Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 11:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe
- Size 37.6MB
- Sample260910-nnjb1asdne
- SHA256 271231afa3bdfdffcbde86709824bde63ddc85bc37aae789e169ccaa159886f3
- MD5 b8dbdb479655ba71375dc710d96d1f9a
- SHA1 2e803d9659cbb20ca8ba5ddc6c879d88bfd8e566
- SHA512 64f4d904fab3d6325bf4748d8efbb97a652b08095742a931d0421c65a55ddc8b35fc918dc530a6f00a6c72d7706566dc601a16dbf498a529ffebcefdfc59431b
- SSDEEP 393216:knd/Kb3WMNzNjJ1z4ovBB6yIlBCYoFdm3ieS2DTJCphFzqTMdKJ:knd/K7rJN91vSPBCYf0hnvs
- TLSH T16587AE03F26691EAC169C078825EB273FB317C59022579EBABD44B313E65FA0673DB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe -
pid Process 4556 msedgewebview2.exe 2988 msedgewebview2.exe 3332 msedgewebview2.exe 828 msedgewebview2.exe 4908 msedgewebview2.exe 5792 msedgewebview2.exe 2592 msedgewebview2.exe 4184 msedgewebview2.exe - Drops file in Windows directory 55 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-de-1996.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-nb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-gl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-sq.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-te.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-af.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-or.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-sv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-tk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-cu.hyb msedgewebview2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 828 msedgewebview2.exe 828 msedgewebview2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5792 msedgewebview2.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 4736 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe 5792 msedgewebview2.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3572 wrote to memory of 4736 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 90 PID 3572 wrote to memory of 5792 3572 2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe 91 PID 5792 wrote to memory of 2592 5792 msedgewebview2.exe 92 PID 5792 wrote to memory of 4556 5792 msedgewebview2.exe 93 PID 5792 wrote to memory of 4556 5792 msedgewebview2.exe 93 PID 5792 wrote to memory of 4556 5792 msedgewebview2.exe 93 PID 5792 wrote to memory of 4556 5792 msedgewebview2.exe 93 PID 5792 wrote to memory of 4184 5792 msedgewebview2.exe 94 PID 5792 wrote to memory of 3332 5792 msedgewebview2.exe 95 PID 5792 wrote to memory of 3332 5792 msedgewebview2.exe 95 PID 5792 wrote to memory of 3332 5792 msedgewebview2.exe 95 PID 5792 wrote to memory of 2988 5792 msedgewebview2.exe 96 PID 5792 wrote to memory of 2988 5792 msedgewebview2.exe 96 PID 5792 wrote to memory of 2988 5792 msedgewebview2.exe 96 PID 5792 wrote to memory of 2988 5792 msedgewebview2.exe 96 PID 5792 wrote to memory of 2988 5792 msedgewebview2.exe 96 PID 5792 wrote to memory of 828 5792 msedgewebview2.exe 100 PID 5792 wrote to memory of 4908 5792 msedgewebview2.exe 101 PID 5792 wrote to memory of 4908 5792 msedgewebview2.exe 101 PID 5792 wrote to memory of 4908 5792 msedgewebview2.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe" highlighter2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4736
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe --webview-exe-version=2.8.4 --user-data-dir="C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3572.4192.16220995111554311341 /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e3525052⤵
- Network Service Discovery
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView /prefetch:4 /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e352505 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff862555fd8,0x7ff862555fe4,0x7ff862555ff03⤵
- Network Service Discovery
PID:2592
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView" --webview-exe-name=2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe --webview-exe-version=2.8.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,13101843542023300913,6953810921051705066,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e3525053⤵
- Network Service Discovery
PID:4556
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView" --webview-exe-name=2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe --webview-exe-version=2.8.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2120 --field-trial-handle=1752,i,13101843542023300913,6953810921051705066,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e3525053⤵
- Network Service Discovery
PID:4184
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView" --webview-exe-name=2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe --webview-exe-version=2.8.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1752,i,13101843542023300913,6953810921051705066,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e3525053⤵
- Network Service Discovery
PID:3332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView" --webview-exe-name=2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe --webview-exe-version=2.8.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1752,i,13101843542023300913,6953810921051705066,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e352505 /prefetch:13⤵
- Network Service Discovery
PID:2988
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView" --webview-exe-name=2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe --webview-exe-version=2.8.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=348 --field-trial-handle=1752,i,13101843542023300913,6953810921051705066,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e3525053⤵
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
PID:828
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView" --webview-exe-name=2026-09-10_b8dbdb479655ba71375dc710d96d1f9a_avaddon_glassworm_megazord_poet-rat.exe --webview-exe-version=2.8.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=1752,i,13101843542023300913,6953810921051705066,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6cde2cffdc28b96e83441aac01851620e3525053⤵
- Network Service Discovery
PID:4908
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 5d930040a8e28965ee2ccec05849683fd0cebffa5c26e8080b36dc6f57962ee5
- MD5 640c9e293313b7f6d331214a0ddca43f
- SHA1 4a2bda612710fa7ca994c9c3508840531126571c
- SHA512 7f34d36d35f069a31d355b8fa6f8e7d094f4577d2247fd51ff788f5668fd04f200f275773bee7434a0a6e78712930b87f0b8a766f68e6aba60bfc36a75e40c04
- TLSH T10FD0112A32028AB8C02038330A83A2082C00CA0BC00A8080A8388AAE2F080A02A0B882
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 fe998b5136a76103ac16b00ae054d7d9b8ff437ed5db20b26836c4d0afe436b6
- MD5 3be8f0deb25c73b2a1d8b3bbe6beb0ca
- SHA1 6f2b81e69877b3e85f3ca4d21f020f243298df5d
- SHA512 d30fc8521fbbbabbe8440715139f0acc7257f6fcde35e0ee548131ff5d1e9318ff2ce2d56b12ef5c608eee76f07784aa35833b13267ec648bae5e75fa97bf323
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\8f7cec22-f412-4be8-bf48-f6e1955df87f.tmp
- Size 6KB
- SHA256 ed15be587140ffa6d86b4f4e7736ae8955d65b5b729c6335a797aa262637e860
- MD5 7cccda1dec185860ca15020b01118f86
- SHA1 6bfdad0a45afc5324c226129f21f43250b67d7e6
- SHA512 c36f2485d703939b774c7703c025ca2f34e7789cf191f072174a2aec06fb0037dc7a88cdea4e86afe02f174c55f1343535641c1fe7007253c5d3d4389ee81743
- SSDEEP 96:stE/doa3wub9U2kXo5h16Z0Hs7/x+6MhmuecJTw1eje1K+gs28XM1C7K:stIB82IonHsV+FdTwQjfCG6K
- TLSH T1CED1A6016E24797B4CC7F108BA39BB47E2F9A03164D52E58EBF8462C08DA6CC731790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 312B
- SHA256 552693313c610e77a1b2d121d4792dadf86f52999c78612d36806432a690dbf5
- MD5 5939ce0dc27d82452f30e5fb004339b6
- SHA1 c5bd98591f04066aa75c80cd234028549a62d556
- SHA512 1d3557bc8ff7f394728c909b7b399b6cdffba772eabd3e94ed44f806dce845164b2e2592e14866736fb37fa20eb6969bda38a3d5ec64a8097622b2ff6cfd09cf
- TLSH T12DE0A9E408B8028ACBD002BCE4F020B33E32281EC37B4E911420F9F084187C7A0C10E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59b7ae.TMP
- Size 48B
- SHA256 24428d53ad83a6ed28a4dfe9209405a5a8889c548ee1c1311688cdc188084c30
- MD5 a59ebec181ae0a47966b84f4a23c71dd
- SHA1 1d78ddfbb33afa43aad6350d56e0ae668f41c069
- SHA512 a268ee97059e71e6657492a2b40fae15e50b3b2c10caa3bf4cbbdd90056dbc1fd3f92dd8ee3a6da96967897bd8e473b00965c0c1b8b82ea5187ed848df0565c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Network\Network Persistent State~RFe5a8d6c.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Default\Preferences
- Size 6KB
- SHA256 9bd9c00f3bfcedd622732efc36bd10f770472cbfaddd90bfc9d4a72773908ef2
- MD5 27cc8713bc15660abd33f84a1f07d7f9
- SHA1 91187c433bc3576522de4c508287c33b747db402
- SHA512 4b9572bfed35409736fca0a39f50651adcd5ff88772074093d0dc077b1701819414d2e6015dacd706ebcfadb460550658d069e3fa8558bc780c8ac87d5804b1d
- SSDEEP 96:stE/doa3XGub9U2kXo5h16Z0Hs7/x+6MhmuecJTw1eje1K+gL28XM1C7K:stIBC2IonHsV+FdTwQjfpG6K
- TLSH T141D1A6015E24797B4CC7F108FA39BB43E2F9A07265942E58EBF9462C08DA6CC731790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Local State
- Size 15KB
- SHA256 d97893c67fd210990f1ca9bec4eff5a7237d4170a441698d1c11c71ba605a29d
- MD5 a65716a85d8d0d828c9b7e6bc2b049be
- SHA1 6f17bd0d3829b5d1b7d0bd2480510efd03954b7b
- SHA512 6f1cbd0b7d5cfacd48b3f1dd28c718aaff657f6ef11be5cdba8c268d39d536c78da75d8b57b6f92d959edc71b36cefc626b7e72653b1ec34939e03330cc25c0b
- SSDEEP 384:E+aQikB+z/xvxjg/qhEwNBSvL+o2cP5g9z1:j/UxvxjgC+rTKF1
- TLSH T13B72AE2B9579BE2795F3F604795D0B4BDFB894B294813D744DAA5F0E06873C82302C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Local State
- Size 2KB
- SHA256 7fd147ed4d5415181049d4e159ca0628fa39424457eb81fcf5c1a08aa08f3066
- MD5 2b5f28bc87cdba0ccd60d1681e89b568
- SHA1 b2aa59d3cd56ff26e3d70a657795d489ec12f683
- SHA512 731a98bc4bcd7842b3316333193277e98ddefc84e396126233baa933a10ec2a42319864e1e4fc97227adad7cdc87aa631c27f507370d6b56908946718ab9635d
- TLSH T1BA519733AD34AB7789E3A644B5DA3F13EE3691B5AA512F1099CE4B1D00D614C3342C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Local State
- Size 3KB
- SHA256 64001ccd99b6e1c871c1e3eeca5fb9497aa3c3729808c7a9f8e42df34c5cde65
- MD5 60e887584b39ffcb0ff0a95d3b54780d
- SHA1 6021dc859cc10d7c9d26d679d2b28143c621b8b8
- SHA512 3252fd71a876bffade5e8b00e146b88fb60b2bf032a1392e00fcc61ee67caff49c8e4691aeecd8d75a6afefa2c6c75d66a0912f342b27c3ece8b27409a9cecbc
- TLSH T193618632A974AA2B4DF3A644B4D63B06BBB59137E9913F64D9DD0F0D00D728C2342C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.elijahpotter.harper-desktop\EBWebView\Local State~RFe596661.TMP
- Size 1KB
- SHA256 076f88d057d81ecbecdd41431bff8ba180dafd78e4b1d8c822f52c6f6c31d452
- MD5 5f396dcd8476a78042c62e87d94c8b6f
- SHA1 cee4c063cab648dd154af90d07d94c9c2e719981
- SHA512 db5b88be1eaf8fa0caef989bb3b3e17bbad21182c12e1176a9509159771999879569693c6b59d6795d9ebd0b04d931875aa3a6d537b104fcaf19c8d9c63079b1
- TLSH T12C216572E8789B735CD67255A1E67E47AE31407791500E0095CFCB2D41A618CB267D32
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\harper-desktop\config.json
- Size 16KB
- SHA256 6df19afb6e2926db07d0cc37354f67315b35c05c62f1c2b645c7f6d3a25805ad
- MD5 fd53dc95c9b9c27926ed696cb64443d5
- SHA1 9cce126933d853feef78686655f2d39b25d8325e
- SHA512 236d7285d535246d273548647d4aa8f40ff22ff403cae23c602d273be4c7b00020c8c9d2f2c70d4be94ceccb24d63f46a47786e4f0227044e637085b8e67e9e5
- SSDEEP 384:hBQ497m4GUbP6bXqjQJp0cB1kdmIZVfBrg/Ry0:h1vFjIXqVot
- TLSH T147727F41A8265D35C7D903ED883D3F476E7C03B36345380EF56EAE9D0976A2B20A791B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-bn.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-mr.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1981998220\hyph-nn.hyb
- Size 141KB
- SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
- MD5 f2d8fe158d5361fc1d4b794a7255835a
- SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
- SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
- TLSH T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH