How does Glimpse prevent multiple instances of its agent from running simultaneously?
Glimpse creates a lock file at `%public%\Libraries\lock` containing the PID of the current PowerShell process. If the file exists, it checks the creation time; if older than 10 minutes, the process exits and deletes the lock file, ensuring only one active instance at a time, as described in the [Analysis of APT34 Leaked Tools - PoisonFrog and Glimpse](/news/analysis-of-apt34-leaked-tools-poisonfrog-and-glimpse) article.
Related article:
Analysis of APT34 Leaked Tools - PoisonFrog and Glimpse