9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab

Resubmissions

01/07/2026, 12:15

260701-pex98sdw8p8

01/07/2026, 12:10

260701-pcfbmsfw3w8

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hydra-installer.exe
Size 10.9MB
Sample260701-pex98sdw8p
SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
MD5 22a7efa9705ee6fcc45c21e13d760f4e
SHA1 14b19bc1233ae1c35b80d91bfcb464c967fcd019
SHA512 bbcc1ebbca30c0157a54dae343516c0118c76b244b685c7f7874bd2e3fc96236019f7aee943cd08237e8fe93af1a7c2153c5ec77b5e13839a0d6a9e7995d389f
SSDEEP 98304:ptFsk/Tuu7zYj0aBzRr2WekYOjmkPJTY0d9A3lVVPuiGX4vvrf07GGovDy9VFce:ekD7A0a8Qjmkozftvm9Y
TLSH
T1FDB6D5216A5E99ACD15AC474824A476309713CEA0B37FBFF648573393E79BF41E38218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hydra-installer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_448393509\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_448393509\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_855366371\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_855366371\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_448393509\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_448393509\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_855366371\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_855366371\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1671888273\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_448393509\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_448393509\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_855366371\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1671888273\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1671888273\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1240	msedgewebview2.exe
1240	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5756	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	hydra-installer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 5756	2724	hydra-installer.exe	89
PID 5756 wrote to memory of 5816	5756	msedgewebview2.exe	90
PID 5756 wrote to memory of 3028	5756	msedgewebview2.exe	91
PID 5756 wrote to memory of 3028	5756	msedgewebview2.exe	91
PID 5756 wrote to memory of 3028	5756	msedgewebview2.exe	91
PID 5756 wrote to memory of 3028	5756	msedgewebview2.exe	91
PID 5756 wrote to memory of 1216	5756	msedgewebview2.exe	92
PID 5756 wrote to memory of 6068	5756	msedgewebview2.exe	93
PID 5756 wrote to memory of 6068	5756	msedgewebview2.exe	93
PID 5756 wrote to memory of 6068	5756	msedgewebview2.exe	93
PID 5756 wrote to memory of 5600	5756	msedgewebview2.exe	94
PID 5756 wrote to memory of 5600	5756	msedgewebview2.exe	94
PID 5756 wrote to memory of 5600	5756	msedgewebview2.exe	94
PID 5756 wrote to memory of 5600	5756	msedgewebview2.exe	94
PID 5756 wrote to memory of 5600	5756	msedgewebview2.exe	94
PID 5756 wrote to memory of 2756	5756	msedgewebview2.exe	97
PID 5756 wrote to memory of 2756	5756	msedgewebview2.exe	97
PID 5756 wrote to memory of 2756	5756	msedgewebview2.exe	97
PID 5756 wrote to memory of 5384	5756	msedgewebview2.exe	98
PID 5756 wrote to memory of 5384	5756	msedgewebview2.exe	98
PID 5756 wrote to memory of 5384	5756	msedgewebview2.exe	98
PID 5756 wrote to memory of 1240	5756	msedgewebview2.exe	99
PID 5756 wrote to memory of 6120	5756	msedgewebview2.exe	100
PID 5756 wrote to memory of 6120	5756	msedgewebview2.exe	100
PID 5756 wrote to memory of 6120	5756	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\hydra-installer.exe
"C:\Users\Admin\AppData\Local\Temp\hydra-installer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2724.5644.3880813283192907062 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView /prefetch:4 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff85a505fd8,0x7ff85a505fe4,0x7ff85a505ff0
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2384 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4680 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4748 --field-trial-handle=1776,i,5842400250775315258,328350281891551469,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c458736b66bb31339d3ee80780db62abd6abb39efef9d7704ed29ea41cde26d0
MD5 1f4cfe0297e2deff77c090fcdbf52832
SHA1 464a21f797596a98d667fb36f670e1f2f9d96251
SHA512 0d3dfd6310957255e5d003f54a589c2d46e323a7b416234eb9189ea4efe9739e859572b9c8a1aa8e875740de58961c7ce195d305b3477d3b66ba76406dc362ca
TLSH
T16CD0241333010335C45034330103F13C0441C53F4107C041543CD55D3F044D40F174D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6980a7bb1694efa9f5a4c8c3a8313dc0201c1d05c10b36d3846646a615d17c21
MD5 fe4be8045f68823128e150c22e7ac00f
SHA1 d6db17ab49facf1cc855460ef40351cdaaa8557f
SHA512 7d4e3973800331d4b7c70cecc54a583fcd7b488a5f29eb00a9feb0f9709b9b7df1e4b0d1f204f3d9e6a26e918e3fb573c80e63e29951c7f73578a89107b90985
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e41609724dae28bd3344574c0d1e27b7ec7c0f0fe6e56b0545669833cea0574f
MD5 bcdd454fcaa6a3f6b679b89e02ce2494
SHA1 8be5bcf2ebd67422fa27fee5f14cf0326f96b4d1
SHA512 50f3439ea87f7e2bb9f9e2812660ee88941fb969e0b190c0d9ddf0db97368073064348d9fbf2c3856412580d2898bfd989714f354140d738bda92ce389e0feb2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 522320330b83bba9dc613a5b46c512beae1fb8aff61b9881327c9cb2bc50a41e
MD5 af3d9e1443c0a7141005562946de531f
SHA1 064ec0f689ee7823e487288e5c67e50c568bf3b2
SHA512 ebc3e2064e1c3364b99b96551087522b95a85a48e72543248e2f6dd7622c9a2ea7b829965ee6093ea0ea56e4728d994ada05ad5ff8d96a2642e4e247cf967f70
TLSH
T1A7A0029523942082C3508B70B0D1118B7676CB798607168350954078DD95B485A46680
MD5 SHA1 SHA512 TLSH

Submit Download

2fab3d7e-4e27-4e32-8d70-4646c9a07d6f.tmp

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\2fab3d7e-4e27-4e32-8d70-4646c9a07d6f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 12ec3d7ff7d046b83639af07a7c66cf812f2be08fd9406fb4e613ebbcf93e1ad
MD5 b5c7a6da2afafa41c5127f2ebb034e43
SHA1 79d98eb3201bd7bb3655d90eb39945a79a029bc4
SHA512 35cf01a8faea6d6468ac8b4dd885ea3b8e910402b68a6a6a6886df8d8073dbabce2f63e8affd871b8d4f7aa52ac0f0f10b690c0a91b4125de095e8c2cb35a139
TLSH
T1CC31A1B2C3E8CE7D89A157F87E2A6927CD1D1D1482783D0EC8D9DB8B93E2461D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a762.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\Network Persistent State~RFe59a762.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Preferences
Size 6KB
SHA256 b94471fe596e521ce07c93d5e69779cb4e055e403eb39e8d7c0e1b9bcb7f379f
MD5 1dc762bd982a5495e8123e4a15490eaf
SHA1 4c766a3b843d4b8e60f987e0159d6755f8fba102
SHA512 79cb755bed40107d94d05952f7cfc2b8d1968cbc9b84e344f8db49b77f1e0c09fc6023fb24f0153512768784d2e5b703b1508708367121a86bb54eefab392eb6
SSDEEP 192:stVosYpJdzUu6oMVdsV+FJVvuqjJOpe1H+G6K:st+sQzSsGGqBoK
TLSH
T1ACD1B8025E2479BB8CC6E619BA29BB17E2F5703265E11D58E7FC461C08DB7DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dd6d0a39-4060-485e-80fd-8ed7494145ef.tmp

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\dd6d0a39-4060-485e-80fd-8ed7494145ef.tmp
Size 6KB
SHA256 61ac6b3417e7417ad6a0dccc3faefd447d86efddd272d22116e6cda00ac6948e
MD5 93104e1888165ae64886fbd33844fda3
SHA1 b46c5e99e437381e16e7f0cdeaf547835cc85577
SHA512 26e6eb243ad09d12f0dbe55e5d16d5def388137026fd95bf12d8189144b04ef4028aa283a2fb5ed16992d4ed8b2b4df6afde6a5ee44a901695548b4dbc6f2a56
SSDEEP 192:stVosYpJfzUu6oMVdsV+FJVHWKjJOpm2H+G6K:st+sWzSsGGKQoK
TLSH
T131D1B6026F24797B4CC6E619BA29BB17E2F5603271E11D58EBF8461C05DB6DCA31B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 2KB
SHA256 32ed643209b1d807aee5f855d00e1bb540dd33f7e7623cb4998cb4369becaccf
MD5 d46aa71f8fe16d917c7d0d44730bc765
SHA1 0269957f031f13a6d4d4b4b4fd4283eebaa81f6d
SHA512 1b2b15b1f7d5a7c71b364c3938361c95433c6706e017f6515e98fdd3e8fa476e592f900316013d5d5154679a1fea644b8b85462df987c4746fc908c3c4403db2
TLSH
T16451C83368506A379AF29614790A7F53CE326066AF712F40DADC0B0C01CB65C631BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 15KB
SHA256 8e711ba15d54f2488ed13f9167808f7d3ecd3b76166a4f5da463b7fbb0e7f62b
MD5 0e5528862f10c0a911882c1b031179ed
SHA1 89172e52c5e155961f5c9dbbbee9d43f24436070
SHA512 1dffd0b2ba27b99721ff9198ab0cbf6f5501e2376fa148505b62cead82b4d38d50a1f62e556f2ddf9056145c5af34465d9e3ce2479682d6d311c9a498f8b637a
SSDEEP 384:Isrv+89zHqlDNP9oidawNBSVlQR1mISUh3N8c:zrv+4UNbdatK7mISUhN8c
TLSH
T10C72AF33A438AA339DF29905B44AAE077F78709696D25F60D9D90B4C428B0DD230BD53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 3KB
SHA256 20ae0e971d3f2ca8102183256b8048621ffde57cc63fa87cebc7e9a2775efa04
MD5 37ab462e17a0140f00225a5850810bd0
SHA1 ca9708890cb565c226310d3d393779e854c3f791
SHA512 e4506ebc1f45117e027e42834cf9a18f1ea599d9bbbccba7395e0150f65a5766435ab9b2a77741835fa6a2afedfbbc9d7aba338131856b6dd9e58cefc59077da
TLSH
T18871857769A0A9375EF29A1578862F16EBA16027EAA13F95DAEC0F0C01D739C1317C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5892a6.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State~RFe5892a6.TMP
Size 1KB
SHA256 c4fcb83bf22e60a577f155944eaa22c079b2b7bb241c3b3bf98a8a87ece93b14
MD5 e3655ef066875b73ce3dd76ea2b06aba
SHA1 24e48566f165d8dc8a0fc2d6c62da2af85432bf0
SHA512 09aac3ac92702cf47449c1c8d9ca8a72fe22d08a857055fccd81cbc7dba6607a7226b1613c3580f5e3825e23b2a09ad993d49391b7b78a20ed63607145cc7f18
TLSH
T1B23196B394D01A32BDA2625632067E979F22607B97614F40E9CD0B0C12DB14CEB3FC31
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1240-285-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/1240-277-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/1240-279-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/1240-288-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/1240-287-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/1240-286-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/1240-284-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/1240-283-0x00000191686C0000-0x00000191686C1000-memory.dmp

Download

memory/2756-229-0x00007FF87B5B0000-0x00007FF87B5B1000-memory.dmp

Download

memory/2756-228-0x00007FF87B570000-0x00007FF87B571000-memory.dmp

Download

memory/3028-29-0x00007FF87BA40000-0x00007FF87BA41000-memory.dmp

Download

memory/5600-102-0x00007FF87BA40000-0x00007FF87BA41000-memory.dmp

Download