396 wrote to memory of 984	2396	msedgewebview2.exe	105
PID 2396 wrote to memory of 1088	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 1088	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 1088	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 1088	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 1088	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 1548	2396	msedgewebview2.exe	110
PID 2396 wrote to memory of 1548	2396	msedgewebview2.exe	110
PID 2396 wrote to memory of 1548	2396	msedgewebview2.exe	110
PID 2396 wrote to memory of 5688	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 5688	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 5688	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 1312	2396	msedgewebview2.exe	112
PID 2396 wrote to memory of 2052	2396	msedgewebview2.exe	113
PID 2396 wrote to memory of 2052	2396	msedgewebview2.exe	113
PID 2396 wrote to memory of 2052	2396	msedgewebview2.exe	113
PID 2396 wrote to memory of 4740	2396	msedgewebview2.exe	114
PID 2396 wrote to memory of 4740	2396	msedgewebview2.exe	114
PID 2396 wrote to memory of 4740	2396	msedgewebview2.exe	114
PID 2396 wrote to memory of 1952	2396	msedgewebview2.exe	115
PID 2396 wrote to memory of 1952	2396	msedgewebview2.exe	115
PID 2396 wrote to memory of 1952	2396	msedgewebview2.exe	115
PID 2396 wrote to memory of 2708	2396	msedgewebview2.exe	116
PID 2396 wrote to memory of 2708	2396	msedgewebview2.exe	116
PID 2396 wrote to memory of 2708	2396	msedgewebview2.exe	116

C:\Users\Admin\AppData\Local\Temp\antigravity_tools.exe
"C:\Users\Admin\AppData\Local\Temp\antigravity_tools.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.1.28 --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2032.6028.614317054802630228 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView /prefetch:4 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8c6e35fd8,0x7ff8c6e35fe4,0x7ff8c6e35ff0
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.1.28 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1864 --field-trial-handle=1872,i,13406560251825737845,10893706625929428753,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.1.28 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2088 --field-trial-handle=1872,i,13406560251825737845,10893706625929428753,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.1.28 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1872,i,13406560251825737845,10893706625929428753,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity_tools.exe --webview-exe-version=4.1.28 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3364 --field-trial-handle=1872,i,13406560251825737845,10893706625929428753,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 /prefetch:1
    3⤵
    PID:1172
- C:\Users\Admin\AppData\Local\Temp\Antigravity Tools-4.9.8-updater-gRc7m1\Antigravity Tools-4.9.8-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Antigravity Tools-4.9.8-updater-gRc7m1\Antigravity Tools-4.9.8-installer.exe" /P /R /UPDATE /ARGS
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /T /IM "antigravity-tools.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- - C:\Users\Admin\AppData\Local\Antigravity Tools\antigravity-tools.exe
    "C:\Users\Admin\AppData\Local\Antigravity Tools\antigravity-tools.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2904.8.15095058918903754835 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView /prefetch:4 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0xb0,0x198,0x7ff8c6e35fd8,0x7ff8c6e35fe4,0x7ff8c6e35ff0
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1952 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:4952
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2412 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:984
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850 /prefetch:1
        5⤵
        
        PID:1088
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:1548
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4416 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:1312
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1056 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:2052
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:4740
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView" --webview-exe-name=antigravity-tools.exe --webview-exe-version=4.9.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4180 --field-trial-handle=1768,i,1600526163163096543,197665606875916157,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b8fab6fd81cc3ebb76355b7ee86b637b4ca08850
        5⤵
        
        PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

accounts.json

Path C:\Users\Admin\.antigravity_tools\accounts.json
Size 70B
SHA256 ddc683b936827752701e0aa4d2c830ac43dd830d6f8cad3fe70d024734940e76
MD5 d31803f7911ba63d0c6b6268e5ebbb2d
SHA1 2f5bc899eb30f03e1f7af02f8ebe75af8b1d0235
SHA512 6c887a6c763f8d699868452e7b3759fa2727866dd34db91c611e8593e4b9e6eab30d18ef7187ff98bb7008ca242a4321ca91129b8f7d297bee5c8c7952589cb9
TLSH
T155A0025099325473F8D15F14215693EE87B14D572240720C06EF1819179D5A96372605
MD5 SHA1 SHA512 TLSH

Submit Download

gui_config.json

Path C:\Users\Admin\.antigravity_tools\gui_config.json
Size 3KB
SHA256 ed530494540b14378135bee0bf6f5f98678e81468b425b524de3135a21aada7d
MD5 1b8ef1224452f4dda39f20a41f20557d
SHA1 59a393d0fef0dca4832b8ca8456bf79c04cd8bb6
SHA512 60111f8005c4513efff0db9b96fa9a343ac2fdf33a7ee9fa6555ac957c216d13986b4f321f6034aac09b2ab45e322daf71e0c572da50b1f843d7602e4c0f086d
TLSH
T19E517A28C9790CF701D8D029E9BD92936260C9970F167C38B68C952C1F4E73E1AF9ED9
MD5 SHA1 SHA512 TLSH

Submit Download

gui_config.json

Path C:\Users\Admin\.antigravity_tools\gui_config.json
Size 4KB
SHA256 2f74f85a8624b3cc0e207bde94b8cfc3b30b1eaf4c538c809a5f5ffe0dca5d4a
MD5 ad0796b142fb16d001104ddf0bf33c4a
SHA1 9b8b9aa8d92c820b48e806b6a9d11f102c76ddfd
SHA512 ec2915051e23f51091ebe4e0d14f0a1c028680c4ec22b3d5545866899da94002fd3cedb1f901b809faa8b0bb99c118ec9877aeb80c3e0128f0f293190c152a5b
SSDEEP 96:UgXpkuWZVx7Gifb9Ix4hZjb/Mb/zgA/9kdd:nZkbdSuhZjb/Mb/Uxdd
TLSH
T13FA1BE29C9790CB701C8A53AA47D928357B0C9174F163C38B28D492C1F4E73E27F6ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.log.2026-10-20

Path C:\Users\Admin\.antigravity_tools\logs\app.log.2026-10-20
Size 4KB
SHA256 4226181e8c051dd5c88613e4a51526af3d3534266a00beb6b597eda5d14f63d8
MD5 fe8bfa1f434772b682bd4290093aac5b
SHA1 f44701a581204651f20de5ae1b77b24ad113331d
SHA512 7ec325979fd3e737b3302b7db33dfce14e8e4e17c237c416483b21f5c6707a833042d841e83b0e511b8a0ca972161fe09e555ab3d4fa38b9b04290a24aa82737
SSDEEP 48:8ZSRvV8bT1h5Ulu5nw5dHzIm5dAdz52L4R5in5FK3sX8zR/S3sf1lG5yg/sqOtCC:8aCUkgfO6CWGY8Pgsgs/ITq
TLSH
T10B812B1459F6D113EF1B6A92F10EF78679BEF86BF74C40AC678CAAE401490306BF9601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proxy_logs.db

Path C:\Users\Admin\.antigravity_tools\proxy_logs.db
Size 68KB
SHA256 b2d75a608bff60d1d25ab9dd85f550917d273086ecaa3489674593d5df047fd5
MD5 02b825bb0d5b8ac5f359b82146622f52
SHA1 91ebd0bebbd4157575b60872da31943e028f53e0
SHA512 4a00e44ddf04f308c5b31ae17bc6f06f2d433f3799ff23d1a28e2c22cd1bea16f46191bea664454320927fb8c07f022280406ffeedf50205b1c0f2913f216f6e
SSDEEP 48:Ta5zRzpTQbMCm1y64Ycb/oM0YzR8RndZfEElMsJfA9sQGGn2JqkQilU:GNOm1zndZf/A9
TLSH
T105635DDAC6F82921E94E22366C513BA0177CE54D58D66FB3309C439E0FC6441ED392BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

security.db

Path C:\Users\Admin\.antigravity_tools\security.db
Size 52KB
SHA256 33d7d54b9d7894aae09a9c45d27377099fd8fa95278e8c5e23a9704de62e0528
MD5 339eb94985a676331dbd5b0b5df27f6c
SHA1 58d7d5fdb0e35e066366e658f762fd497ee710b6
SHA512 233cd7fa205ac0ae58f8474bac4182fd7ae370e92052ca1ec7626d7af4370a313413a29cfbd92408229439b493a239db01a6aa38a9ce000747ff950e84ce40e4
SSDEEP 48:Tb/ZVGZIB8mBKS4WszKZX2BIbDs/VscjmmZt2:XZVGZnmBBszKZmB0Y/ycjmmZ
TLSH
T1AF334CC64B683660D2D54273985206717229C85F9E633BC1B8AC51A92F8F08DD638BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

token_stats.db

Path C:\Users\Admin\.antigravity_tools\token_stats.db
Size 40KB
SHA256 0789777f66d9841b8caef040b5fceaf661c826ccf34e1dc16cfd62f812541456
MD5 aafd56e52f52c513964eaab7a3efa4b7
SHA1 cfa788f310938be35e2e18a28746ccacc7139489
SHA512 a361f3d658c75264adfd9cb2b72ee5c3d66433ede15eaa398f7ae6a079e7b2589fb6bfaaa99b6b6f037bd363d2eed26d793da41cade4ba597f237eb4b9b1691b
SSDEEP 24:TTd4JTf6w+4b2l6sV1e4NsqJq3gI2BkQBkYhLi6wxsw:TTGJTf6wbb2l6MRtI2BJkYNi6wx
TLSH
T1A503244E1A142669D9FD1C71BCA4097B3A3CA10F4F437D4479EC03F2CFA951658372AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user_tokens.db

Path C:\Users\Admin\.antigravity_tools\user_tokens.db
Size 48KB
SHA256 f9c391492fea3f7e541aaf607ec541268cea5f0f4c84eddb14d4fa42cdaa8250
MD5 0adacb2db6dd99f69075f20d7b3a1baa
SHA1 d935c4cf90b85c0407e9cac29b9b0fd5c19c75ba
SHA512 513019d058082b4997922cc47fe18ffdc4c6087c3ebb494f3829c07cfb3eec9013f5800eb97b66966382bf7dd948f86bb5e244dfbfecbe0ba52f0aaf4ff2a096
SSDEEP 24:TLRXl2sakdkcp7pRgFnEOc+cZRg84bfZgFpr8TFPMS1BGvzH6mwDM//2eww:TNTBycGbeDsPM2BG7H6mQ6/
TLSH
T138234C991A245918CCFC4E32FC624D352938531F8EA73E5178AC43E19F5A016E8774AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antigravity Tools-4.9.8-installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Antigravity Tools-4.9.8-updater-gRc7m1\Antigravity Tools-4.9.8-installer.exe
Size 15.7MB
SHA256 37dc2e6fe722b4ee97d6f2de52aee1dbcbcb9d2a2648e7acc94bafd4fd241c38
MD5 dc8decbed58587a7d21ea96bf1ec63aa
SHA1 75a500ec8d40c8cdd440465e0d703906ec0778ce
SHA512 6b67aad7a3eb69249543f388307dadef932ccdbd7c48da2d911ea6bf064a30f29498bc5227c0efcfd4cc7c711d4e8777310263c95fcb2679b771d1dc89788622
SSDEEP 393216:9ZTurtvGNRONaPNk4TDbTvA+hWzNyBnD08Ha/9PP4Dn:9itvGLEuNk4TDHvRhWJyBnD08H0Yr
TLSH
T10EF6339A7E584D56EF0C0C31CEE7A407EAF1C5B22490CD0F6B22234AF966556D366BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc61FE.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc61FE.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc61FE.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc61FE.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d1b464b-8c49-4990-92ec-f472261bf9b4.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\4d1b464b-8c49-4990-92ec-f472261bf9b4.tmp
Size 3KB
SHA256 eeb104c1b03dc4735fa0e63cc19b7d8beaf6c0b3c4d277fa90feeb423fb70d73
MD5 3a4cb9820199b0d26c1b38aef987dfee
SHA1 d534f849cfb7d636835e705f17e02b7e29284e28
SHA512 8f26ed46f6473250d49c8016a071f7a3f84b54facd5387cd4afff0b51ad6b35fe0cb9cc14cbb1c95dd1fb22e330a5a4cff2925af55910436bfe4f2292fa18dd6
TLSH
T1AD6172336974AE3B4DE29A057DCA2B06AAA99027E5A57FA5C5EC0F1C01D329C1342C23
MD5 SHA1 SHA512 TLSH

Submit Download

8a065250-492b-40e7-b08a-367b50bb25f7.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\8a065250-492b-40e7-b08a-367b50bb25f7.tmp
Size 2KB
SHA256 9fc07fc9f7570571bd5894df96bec0d13209a5b627d95f91acb35283b129e65a
MD5 c1f54c49b34f92d55eff7af50b48c55a
SHA1 f8eb0773a4dc0350d4b876ecb4df6d65e06bed82
SHA512 dd0db11d8632eb641351c6a48ad6a624c92cce8dee39be977a7c366e910af0240ecded2b86db0fe8a8e358d9b02ea1aba1810d5d0fad010a28b565a0508330ed
TLSH
T1505195336824BF3789E296097D8F3F139E7991A6B6626F5095DC4B2C01D32AD1302C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f2cfafc608ac9852f1e98d99e2ce4d1c92af36cbbed51002c702d547bf83b4b1
MD5 246025967a13f52d44af6a7123716a4c
SHA1 171c79a9dafd3f573821863441e072704ae39c9d
SHA512 42560de7511eab36d757a60d1fd858b1e9101a3c10b34725e8d1da65d4641fae507b0995c07937b214f54853417000f8cdde817898a1184844cd8ed4c015bb79
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7a44fb58411b1c9c935041a89d1911db286fab47b385c66860ea5e3070a28b01
MD5 22e9739f0fc472bc77a0c1ffc17b48e7
SHA1 05685d33ea00bd9c3a84a29f0f6191106f5776c5
SHA512 a4a4287c9a41f28a0a4442c20127979bde7c93411d50ab8e20beac4c84ce2a1d667690c56e1cd01bce28bc5fcc71064a40f6a71e9b423a3e94809ad5f2931e0f
TLSH
T1D7D09B2233054B7CD5226D331276E5451E91F11F8505D15CE419C56D2D544F41F598D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2f4dae0dac6f431ae1eca7754db4fe66541551c0d5943462fec654cda0626445
MD5 b5fae742dc456b2c2212a5cbbd91c1dd
SHA1 da532ba495985ba3155dccb242a860b07acb9a41
SHA512 7976650c3a1f53bcab19dcbcd3e8254c3fa20c9a5fd3891073c1b56b25db2349b313f012ab02ba93cecacd802aa53616d3bc1f174aa088d6dea7086784ab3e34
TLSH
T10BD012233205023CC01134330036B1480901D10F410581049429855D2A440B42A0A891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 60a232bc6633c473419df96d4bcc254137091a1ad77b5b63c43ef921111a3ea0
MD5 a554d06ca417c44354d6635ce41bb349
SHA1 9531aef44160c71228fcff7883bc6e5396e0af99
SHA512 589da2d6c16564bbce402e656e9a1165c1a4dc984ddb555432499b0f2a31ec0550842f91764f83a48b1d9e6e749ec7ee15a16799db7203b1616358e59b895d3f
TLSH
T1D4D0122172014A7CD127693216BAE19A2A51B61B4405D298E41AD56C99444E51F41CD6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7c570fe93887c7c861e291f8e95e73363683ea6db751d096660a097699696504
MD5 d0f64340bcde9e95915c6cb092aefae9
SHA1 a713977f775624d41dcc6d8d3aff3d1ba25c0ac9
SHA512 1d65938b9fa791ea07fdff06ec68d76ab4660a0353ce8693feab51ab0ef48f11262b89386f16777d8b1ab5513a7c8f3964232793be8d22b55fd7695b7767958c
TLSH
T141D0122172014A7CD1276A32167AE19A2B51B61B4505D298E41AC56C99454E51F81CD6
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4f8259d7-f207-4dfe-bbd2-c785f001603a.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\4f8259d7-f207-4dfe-bbd2-c785f001603a.tmp
Size 6KB
SHA256 efec7408d4ae2165a6e595a3f3dac1c414279f0a66f50954c8eddc27e8456b9a
MD5 7879c12f12db8be94ae4b98022e0fae8
SHA1 0e7d39343a207c8e01444d81f5a669a67d344952
SHA512 89d3cf4d0f6063534b480b4a7b2f9c63f305abc24ba39bbd0ab9d0f8e99c7d762a2018a1073a953102c8349c2ee6062f873794d8ff0f9da52c665f84415cb282
SSDEEP 96:stInU/d4xv/5QqbDnk+wo5h16Z0Ms7/x+6MhmuecJCZMkkjeFK+g0z28XM1C7K:stEYIV0onMsV+FdCZwjnyG6K
TLSH
T102D195115E24BA7B4CC6E508BE79BA57E2F9903274D01E58E7F8856C04D76DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 ad19b25406d8d4a9bc1fd559573d0acddd2e18a016ed21bd6db7742e0d1ec151
MD5 9364599561aaa556e2f0194cb52b9771
SHA1 e364cbd7aec5625b7596f4758a4fbaf1d1dce1da
SHA512 3e569b005390c01ac59c234cf6084fa3f0867d262ad314e3deb5c1c65665853e5f2a4b182d2a24d81d5d554bce4c3d12e20db85abf479fa082316e39a71e3286
SSDEEP 3:LstlNllkll/lW7Ul/:LsX3lEtW7Ul/
MD5 SHA1 SHA512 SSDEEP

Submit Download

eb7e47c3b295f2b3_0

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\js\eb7e47c3b295f2b3_0
Size 256B
SHA256 91e554fe685b39ae79b457364c39ea871fe671fdc6c11d4624eb8e65b33858aa
MD5 589050820f7ddcdaf363657d4633239e
SHA1 e3b470526701739c93be7c6136a56bbd542d8137
SHA512 b50e09325240875d5e159efecb8ade539eddbca13a2169f1f18038a31126da8fc8053abf279bbee4ba6c3e867b13db7ebac2b4fe9c2170c1bea9aad3297d6c22
TLSH
T1BAD097CF0D205E04D1AF48F0EFEBC70F431341F0046A9A0A9004AB9216C0E29A81CF06
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 e1d4fdfe77ae083c78e16fc8dd7217f5be823ec2f3b926384e49f8116f66b3dd
MD5 234fdb545e1817fb81e30cf7f23964ef
SHA1 75c12d290549d26685f6903ecbc26ab234530c09
SHA512 7de817777acc6d3a8eda23e7c8db62305add19e9c33f278604f29af7bd01f2c8626ef3589f92368f8b612c62d6e69f9ef49982eb9d9b519a5bb69adee40f113a
TLSH
T17AA0026511508002C95F277114C1064873216C1215021B15C0E09378BC692C159F6C04
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 eba95130bb2700ea99e3a2fb45160f403c2c53b7438eb1a59254e6c5745583f1
MD5 6dd64e9a50ca649a3bf0044b22bc8e44
SHA1 779dbf1a5aae3fefb7a34f2f6193133aa07bf381
SHA512 58e98a98edae6ba3cf009b5b73c5e9e5b463711ed53f40de0db0e178eab46dddb0c25b91617a2927553b95213fd18c484c2326abbb1f0912530a360d8351196b
TLSH
T14EB022C0B0000883EA32333202C20A023233AC023F838A23B8A0B030B03C3C00F32C00
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 c7bfadd72aa671a4f78a69c98d5375ac1297fa1d772f567e245a185d722d9df2
MD5 4c5ff368158aefb4b29c0035307ef0d7
SHA1 b4c9b577063afd74396de22e1954ab58345a1b7e
SHA512 df72763561fe3c30cbca4b57c804757de2ebe6f6b12e6ec6cf0a7de73ad416a57ecdf03917951e553992ed8bba677ff70535e3a6e8617b95149a7db227c6979e
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Favicons
Size 22KB
SHA256 7bc61ace52c2d59792e7a82b4b8d79122b1525d2ef8d7d9e5ecfd92d7afc0a26
MD5 28ab9c4361a00f2b81fa3b2236004844
SHA1 22dc7cb25e3825f0268792cc5abfdbb2376ef9be
SHA512 aaecd0cb11af5a4128f9d65dd55ab8791d0ce78aff546b32128b54dabd142fa0c0c681da10ebbed17ae9ac53b516c66fa2f435776d8332e272165e6127b07263
SSDEEP 96:nBCyucXXTX5MgH/xYpUQ5tiL2kTczD/UkdI83JIEVKPGYn:BNucXDJMpz5gLfTkM8ZDVK+Yn
TLSH
T10FA22A6F2B353403DBC21E7E66AA1876CE7B92ADDFE15D04705848118CF824EE0381AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\History
Size 164KB
SHA256 4a1a7f6d13584ee23c21cdbfa9901d62d762b435bbca7a5d446d406f0b04b38c
MD5 5ce3ba857666f3b953342ab279f43c13
SHA1 3946694b98f532aa0c6d25c32692d72abdcdf819
SHA512 0a10293352f11522ecd9a36f30a5a5e648d9ce9b72a383318c08df69959b4374e0052fcd8a4e8a258b2cb56b7d9daa177529c64e8e962aee555c9300edba0381
SSDEEP 96:8BOnV5LqL/uejzH+bF+UIYysX0fxQp977EHt/DfLVVVN6zRk/E08yV:8BOV5qL/tH+bF+UI3iWGV7WNVVV634V
TLSH
T156F30B5E6F643312CDBD923A68E745B3597CF03F87236A856C6104B1CEE2656B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 4ab1c671a016d7853879a418cd3f2b498f5007a8e32355672cd9b8be63b31e81
MD5 176b32408b212f0d9cbcbc61928f0d3e
SHA1 e8c51468ea800145a46197470ae80044aa2ceceb
SHA512 00b58ea535b8d3c8ef4ed2c757ccfc6163fe25588e8684eaa4f3b5fd73555bcdd32d1feb3daff9a2eb7570f40f1376e10bca4d2338412f5d258d560bf468dab4
TLSH
T17AC012614169E57620B846212A84BD45AF7BB53C01C194F995F2477C61501EB9603813
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db8ba143-9d46-4e4e-a829-6933897ac23e.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Network\db8ba143-9d46-4e4e-a829-6933897ac23e.tmp
Size 186B
SHA256 3c7328630ef2c986b90feb0678113f3a80adf7ac952de7ff0254046860c906f8
MD5 01c15b7f43d2cea4b342bfc9b3ea6b73
SHA1 27f110b5ab0aa76d34824598c00f897e007d2270
SHA512 89ce41860610cdbafdd9f1cd319909acbf585d0c75974d6ce13531ac2794944bd181d782fcb5a28c3f9f0477765ed751470f75dcc52219b1d27241ba6b5223f8
TLSH
T10EC022A20069B43650AE06211880BD496F3EE030018194E891624229A0409BB9603022
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Preferences
Size 6KB
SHA256 f51e4e72caab08d4e514592192991184f3ff13eaa7ea407ce5dce4c9c7d4f6a5
MD5 2a62ac926275b466e67891cf33d17ed5
SHA1 9324c97c05c1f2be0e75c4c681b153f6772f2de1
SHA512 b956d685aeb1608f721c957a863a7c6c2f89839442715dc32ffb88c88286a67c505fe9bc7ae15335d523cd4d3ed0178ec1e73f10a2581e9f7f0765efd01aabe6
SSDEEP 96:stInU/d4xv/Zb9nk+wo5h16Z0/s7/x+6MhmuecJ0l1ejeFK+g+UI8XM1C7K:stEYID0on/sV+Fd0lQjnrg6K
TLSH
T174D1B8116E24B97B4CC6E108BE79BA57E2F9603274D51E48EBF8896C04D76DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 38e1883d1063918911a11e3200243450ae6dc965a23e64122ee2a1c65822e84e
MD5 ebcd046dab4f6dc108077cb5422811a5
SHA1 e1c6c4474e68fad0decdacf0fbb6d2e8c12d7601
SHA512 10da2e866701783daa37b6920975778f0fdcbc0d17fffc8b46f32fcd8257c64943ddbdaca95c22cbf8c0837d4b4c583077287164fdb15159eaa8c63055e99158
SSDEEP 96:vlibPlf/ROo1pkF5d1liW7VaTEv9V5h5pg5+e0Owjq+LLcIKcICa+8O:0zvRm9lufGVh
TLSH
T164C175A7456CD6756F448BEAE83C7DCE98AB00DF98C54C1A96D2C48C06C2EFD21DA4D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 c0a61013a67949831322b032d47a14269638dc8d5a9563dfa31afc66e904f4c3
MD5 c7e93193a7ae0ee8ac8974fe9795f105
SHA1 854cd50e4dd55e6d47e02702ac7ca7215a20a972
SHA512 8f43b4fcaa994b007108208a908d1f1feea85893f29371821d7328029c1e4a3640788817a24e1ba67447bb1172fb8e6be908c2a07554bd36a442c0bea20be46d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 56daed07c9eb6e0629634e60d8080ff996b86b0964d834b50f14146b5687b9e3
MD5 03d9c6b198c461a9d47c83d29f1d46db
SHA1 62aeb93220281b09a86aab65c73f820ac4dd1aad
SHA512 c7aa5db34abe4aa7854ddb2980d1544904fce3488efdd7578c3851433eeb85f7725d16c934b648342d5e98c779f06e35250f42f5d7e7e882918e2232f574f6a0
TLSH
T1C4B012847B909137C4FC0E3D4294C7F06321E2037502681388448F320EB67E47E418D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Site Characteristics Database\LOG
Size 335B
SHA256 d6cd9903443aeb227ae129702f3ce72475d8492fca4302db397683397f8e0f23
MD5 beab49fffdf39f047f75ae35969b0340
SHA1 0a5023bb541a23752f48668b560764f6386d4ae3
SHA512 84d64817945c1d15ac9f1be4f163867ef24d3ab71407f9a81dbc014616e97fbabdd4ee3685486d04b2ff32a827df651994189e312bf830f56293656d8ffaf88c
TLSH
T18BE0DF3065CAC23B098E08EF193AF34DCB72B456ABDA26254F19EBC0268F4487202600
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Sync Data\LevelDB\LOG
Size 311B
SHA256 d0fb12a61bb3aed64c87ee4630175f0fd601d746a538c38bec455a06fe47bc01
MD5 784eade656fa17f3bf4a6df0873be6c5
SHA1 d2aa021eff53bfc6b032a18bac9e55d6c4e23437
SHA512 4c141ee4ef8d20e7615b2c13d9200b03572205763c3ba2a8e5fe1bbb61d8ed75f2f452643b624f7e9c8d135eb7bf3813f440099ad5914765e1217a565daed232
TLSH
T19DE0CD34E4D6C1374C8C89EB097DE35DCBF1BC656BCA36194B04DEC469474087122641
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Visited Links
Size 128KB
SHA256 b88643b3c74e741225a165c083e5c496e822c9fd6ebadd92488ebcfdb6bb8f7c
MD5 a16719601ce03b6ebd6a3617d6998b59
SHA1 25512a1bd912f0eca470ab261c98698efdf761ba
SHA512 e81abe55bf00578323edabd6e70b1798812a0b4634adacaa11926dad8e5cbe4819deee46fa31e8d60c5b5d3b22570f6471406bea43534895152cdca53f553d55
SSDEEP 3:ImtVu/YoX/qdll:IiVubydl
TLSH
T16FD3040CC5F31CDCD14C0C7CDC000F4D5010C31510D15001133D0D0144F40174773500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a48cfe91-51e4-4d6f-984a-b0ea13e4945f.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Default\a48cfe91-51e4-4d6f-984a-b0ea13e4945f.tmp
Size 6KB
SHA256 b925f3781028c1336458513dfaa671242f883b957ab9b615b9f1c40eb7fa97ce
MD5 ea6c1ba5f31a69518ef788ac15df3195
SHA1 e8caab74402f84f3d02969980ce1d5fb767d0caa
SHA512 b6e317dbd5921084cd51d4b891bd59476bc4d4d453bdfe6c89d5c512e75ac33c62e3b956d450205239f2ee8e545333afb0a27bccfe7ceec41cbd3d791140501a
SSDEEP 96:stInU/d4xv+G5QqbDnk+wo5h16Z0Ms7/x+6MhmuecJCZMkkjeFK+guTA28XM1C7K:stEYIn0onMsV+FdCZwjnMEG6K
TLSH
T1FDE1A6126E24B97B4CC6E518FE79BB57E2F9A03275901E48E7F8896C04D76DC6203D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Local State
Size 1KB
SHA256 966c1cfb00bfc9f2254c4960a3337ff9be142e5d559aef7038f48d831f039954
MD5 82e21f53531db997eea133dc8b2bf96e
SHA1 4bbd6e5d80ac8047aa36464af12544bc51e93a6b
SHA512 b3cd06af79b5f746d5eab8eff616980b4ad975ac41f7fad930ab9b0a4401b58f249e6954379f23b58a4330980aff6f0cb0a503e0bf8b8a07a93a4fbe5c69eb3e
TLSH
T1B3218773D9A47F33AC91610B398B7E572E25607BA261CF4090DDC72C12D219D9526C33
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\ShaderCache\index
Size 256KB
SHA256 a258055c632518ee16fd4a1d02f6127a32654114c7ad3bbcb77be58259ba7f21
MD5 bed80b05d23104eb692e5d9948a1691f
SHA1 db4c8aae9a81335a144a566521fa1246e2510be4
SHA512 160eb9e6184e98752312c12112ffe3191a2349bd702fe089853f1a638fce1d449fe082acc159b87835489244004036181233f730ef944d1ec97cf84ae635178b
SSDEEP 3:LsOllllklkXlYI/l/:LsUlPYIl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

bff4ab38-0d21-40a0-a726-bb91aca426ef.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\bff4ab38-0d21-40a0-a726-bb91aca426ef.tmp
Size 16KB
SHA256 82f2c1bc28b9b8dfbaac95f86c8cd3fc93b3e5971986f58b1ab416b1f3c8b10f
MD5 fa0852e7acab343a35ec6b9c8f52c0f2
SHA1 6e04209043e062e4e65c1a2dca5f151b36b468a7
SHA512 fec55c289873d216b8b7cf2ddfb2e9b45e233f34b695ae8efb42b8cbfa3983fd252e56a9e5df564a17c5c4cf93a43c9eaa03b94fb93fac80674c51e5ec64ae19
SSDEEP 384:j+OBqImmJvGBLx3NaFMJF13NBShgmdSi5jck3QtAdyg6rB:6cvGtlN1aFgk09
TLSH
T179729D7A18667F232CF7C50ABECE27878B646153C1D5ABD5C8ECCF0E226A1990342D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8639dc0-d083-47a6-8d4c-3f7e9debb1a6.tmp

Path C:\Users\Admin\AppData\Local\com.lbjlaq.antigravity-tools\EBWebView\e8639dc0-d083-47a6-8d4c-3f7e9debb1a6.tmp
Size 16KB
SHA256 e81c994c7f7c9669f2148a5fb551a5b2f41b2f4e38cf10d5367ff9cfa4015b17
MD5 24b5656df0f05cd40749b7c8bd56f0a4
SHA1 c3d272aeb2f8e252dea3aecfbc0de403fc983eb7
SHA512 1267faacbc953da2f599fc71561f023a37e70b97d19e950a1fecf59364ab59ecb00d9a4c108f6e064b3c091fd046bf4c359afc2efbc7aaaa17befa2fa9c67e3d
SSDEEP 384:u+OBqImmJvGBLx3NaFMJF33NBShggesSiITck3QtAdfuuDzFg6rk:rcvGtlN3qkQk/g
TLSH
T152729E7A18656F632CE7C109BF8E278B9BB46253C0956BE5C8ECDF1F212A1550343D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1649283182\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1990301821\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2018797282\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_276316847\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_412503711\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_580901884\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1172-96-0x00007FF8E8C00000-0x00007FF8E8C01000-memory.dmp

Download

memory/1312-1457-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1312-1450-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1312-1454-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1312-1458-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1312-1456-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1312-1459-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1312-1448-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1312-1455-0x000001E198F50000-0x000001E198F51000-memory.dmp

Download

memory/1548-1178-0x00007FF8E9330000-0x00007FF8E9331000-memory.dmp

Download

memory/1548-1179-0x00007FF8E9130000-0x00007FF8E9131000-memory.dmp

Download

memory/3500-39-0x00007FF8E8C00000-0x00007FF8E8C01000-memory.dmp

Download