dda01d9fb4189f1d2dae905609a9270d92ef67df2fd46d8d88909d7c0bf2adae

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hydra.exe
Size 7.6MB
Sample260502-rfvxlsas7w
SHA256 dda01d9fb4189f1d2dae905609a9270d92ef67df2fd46d8d88909d7c0bf2adae
MD5 87b0af6700396722c907ba7765cc3b2b
SHA1 8d696940e4918fafd8ad0d3e791516185b6a5dac
SHA512 df4ae0f2db2cbdd76b4643977714c8672de6f1527a917867a82e8def51307f05a9e66f0e40f6774e7ad1d611bf1512908bd6799694c940d9c5add04e77d23026
SSDEEP 98304:Irtoww8d/DSQGbdVUpT7hFURQXths/ZNQ77:bt86dVooin2N
TLSH
T1D0864A012F8E5999D089CC70C35B8B930E2130DB1A76F9BF49D606292F7E7B95F29319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hydra.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_275695352\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_275695352\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1682065573\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1682065573\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_275695352\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\manifest.json	msedgewebview2.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2340	netstat.exe
2400	netstat.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2340	netstat.exe
2400	netstat.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4660	taskkill.exe
3984	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222045559643318"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	msedgewebview2.exe
4736	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2468	msedgewebview2.exe
2468	msedgewebview2.exe
2468	msedgewebview2.exe
2468	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	2340	netstat.exe
Token: SeDebugPrivilege	3984	taskkill.exe
Token: SeDebugPrivilege	2400	netstat.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3960	hydra.exe
3960	hydra.exe
3960	hydra.exe
3960	hydra.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2468	3960	hydra.exe	88
PID 2468 wrote to memory of 2104	2468	msedgewebview2.exe	89
PID 2468 wrote to memory of 1980	2468	msedgewebview2.exe	90
PID 2468 wrote to memory of 1980	2468	msedgewebview2.exe	90
PID 2468 wrote to memory of 1980	2468	msedgewebview2.exe	90
PID 2468 wrote to memory of 972	2468	msedgewebview2.exe	91
PID 2468 wrote to memory of 1244	2468	msedgewebview2.exe	92
PID 2468 wrote to memory of 1244	2468	msedgewebview2.exe	92
PID 2468 wrote to memory of 312	2468	msedgewebview2.exe	93
PID 2468 wrote to memory of 312	2468	msedgewebview2.exe	93
PID 2468 wrote to memory of 312	2468	msedgewebview2.exe	93
PID 2468 wrote to memory of 5028	2468	msedgewebview2.exe	94
PID 2468 wrote to memory of 5028	2468	msedgewebview2.exe	94
PID 2468 wrote to memory of 5028	2468	msedgewebview2.exe	94
PID 2468 wrote to memory of 680	2468	msedgewebview2.exe	95
PID 2468 wrote to memory of 680	2468	msedgewebview2.exe	95
PID 2468 wrote to memory of 680	2468	msedgewebview2.exe	95
PID 2468 wrote to memory of 2552	2468	msedgewebview2.exe	96
PID 2468 wrote to memory of 2552	2468	msedgewebview2.exe	96
PID 2468 wrote to memory of 2552	2468	msedgewebview2.exe	96
PID 3960 wrote to memory of 4660	3960	hydra.exe	97
PID 3960 wrote to memory of 2340	3960	hydra.exe	100
PID 3960 wrote to memory of 3984	3960	hydra.exe	105
PID 3960 wrote to memory of 2400	3960	hydra.exe	107
PID 2468 wrote to memory of 4488	2468	msedgewebview2.exe	117
PID 2468 wrote to memory of 4488	2468	msedgewebview2.exe	117
PID 2468 wrote to memory of 2480	2468	msedgewebview2.exe	118
PID 2468 wrote to memory of 2480	2468	msedgewebview2.exe	118
PID 2468 wrote to memory of 4736	2468	msedgewebview2.exe	119
PID 2468 wrote to memory of 1792	2468	msedgewebview2.exe	120
PID 2468 wrote to memory of 1792	2468	msedgewebview2.exe	120

C:\Users\Admin\AppData\Local\Temp\hydra.exe
"C:\Users\Admin\AppData\Local\Temp\hydra.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3960.4924.14676407925138685072
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffe0279b078,0x7ffe0279b084,0x7ffe0279b090
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3644,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3684,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4316,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4500,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4712,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5048,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:8
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5264,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4616,i,11642604412619638813,14360332728442150642,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
    3⤵
    PID:1792
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM HydraBackend.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\system32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM HydraBackend.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\system32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1682065573\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2468_1911385617\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2468_275695352\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2468_275695352\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a3d3498b388ed4eeef347aab174f4719e70e9209a556bc450c73ea5763763c45
MD5 2dd1ac5ea2d688037f77fd24d4bb763c
SHA1 2f0ca268fa076e792c5ddc7376dbc3e9eb2a7528
SHA512 c1ac05db9f7367392d94fd5e596411935ef66564a3527541e6d4438afcdfcab46f34553b008eee21e097f53ee5504c075a72672eccdab2c430ff9518276b6ec2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f98ac8797f6599688b17ecd8380e1711806412346f6fe56fc7d35360848c258d
MD5 6777e9858e1f31556c9f3bf8b161662b
SHA1 da5d39a3e84bedadd29f5ecdc3f3001359632f2e
SHA512 f3cadb20b02989f807f0aa2f6a207dab9d2c3d585f5db4a85224b755b8542ce2e448fd9d8ebbfb8f27c74ff231ab4650ddaa40df8d34435b6b68e2c01e1c254d
TLSH
T17FD0122236010274C4242233085371081400CA2F410540045838951E1BD40A00903452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 f7dda9452ba63a349d2ab6fbffb54d77306b6e20a7ab41299bfa7fb567d0084f
MD5 bc922f24a91c575bd0a9d8e87dd6c181
SHA1 06c5342a5879fa518140d35b918f7a9e3b42550a
SHA512 c36e5321d0e01aa28cff95c00c1f651016f78ec016610f3f4e1f3e63c60082ffbc0a130121576ece52da32881585501d2985b2cf456f2b5073c9457510de3cad
TLSH
T1EFB0121020E00247C647D7F41FD3000031318C108E935E8184F09734C625FC056030D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58581e.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58581e.TMP
Size 48B
SHA256 1c11b2f4cf64d969124ca475a72b1cd05cdce02e4046ea3ed9023c0dcee5697c
MD5 f5ea0b3128809cf366c8e646225ab98a
SHA1 760d826a1cc47684b7e838181dd6d27a82cf04f7
SHA512 45333e86f63bdae310712194cdecd556aee996ed0bbb8eab710dc6dc74abf3788ecea99c8237a6800972346154bcd85649879505d3e7cbc81ee7c98c5dd85f9a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 cb9e7593641b49fb64271cddd8d9241d279d3d0eda58f3257c4ea7933324b12f
MD5 5da741379f5b44b2ac96290a931e5870
SHA1 e82c1cbcfdcfd7d3b865440946ccba253c327f33
SHA512 285bbce0d621e2f1e965924d0bfe54ec36518ea4fc498b53bb61b98481d069274901ab47011fde92c9e3ca56acbd3d7905bfd1bc0522e0bbf12c8f3a1ad0f6d9
SSDEEP 3:LstlNllkll/l4OAKll:LsX3lEt4OAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 ee72e092ee4c91dc751b7b96f8099b1b23cc2a06073a53ed85719aa4b1a2d30c
MD5 38983e578244e916ac4ad718c5ebd9f0
SHA1 23ae58ee43e6958f826597e8c47b4c150593d881
SHA512 0d44edf20c0a3cbf99ad241d3f3d80683025bbcc0acfd93033a624db17566a6b40e0492711aea0264c38134c2385b897b0c70087f531889107e69cf3050f9cc1
TLSH
T1983191A2C3E8C67DC95126E437347817CD2E051992283D27CDEBEBDA67D2071E22164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe591728.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\Network Persistent State~RFe591728.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Preferences
Size 6KB
SHA256 6b06b37d0a6782d7cee6082c64e4da20336fd706c8d5fd1e76fec56854eeb0c6
MD5 2d2a223d5da1b0ec351271dcc7cb20f0
SHA1 553caf344e8fe5235b96b6c4192e282bfd4fb199
SHA512 f13450818a0e7366afc9159dc8ba759947cd3c69530c3fcbe471bd331af6444bc3ddb090190172fe42fc5ddb55512428e4b7d820300dd0581e4997ddf1607477
SSDEEP 96:str205Eaqw7GbPb9sffZZkZ8i0vhEektgDm/7qx+WVHMSm+uecJbITTUYQQjQ+g0:sty0BSSffkZ8paFZ/S+WiTUToYQ13eMC
TLSH
T163E1B8039F286D7B4CC7F6197A35BB52E2F6112256D50E58ABFC870C04E66DD230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589e1f.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Preferences~RFe589e1f.TMP
Size 6KB
SHA256 f0475f6c6f3c9d2829e766bcb590d37d871cdbf992703bde84f0ea8664ffb514
MD5 7dd05ea5474ac5d6f4c0bce72e13ddf3
SHA1 64ff7b8f8eaedd12424f9423f65a3c0ecb6f3293
SHA512 60bed956970986db74c91ecc0bafa1942509935f5e53aafec3e17994e1de68bae18a1156b84de9a37ad11a81edd06a03d07658467853998fba84408343bd9230
SSDEEP 96:str205Eaqw7GbPb9lffZZkZ8i0vhEektgDm/7qx+WVHMSm+uecJAqIuvYQQjQ+gI:sty0BSbffkZ8paFZ/S+WiTAHqYQ1FeM8
TLSH
T10AD1B8039F686D7B4CC7F2197A35BB52D2F6116262D51E58EBFC860C08E66DC230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 1KB
SHA256 fe4d78c409166479f030963540e8aa4748dad7bf42a063193148a471e72ac544
MD5 8637acf550c59dfa9b5490b7af4cf61c
SHA1 5cd8cd590d45f583be74adce210240a0e4acabdd
SHA512 21d6c44f3175c5d07a49e7752316dc87637443c969970cfcb38534fdc592c4ecd315a5a70f603a6e62d227bd0ac1c0b4bee96cb1607d0b937985c690ef5a5590
TLSH
T1A431607794986F3319C65586B202BB876D21032BC2605F84E2ED4B1C06E66ADA62BC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 2KB
SHA256 fc3ec852add017734e004ea4a948d9f8d855de96eef95f9733e10e6467784965
MD5 b50acb49223972b7de8905d9979dc17a
SHA1 4668ec0d7f6f96afd2239b34c93c98f715d70c04
SHA512 06207119d4251dd369d5a07fc1bbce182320ab1bb59899ee386707d459e9f390d227cc88ab729bfeb4f2641235baf8ab8e469f5174eed8f0a31cd05176460a75
TLSH
T148519573A818AB3749E34984B9057B57EA365366C7A12F90D6ED0B1C02DA67D2307C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 16KB
SHA256 32bc3fd49f2e23af3d44c04834d697b4e1f1ebb4679d6a11e4555742030bb7ff
MD5 9e489f535401fb598903456a57897b97
SHA1 4a95e0962d3525ece53ffdb8d7e7db21e9fcf4b0
SHA512 8d44a502535211dbfbf88d3b2f394e31ba0ece36170bbac35729a1586cdacce08d5366b1f8ca2cce44009ec4b90275c254201cc0e43bedb2d205c89bf84b77cc
SSDEEP 384:znfTPLdSWCUkEaV8DNYi0qnSXaqZvaNbLAeaDXuA:LTRMUVai1SKqvXeyb
TLSH
T1AD72BF639C38DA1B08BE8949F517374B99B99255C2D52F4DEDED1F0D07C16E80316C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 3KB
SHA256 48ce1bb14dbaddb0ba21e5979bf671b8a68c4ed801d8a4b123b1927823bcbe25
MD5 a9cb2350ff3defe09892340184281cf8
SHA1 b3cf8f124f3fbeb2b1d0a366e3680b4e143b46d1
SHA512 8ab950f814326607d3b71df668e0f87a555cc76c5771264dbedca0534cb40c04961aa0c433267820acb6b48b68f1953fe86146e4d64d0846b25d76979069282b
TLSH
T10F71A927A868E9374DE39945F8853B06B6655337D6D13F94D5EC0F0C02DB7A82302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe57fe84.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State~RFe57fe84.TMP
Size 1KB
SHA256 d9b7e08cd2fdca8575358bc08df96a0def45da91665d5e576409e384af27f2d3
MD5 a9dcac66f20d50058f6569997d5871e5
SHA1 3ae0059b7cd1c281d2e045473b08ee3ef7f576da
SHA512 fd5faf6b1d00092a66e7b1a06f37819f82f9daffdb241642f72a7dabbf91a78777bc1a32a35de8a650c3a5a27e2e140bca82b7e2572cc352f80192c5dc3574e3
TLSH
T12C216277C498AE7719850886F102F78B2D61432F82505F48E2DD471C06DA6BDD63BC77
MD5 SHA1 SHA512 TLSH

Submit Download

memory/312-147-0x00007FFE1EC50000-0x00007FFE1EC51000-memory.dmp

Download

memory/1244-76-0x00007FFE1D730000-0x00007FFE1D731000-memory.dmp

Download

memory/1244-77-0x00007FFE1D770000-0x00007FFE1D771000-memory.dmp

Download

memory/1980-264-0x0000027B36AF0000-0x0000027B36B9D000-memory.dmp

Download

memory/1980-26-0x00007FFE1EC50000-0x00007FFE1EC51000-memory.dmp

Download

memory/2468-253-0x00000256CEDD0000-0x00000256CEDFC000-memory.dmp

Download

memory/2468-254-0x00000256D0E70000-0x00000256D0E7C000-memory.dmp

Download

memory/2468-256-0x00000256DACD0000-0x00000256DACF7000-memory.dmp

Download

memory/2468-255-0x00000256D7CB0000-0x00000256D8122000-memory.dmp

Download

memory/2468-257-0x00000256DAD00000-0x00000256DAD3B000-memory.dmp

Download

memory/3960-306-0x00000267178D0000-0x00000267179FA000-memory.dmp

Download

memory/3960-343-0x00000267178D0000-0x00000267179FA000-memory.dmp

Download

memory/3960-707-0x00000267178D0000-0x00000267179FA000-memory.dmp

Download

memory/3960-252-0x00000267178D0000-0x00000267179FA000-memory.dmp

Download

memory/4736-686-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-680-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-684-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-675-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-685-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-683-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-682-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-681-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-676-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download

memory/4736-674-0x000001F56F8F0000-0x000001F56F8F1000-memory.dmp

Download