ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684

Analysis

user interaction
yes
max time kernel
162s
max time network
164s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/05/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Neuronally Executor_50938131.exe
Size 583KB
Sample260511-rxt2mscv7z
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
65	3580	chrome.exe
97	4548	hyp.exe
107	4548	hyp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000\Control Panel\International\Geo\Nation	Neuronally Executor_50938131.exe

Executes dropped EXE 1 IoCs

pid	Process
4548	hyp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyp.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
80	raw.githubusercontent.com
81	raw.githubusercontent.com
85	raw.githubusercontent.com
97	raw.githubusercontent.com
105	raw.githubusercontent.com
107	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_2124812250\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_2124812250\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_2124812250\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neuronally Executor_50938131.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229837590273887"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	Neuronally Executor_50938131.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5792	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
4836	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
4548	hyp.exe
4548	hyp.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 5792	5932	Neuronally Executor_50938131.exe	91
PID 1204 wrote to memory of 5036	1204	chrome.exe	98
PID 1204 wrote to memory of 5164	1204	chrome.exe	99
PID 1204 wrote to memory of 5164	1204	chrome.exe	99
PID 1204 wrote to memory of 3580	1204	chrome.exe	100
PID 1204 wrote to memory of 776	1204	chrome.exe	101
PID 1204 wrote to memory of 776	1204	chrome.exe	101
PID 1204 wrote to memory of 640	1204	chrome.exe	102
PID 1204 wrote to memory of 5764	1204	chrome.exe	103
PID 1204 wrote to memory of 640	1204	chrome.exe	102
PID 1204 wrote to memory of 5764	1204	chrome.exe	103
PID 1204 wrote to memory of 5180	1204	chrome.exe	105
PID 1204 wrote to memory of 5180	1204	chrome.exe	105
PID 1204 wrote to memory of 448	1204	chrome.exe	107
PID 1204 wrote to memory of 448	1204	chrome.exe	107
PID 1204 wrote to memory of 5248	1204	chrome.exe	108
PID 1204 wrote to memory of 464	1204	chrome.exe	110
PID 1204 wrote to memory of 464	1204	chrome.exe	110
PID 1204 wrote to memory of 4512	1204	chrome.exe	112
PID 1204 wrote to memory of 4548	1204	chrome.exe	113
PID 4548 wrote to memory of 4836	4548	hyp.exe	114
PID 4836 wrote to memory of 3848	4836	msedgewebview2.exe	115
PID 4836 wrote to memory of 4772	4836	msedgewebview2.exe	116
PID 4836 wrote to memory of 4772	4836	msedgewebview2.exe	116
PID 4836 wrote to memory of 4772	4836	msedgewebview2.exe	116
PID 4836 wrote to memory of 6140	4836	msedgewebview2.exe	117
PID 4836 wrote to memory of 6004	4836	msedgewebview2.exe	118
PID 4836 wrote to memory of 6004	4836	msedgewebview2.exe	118
PID 4836 wrote to memory of 4756	4836	msedgewebview2.exe	119
PID 4836 wrote to memory of 4756	4836	msedgewebview2.exe	119
PID 4836 wrote to memory of 4756	4836	msedgewebview2.exe	119
PID 1204 wrote to memory of 5916	1204	chrome.exe	122
PID 1204 wrote to memory of 5260	1204	chrome.exe	123
PID 1204 wrote to memory of 4600	1204	chrome.exe	124
PID 4836 wrote to memory of 3452	4836	msedgewebview2.exe	126
PID 4836 wrote to memory of 3452	4836	msedgewebview2.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Neuronally Executor_50938131.exe
"C:\Users\Admin\AppData\Local\Temp\Neuronally Executor_50938131.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff82cecc728,0x7ff82cecc734,0x7ff82cecc740
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1812,i,9236914868518057375,4727775393937589187,262144 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1676,i,14612078122724350163,6811954301622774864,524288 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,10304655670911526941,14038296488945901055,524288 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,2959410968234690376,301144314086199347,2097152 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,17392646667527537591,10668459233605732530,2097152 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,6949513784206587060,4268006656618405503,2097152 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3824 /prefetch:2
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,14439666006354456380,12804282353278135552,2097152 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,8629992615109943384,11040723453433837278,524288 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5692,i,3342752897506393217,17670282762038172183,2097152 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,7052932310849125870,4895126955115982830,524288 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4512
- C:\Users\Admin\Downloads\hyp.exe
  "C:\Users\Admin\Downloads\hyp.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hyp.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4548.5196.17559933183807313783
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1b0,0x7ff81731b078,0x7ff81731b084,0x7ff81731b090
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView" --webview-exe-name=hyp.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1868,i,6307269807213740496,12602373561251923168,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView" --webview-exe-name=hyp.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1988,i,6307269807213740496,12602373561251923168,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:3
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView" --webview-exe-name=hyp.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2416,i,6307269807213740496,12602373561251923168,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView" --webview-exe-name=hyp.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3640,i,6307269807213740496,12602373561251923168,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView" --webview-exe-name=hyp.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1268,i,6307269807213740496,12602373561251923168,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
      4⤵
      PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,10825557345035961796,14757836882568585678,524288 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,11591469829791287744,3114355724888064084,524288 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,2118610616049975699,17003009512053929399,524288 --field-trial-handle=2064,i,13285958080818940941,13386263960526225888,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6b3f827954df022a90736cd0e7239eaa05020d4f9b674e0f74773486ca9ce76a
MD5 b00fa52f80ae56f9604d3c678751b2b5
SHA1 8204d474ad226a14a04ad68a14a56cc135450dbe
SHA512 adcdae5a3579a311b85331b032dd903561b3510f65465fa2f8bfdab8e60244bae2aed5bbd418bf148befed12da6d08e5439540b15b36de0da1cb9ba9905b6e5d
TLSH
T136E02BA5C820ED3728FD1B1D64544746EB5513562B91899B3B3E810CCFB267A0ADAC2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1171d27b8d5ecb5090f7f58fdd5617a3784f99abb1057d3f7056ea686062be9a
MD5 b85cce52a16ed6da28990af5992ddca8
SHA1 2a0229d6f2228223c5c10d2c970444384cd9b583
SHA512 dba06011b27eae31b7f4d696695c336de0cdb089b06305d000df03063113f63d88a2363bf71908bc0b9007288383e3ef3509df79c808231fc8eb13aad00fc933
TLSH
T1B2518CF3D3E48ABE851156E4AB256E2FDD6D0A14531D3C9AC9D4AE4B47F2872D2003CE
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1d65d0cf2341e5ad05be98db005bd8b4df40cc3bf4d0f3f350eb0d6d68732be0
MD5 0bea938c0dcac935afbd6e1b109921aa
SHA1 2b0ac7097d4b0ff8954fdcde38b17f01095fd807
SHA512 dd3bb78a1f5380084156cee0f5857f6aa6b4431264477cb0858832c181f0269f2e20bddb43b15e5ae590b7bb7bcfa06e8d6c1429f61653f7bbf0db073bc015eb
SSDEEP 192:BRLI5ghqo4Ov7XhAPRp2b9DHhRb+WNnfs0ti1P1+VyIsnAUgtaJ:BRLAgeq78XUxxU0oH28
TLSH
T1ED42C62AF914693B5CDBC22AFD217717D7F6102561942F88E6FC8A2C18E76CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3a2129cbd053015378c572db601079ca5c9ddb7b11f1747fac1b79b10fa3f6f1
MD5 134779fd616a6c78db8e24c67d52db43
SHA1 f35ae0806c0724ae98a535a38dc772d609fdbdcb
SHA512 6ef7be3aef130668ddf59eabade7c8207e1e6e0c8d50cb9af1570fc787f2a3023f05058db3ac2f1b0e37fa1d873b3e4730ff7be93b46dd1f56d99229f63f3415
SSDEEP 384:EyjI37KxkXqKf/pUZNCgVLH2Hfgslzs7pLuLcifSzXODI7+ErU324HGZ8EJyX:ESI37KxkXqKf/pUZNCgVLH2Hfgsds7po
TLSH
T19E72F9A7B84C9D370F94CACCD8267F4FADB5025A65EE886842FA982503D5ACF11061F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 72eca910867e3c19a5d359a23b07266991df8e85af730e526839d0b70e4ee985
MD5 3cad4851feb5b87726a992c4d021cbc1
SHA1 f28fe7183fe1a9a7f1bc8200e5ac16209757fca3
SHA512 047acd120b5c56fc31b096e1ed1f4ec7b9e342e25c1951e9825236dc56c841aecf16ca8744fa12e3185947c3c0adffe4bf0b8ee76db9f14efd21051b5cb3f3c2
TLSH
T1BBB0126084015D45C0C702B016C204DC32189F169709130657F06971E8261A24115151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5941e1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5941e1.TMP
Size 96B
SHA256 75cbd88cab3e6905605c6182e31f783bb2eb91f078295628f2618c295058083a
MD5 adc2c30e744266e7b8482cfa194a1988
SHA1 7cb90a57cc2dbfbeaab1c7c75e3fc93fa3e3b3c2
SHA512 214ee68d1044298cb23f1ac1077021e9ff6b8125b2940da2aab2983199d825725212e0aba94bd569c779fa9cc672da04209f71b6d227b0b74db318348bacbbb5
TLSH
T180B02200C2822202C08323B022C888CAB0A0CFB3E2230222A3E20A2ECC2023200A0030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 f878adcd95034cc0581abffa9df8f4adfa8aa0680f50bdb5812d7ae9bfbee333
MD5 6d4918f7db1bc7395edb6ed6b260a5e2
SHA1 78188d917e4553cad5af90260feec6b7220c1bfa
SHA512 f5da4f1f8d8d1fc76d38df8d21d456da450522734bea0e484f6f7ef6ecee9ba1e771d186440c91389d3784253dc2b6183e6c895ff20ec26d507e259a5fecf7cb
SSDEEP 6144:vyIfzna+DALOQhYifhO6ZZwINsIrS2uB2Q:fzna+w9Ki0upNPS2u0Q
TLSH
T18D1413A73EEACC37758CC11DAA3D2D0DA591D4B2C49CBB674649937F19FA974220320B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 e8e0f509874d63dd39e384f1aef3156851b033a84227c1ba4203621b45f82ec5
MD5 56a99333a38303a5da9b96a27ecd8ae5
SHA1 8e745e838f5915176c5997ed9f0d93d954d59768
SHA512 9ae12f4c1ce30d35a3b20089defc458e3a1f8abc7d82887787d01f736f5f14acd877bc0305f8d92f8c876b64c2981d539bb646d92d0024f2438809cc88d509ef
SSDEEP 6144:IyIfzna+DALOQhYifhO6ZZwINsIrS2uB2Q:Czna+w9Ki0upNPS2u0Q
TLSH
T1711413A73EEACC37758CC11DAA3D2D0DB591D4B2C49CBA674649937F19FA974220320B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 508da68f99016c6dc76224a23d7bca39d8de41b464220df0543790f6cbc562a9
MD5 ac5543ebf417dfa40282735c6eb4ea45
SHA1 258b236a17e0961d96f706578de0bdf08dd3c535
SHA512 f9d0d0a6a87a37dd469b971eca62c76f3771b1cdbbf8163ed3be32a230bc67429c7fa274c93ed66607f1ea0e45810055b0d944208787bd99fc1636e3796e1f24
SSDEEP 1536:PuKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPx:2DlBshIZZwINsIrS2uJBLpAkLQqx
TLSH
T1BC9302B73AA6DC37C49C4202B93C2A4D7EC8B5E9C819B57658CA677F01F2BF59103502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 ed5ba2647c7833c71c34082c903275e5b5dc881a67a7497259b196beddab9d42
MD5 baf08dcce695aa623dae46bfda655c17
SHA1 ad99cf247c6a1095b8da5cb2f265bfd127cedc43
SHA512 b639f3fc4b005875075b5ed07057b3fd01327a4c57314b8d0ad0efafde95b698fc7fd7471a7b5fe6efca8a8e12d60af65cc1558e93ea738529b59a41afefcb6c
SSDEEP 6144:425yIfzna+DALOQhYifhO6ZZwINsIrS2uB2Q:4ozna+w9Ki0upNPS2u0Q
TLSH
T1281412B33DA9CC77768CC10DA5392D0A6DC0E4B3C89CBB1B4949676F19FA974660360B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fc579d0359c6366bb5884a592a6ac4661cb00f504bc3162567cc8b9a3d70d6eb
MD5 0e71bb1b790303b662e7679bb0cd063f
SHA1 f99a640131684e80a6e805d706d2d276270d54fe
SHA512 ba48ab54297e2a6ddf151077aa5930c8b925efcf9d5314a2df846fec4dbd158e53ecb0beaa2b3f487f57e8abb3f9a057a15a66d7cf89346e55558b71f8740c40
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9fc70c591fa28e33b3940601c1b3ff88bc20f765cbd436f87ecc9dfaac66b730
MD5 6954a51c217f3c3f4bdb9db5f425fec9
SHA1 92354706882878c96ee3d7fb84296b8b5e2e79e8
SHA512 5450f39d82bb94632650f464999f21400f77fa03a9953efcc1ebdadbebc8e27153ca6353adeb94f3b33948c587ed984712c08f29f045c61eb55aabfc49ce6810
TLSH
T14CD01123BB020238C82830330003AA0C0802EA0B800A8200A8388A2EAE088A80E23A82
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 bb1e11c79a52354ba0a7e6440ca6ca2ea9ce922a014d0598193003bf653e3114
MD5 91ec5744fbb8c475d3be8b0335582790
SHA1 86d9c5f01f759c14d11596a4af1665ebd5a51395
SHA512 9b44d762b506a7dcc458b3c7b30cf3aa2b98c89af4a72a54d06e169f86fca659af3ff3272590f5828ab37cd6bc2b06fc3cba90615f7e530f9cf70c9c9b0b81fc
TLSH
T19EB00298994A6016E7C0C3F8F6E505C675711FD442C71B62E4F540FAC97E7D891D3784
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597025.TMP

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe597025.TMP
Size 48B
SHA256 c1c433a8032f3abd043fba1637864cce5876c695953f85b8e32869b1dbb33234
MD5 adf7fc5701348667da3a4b300ea1ade2
SHA1 abd933beb8e49bf814611e21a1fb39c0dffee2a6
SHA512 f436e8a429ad19a2a98989d94af6d641e5ec0d95ccd1d7959cdbef5eee866233706b6f2a340ace0069f62e5382b291fda86580776a5ba77516769c83fa112c10
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\Network\Network Persistent State
Size 358B
SHA256 c020dc2d6034aabaa8e9fb7f7772cea51f1147b9da9693b896601fd17f173e64
MD5 2600a79abc0e4b32bd1e3b211138fca1
SHA1 4a8f7353ac3b1ffe4368b6f8f302930902a5c623
SHA512 6d2c3ce617a23506bb85ac16f22d9351a873e261c7ef77ee39c6bc85f96c8d74036224899ff90c19ce81c76a0beed98f9242c2b15d84b14ceb331a122be8b33f
TLSH
T11DE0C052C1E089BD474013FC36347513CA3A080652281E7AEEE8BB9E47D10B8912040F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a32d9.TMP

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\Network\Network Persistent State~RFe5a32d9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\Preferences
Size 7KB
SHA256 41a975a2ec2440e8d30fc12c0b5f1e4324c206ff38a0acb05a1a9c91beca36da
MD5 5e7de945399dec6258e9ac2fe150476c
SHA1 0a86af11c452dc8fcc12d86eb51da8c549cb796b
SHA512 7978fea61c7d131568774d2dc2032fa00a579e4cf9aabcdca95f30821c64fc93b717b0077c4a58ff30dbee0dc319ed8666163e5a0795723fe8e8653261093a35
SSDEEP 96:stp051u0ab9HffqEZ8i0vhEqktmm/7qx+WVHMSm+uecJfPMH9dQjs+gVUcZKOB:stp0DafPZ8paJT/S+WiTfPWdNXZKC
TLSH
T1FDE1A9026E2899774CC7E619BD35BB12E2F6506252D55E88EBFC8B0C05E66CD6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\Preferences
Size 6KB
SHA256 bbbc9324a548bab480636cef8841b6d8cb38b122536d45fef43f754f48803ead
MD5 d96762c198640cc2832d61ac4f2dfd03
SHA1 ca7b9b13b7d7c2681ea451780dcce4c6727a9fc1
SHA512 448f8cf2e2f4c1eb448d2d904c96634d29214955457fdc8c481155672f0374e7db23a5b43c847b4d1f15f8f2ac6184ef455604967bfdf5d5ef2d2565257f3d4f
SSDEEP 96:stp051u0ab9HffZZ8i0vhEqktmm/7qx+WVHMSm+uecJv8MFHdQjs+gVHKMOB:stp0DafRZ8paJT/S+WiTv8qdNLKMC
TLSH
T17BD1A8036F2869774CC7E619BA35BB12E2F6506261D54E94EBFD8B0C04E66CD2217D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c896.TMP

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\Preferences~RFe59c896.TMP
Size 6KB
SHA256 8a6098b262971fb99f33d8e34abab2ac838ed518b9544a292cc1ca730d2d1d23
MD5 50c9824df6346db6e437d7a41e707712
SHA1 a7dd88a03f7abb4770df9490fc236b055170342b
SHA512 6013902ab3814cd14bf04ba89624482a123fa33470f611f30d468b5439c8a0a09d241dcb5f4ed9f20285af8b71c770896600b00cd668283c8b7cc64721ea3afd
SSDEEP 96:stp051u0ab9YffZZ8i0vhEqktmm/7qx+WVHMSm+uecJax1idQjs+gVoMKMEB:stp0DBfRZ8paJT/S+WiTaxwdNhKM8
TLSH
T133D1A7026F28A9774CC7E219BE35BB02D2F6506266D44E98EBFC8A5C04E56CD6217D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Local State
Size 1KB
SHA256 f0938d61215aa61cac2acad4273b24eb846b32b3378e09b445eaf7ff9517ede1
MD5 a337ad25a017913429aa730005622cb0
SHA1 aaeda47f9664f552e38774f96d17fe5338a44cb3
SHA512 bceea99423f8fbe93a2097273595577c144623eba1303eda13fc6846ed63e5bdf80850ea9b05bc09928940dd72b4b5704eb4402113d6dafc58a003d9abe3a9bb
TLSH
T1EB3185F2F4A06F329DA2609AB16367675E311076D2314E54B1ED0B0C02F6ACCE636C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Local State
Size 16KB
SHA256 e8476d98cd30822560c08dca1c6831c6a11750bf08b40526b17d26737935997b
MD5 c3f14fe6e76d919742233e44c21e5494
SHA1 9e392320a5b06a97417fbcd649c5ec27edf98902
SHA512 beae869416d584510f2fae78698a5a8001921bac00b3b4d14b384c610884b34525dbd7678fb776e97d48d7f5df4d4300a480285b748d3899e5fa1faca3aecae5
SSDEEP 384:zmvsrvyOiyp4+IWA1eUVWGfvvLhNbL2iK5MATuBA:q0raxyp4sQe6WGfvL27aAB
TLSH
T1D872BEB11A749A37DDE2A84BFC8B3A1B7EA5506BC9D12F84B4D46F0E015B6CC0706D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Local State
Size 17KB
SHA256 3e69a122c11fa92af50a9d799ca2492c42a0a061654e4e1c43ae7b6a5142de45
MD5 566ae2944cafc802e53d13bb6e95c47f
SHA1 88bf3e4a1437237c21197fe987f46cfcbc459a1b
SHA512 8b0c30bc31e7627e526dde3f39c43e7fceb67307583644366d0aaafda3c3cf1fe881cb58f7fbd3bf4c73d4f395d3dcfb91899c18566c9664fbda010b971a43e9
SSDEEP 384:zevsrvyOiyp4+IWA1eUVWGfvvLw3Nbu2i85MtfZc6KuBA:a0raxyp4sQe6WGfv0g2Pa1Zc6a
TLSH
T129829DB0A975DA379CF29987B84B7A1ABAE45156DAC51FC0E4D46F0E014B6CC0706C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Local State
Size 2KB
SHA256 8eaec3ca71dd4d59b4ac68c81f0e0c35aac90b5b2c272ea3f336acf79c617efe
MD5 fd9d3c7f81825c8e227eb2c6f8c64422
SHA1 d1571f7536601632f3c090c873090a4a93acf1db
SHA512 387965dbd21d526660c8fe27cbeb94d8d363895a75154318ecf5ea3956f4b920dc37b594138bd2210129517dcc5600957b26a57b3af2e303b06aaa3b25efcc47
TLSH
T13C51A7B3B814AB3789F35559F9562B239E355065D7622F60A5EC0F0C01EAA9C3312C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Local State
Size 3KB
SHA256 7b36baee3ada68c2d216add32f6102ac9b4aced5b2556b43bd24a34b18e0034d
MD5 ecc879cc292c0015fa71023c78137c7a
SHA1 85685edbc39615897f1f438f681b99ad84d011e4
SHA512 3b1783ff88b2430f60436a26b8c138debd8e525f9e47de044c84bd609b99821869ddb7ec76c168caf57ad6bc76a0ba2d4d2daf401f16f3cc879d3fc9fdd3ad34
TLSH
T1EA71B566B864EA374EF39905F8862B16BA611033E6913FA4D9EC0F0C01E77CC2302C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591db0.TMP

Path C:\Users\Admin\AppData\Local\com.hyra.ui\EBWebView\Local State~RFe591db0.TMP
Size 1KB
SHA256 84aa7e07379dad1f6a4026c92019741cdabf8341dff29f2946f1e0b787b61f50
MD5 d7392c9d146647cf493ce0ec84a65c42
SHA1 ddb64b864aa45812c46f49fba0d334cf4292d0d9
SHA512 a46342fb1c95ebf92b260b9da9ace4e7c03872751164efe844822fc3cd9277e5e3b375df7236cfd64ea414722316b33234e92933e8e58641583d2fb16bde78f5
TLSH
T15D2165F7F4906F729962506AF163A75B1D611076D2314E18A1DD070D02FB9DCE232C3B
MD5 SHA1 SHA512 TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 d93566f59a2f2f63f411e4fe2d5ff37bd1e9e9f3c8692c65ee39185b626b5277
MD5 642412e3667d4a04c71f9146c00f0f0e
SHA1 781afea378a59e7f5dea4a342c385f3c040ec940
SHA512 301ea194817aece914430f0f6520636f312e8303cfb1bac6ff679717309d660cf5d21b4258cc78f0ae0cd0727ecd242678e060a92937c4a9ef1915a876c4fb37
TLSH
T149A0022554D2155958558E883E915C5066521093116ED355DD3086050C27E1660B6546
MD5 SHA1 SHA512 TLSH

Submit Download

hyp.exe

Path C:\Users\Admin\Downloads\hyp.exe
Size 11.8MB
SHA256 d2cea31f27f9f569e7c01f166119a4b7b8021f4512296d8a7139b0e2a58fe8b2
MD5 8e9704977b5526559cdd1db221fe88bc
SHA1 ea8d0cea7336004997b1739521fd1b819c3e8172
SHA512 da8948407f8415578e8163627f2d26b20570b79f02671aa2bd5f4a44547b5654c6c646a1a70d05c6e74c9e6bea0d867cd9558e1b9db433c91a164daebaf4c1bc
SSDEEP 98304:TbHwlxRKzrzZzz2ZEqMs21ZjvT9yd9bsxZNt7WjRjN158O4AalB74zhCu6bpS3b2:TwRKzrhYEqjaY/4AQB7Osu/G+Xo
TLSH
T154C6F6217B5A99ACD05BC47483478AB24D7170CB0B39B9FF449496382F6ABF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4756-214-0x00007FF84A290000-0x00007FF84A291000-memory.dmp

Download

memory/4772-140-0x00007FF84A290000-0x00007FF84A291000-memory.dmp

Download

memory/4836-618-0x00000227519B0000-0x00000227519DE000-memory.dmp

Download

memory/4836-332-0x00000227519F0000-0x00000227519FC000-memory.dmp

Download

memory/4836-333-0x000002275C100000-0x000002275C129000-memory.dmp

Download

memory/4836-331-0x00000227519B0000-0x00000227519DE000-memory.dmp

Download

memory/4836-334-0x000002275C130000-0x000002275C16B000-memory.dmp

Download

memory/4836-621-0x000002275C130000-0x000002275C16B000-memory.dmp

Download

memory/4836-620-0x000002275C100000-0x000002275C129000-memory.dmp

Download

memory/4836-619-0x00000227519F0000-0x00000227519FC000-memory.dmp

Download

memory/6004-213-0x00007FF849380000-0x00007FF849381000-memory.dmp

Download

memory/6004-212-0x00007FF848B20000-0x00007FF848B21000-memory.dmp

Download