hxxps://github[.]com/craig95/Hydra

Analysis

user interaction
yes
max time kernel
63s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/craig95/Hydra
Sample260701-q4l4yahx21

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
124	1124	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Hydra.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Hydra.exe

Executes dropped EXE 4 IoCs

pid	Process
1432	Hydra.exe
5124	Hydra.exe
5760	Hydra.exe
5772	Hydra.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
124	raw.githubusercontent.com
119	raw.githubusercontent.com
120	raw.githubusercontent.com
121	raw.githubusercontent.com
122	raw.githubusercontent.com
123	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1124	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273873480486105"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{0E8911E7-56F7-48FC-A96E-E9B0C84EEB2B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
1432	Hydra.exe
1432	Hydra.exe
5124	Hydra.exe
5124	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe
1432	Hydra.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2304	2288	msedge.exe	83
PID 2288 wrote to memory of 1124	2288	msedge.exe	84
PID 2288 wrote to memory of 4820	2288	msedge.exe	85
PID 2288 wrote to memory of 4820	2288	msedge.exe	85
PID 2288 wrote to memory of 4820	2288	msedge.exe	85
PID 2288 wrote to memory of 4804	2288	msedge.exe	86
PID 2288 wrote to memory of 4804	2288	msedge.exe	86
PID 2288 wrote to memory of 4672	2288	msedge.exe	88
PID 2288 wrote to memory of 4720	2288	msedge.exe	89
PID 2288 wrote to memory of 4672	2288	msedge.exe	88
PID 2288 wrote to memory of 4672	2288	msedge.exe	88
PID 2288 wrote to memory of 4720	2288	msedge.exe	89
PID 2288 wrote to memory of 4720	2288	msedge.exe	89
PID 2288 wrote to memory of 3828	2288	msedge.exe	90
PID 2288 wrote to memory of 3716	2288	msedge.exe	91
PID 2288 wrote to memory of 3828	2288	msedge.exe	90
PID 2288 wrote to memory of 3828	2288	msedge.exe	90
PID 2288 wrote to memory of 3716	2288	msedge.exe	91
PID 2288 wrote to memory of 3716	2288	msedge.exe	91
PID 2288 wrote to memory of 3752	2288	msedge.exe	95
PID 2288 wrote to memory of 2908	2288	msedge.exe	96
PID 2288 wrote to memory of 3752	2288	msedge.exe	95
PID 2288 wrote to memory of 2908	2288	msedge.exe	96
PID 2288 wrote to memory of 3216	2288	msedge.exe	99
PID 2288 wrote to memory of 2556	2288	msedge.exe	107
PID 2288 wrote to memory of 3272	2288	msedge.exe	106
PID 2288 wrote to memory of 2556	2288	msedge.exe	107
PID 2288 wrote to memory of 3272	2288	msedge.exe	106
PID 2288 wrote to memory of 3272	2288	msedge.exe	106
PID 2288 wrote to memory of 4212	2288	msedge.exe	108
PID 2288 wrote to memory of 1432	2288	msedge.exe	112
PID 1432 wrote to memory of 5124	1432	Hydra.exe	115
PID 5124 wrote to memory of 5760	5124	Hydra.exe	121
PID 5124 wrote to memory of 5772	5124	Hydra.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/craig95/Hydra
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,8814486037619593459,7567121675631604866,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,10380505117628809280,16407243392136352050,262144 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,10985867734385075025,3076053102313740313,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,17802983089428137717,8850509776716156561,2097152 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,1489581035447223418,15988422218391103821,2097152 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,3304411223462366277,11927456532592516100,2097152 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,13436108108942750304,1622320160048242146,2097152 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9004893295214370803,1398401381958616061,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,15183130660506172103,14220458630572119712,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,10914266681741697192,11503464015864407173,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,10914266681741697192,11503464015864407173,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6428,i,17913089212382110891,12833489159030291550,2097152 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,9273238769712033017,9050242449149586606,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7926000505734327855,16506139985823937280,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4212
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\Downloads\Hydra.exe
    "C:\Users\Admin\Downloads\Hydra.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\Users\Admin\Downloads\Hydra.exe
      "C:\Users\Admin\Downloads\Hydra.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5760
    - - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        5⤵
        
        PID:5980
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:4780
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:2320
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:5152
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        8⤵
        
        PID:5916
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        8⤵
        
        PID:4296
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:3240
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:4412
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        8⤵
        
        PID:5296
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:912
    - - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        5⤵
        
        PID:6004
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:1164
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:1332
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:4260
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:4740
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:5784
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:5740
  - - C:\Users\Admin\Downloads\Hydra.exe
      "C:\Users\Admin\Downloads\Hydra.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5772
    - - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        5⤵
        
        PID:5944
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:4328
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:5272
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:5924
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:3680
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:5164
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:6028
    - - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        5⤵
        
        PID:5956
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:4200
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:4856
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:6012
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        8⤵
        
        PID:5408
      - C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        6⤵
        
        PID:5116
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:5824
        
        C:\Users\Admin\Downloads\Hydra.exe
        
        "C:\Users\Admin\Downloads\Hydra.exe"
        7⤵
        
        PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,15017655401660046947,3793573053380570851,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,14178863877957610921,3649964180405233963,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,16352063625814502344,17487582741150489062,524288 --field-trial-handle=2244,i,17500494373351913523,14353903982574276535,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 22KB
SHA256 6955a1d9d9ab23fb1e2cb9d4b1a0944f4523d90dc60399e3bd17c44cf0abbfcd
MD5 1e5689400be996e562fb5b49c7ab50f1
SHA1 c16c0799390049454028ea01d01f46b151a8a1bc
SHA512 f99ef3bac16629aba9835c29b91356a9e463d789b6fb6ea2f75db79ca7a2169f60990e5da4e5277cd8d912f3dc93a289af10b3706023f9e627dce06ef6ef9478
SSDEEP 384:SgOJNMEh2ilBfl1Vpa9vGDmZD3TdvznF8T+VsISj10UDD8b5UvqfKWFAj4z6zrip:pOJNMEgWP12dSm9TdbF+J3Y5UvqfX7uc
TLSH
T151A2E14FEDF39D88052CF3F6367656C861557030385583C8D52A7A5CA3807D3BAA2C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 097f4edb5e9a181bcf886ec4f6d27b87673f58ebb43711ee7c82c6a3dbb65b81
MD5 539e879c4d310666572bc375b2489272
SHA1 b3a1939620b5efffc4ee750671c4ef3a3bd0c2d3
SHA512 80b5a6cc007c4ef49d86c81fc721b229fd176e94698a9f009cc62b7832e90936b8a2025f29d075fb008d7e5ab56081a59b3b6ae84235eddff0f57e30ab37aeff
SSDEEP 96:GVfjNjMgHr7oLKmALu3JcZd5Qyh+dePgbbU/6:0fjNjFHqAcOavdo/6
TLSH
T1AED1C2BA0BA34EE4DB6DB2315AC14E12F13C84C6F1139E36488CD7BA1B167E18B77058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe587aa9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587aa9.TMP
Size 3KB
SHA256 3c5da235e892f8e6f2cd961182395fb09b0fd4d5cc42547152df9e1b2c491360
MD5 6f185ab75999d0eedc3cc8e83a974dcc
SHA1 6d97e7927ff5f8824e41848531a158fd0110939d
SHA512 8c8ee264e50ee5b1f122341c0a00958eeed25456b14982b833d48fe5acb6b1f75ce86d963b25c07f5876568a04a56057fedb72e470934e18ab76e4ac2e7c4074
TLSH
T116716EFE18E30FA5EB21F2705AC10242B13081EBF513ED274D80C7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7a99553436e4127a6db2309d4e7af340e62bd458274c042dfd94a312be1ee054
MD5 bae6f314acef38ab28ac849576f36d85
SHA1 8c177ddec781960cd6a3b70683e2564808cb1b23
SHA512 c51f14f0caae68e92ef50d95bf9bdad9ac3e32d21c52761935fbc5efb88b9392bfdc62c2d03121764599b16b60e2508fad9c708be4c3548ab160ff77f63ef1e5
SSDEEP 192:sxZV0kdRIIyM/jK1Ml8MkYh/f4usbeBSLnaV5DIdp9VTnViHW6+WNYVCJ/YIlqVP:sxZVHMO/fbsWSLaUcHbF/s9
TLSH
T15B52D7126A345A7BCCDBD209FA45BB53D6F51572E2940E44AAFCCA1C05E7BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5ba944edf241ef8ac24d5f824bc3e476c046dd788c80e76b97605431369b401e
MD5 d3c2a4e19f7e25ba08d4227b4c431049
SHA1 70be16c13ad40a249cd225755f957820c83b9b48
SHA512 69ba7ee38cb30805e1f2058ad0e3ea3fd0873fdc30c2a1eca31c6ef82a6e99b74465b9b3573b13c8d0595a71ce98abfdde65efea0fac9d120b0d6dce20ad9b9c
SSDEEP 192:sxZV0kdRIIyM/jK1Ml8M9Yh/f4usYfeBSLnaV5DIdp9VTnViHW6+WNYVCJ/YIlqM:sxZVH1O/fbsLSLaUcHbF/NL
TLSH
T18652D8126A345A7BCCCBD20DFA45BB53D6F91472A2900E4499FCCA1C05E7BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 29ff2e95662d7b580ecb19aff851465bd8a588ecfa3facb1066a134d804f4343
MD5 0f7c9fc16a67b267381e282cbc700c48
SHA1 d764d2c140f4974d1f11814d09139c10da6d6007
SHA512 710b755fe0b7d6a5d6ec80b94c933066106580cd02d9749e5d29aceba600e962c847aa88794673e31c4dbadbd28d2d39ddb34c508eafc291943ea78e16c2cf1c
SSDEEP 768:QusqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9LroEPU:QusqxXlWvJD6Tu1ja54LAs94E8
TLSH
T1AFD21B3B694CCB7E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 014e3d3c2f874828ccaef4f09d46c6bafb82054e50fe49a4ff2ecb19522c5322
MD5 bbac874221b50a77252938a590c85750
SHA1 73cbf6c3aa078b74ca3c72f13dc9061868021f5d
SHA512 30b2e6815114250ea6eb97742f15d8e90e51a617ef3fa810bacc1fcca225697c8310c6d37f0a274bb92800a60cc6dde19edba794b0ed3167c9ecf1a1ca7f4b54
SSDEEP 384:ktNn/s3n9SfsNRCorb0qqOVRN3OKZ9QZtX0IidKzvpxRu:kj+9USqMH3Om96t78KzHo
TLSH
T115928D326D384E7B5DE25489F50B3A179FB89277D3852E50D5DC6F0C02DABDC230AA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3d0a27e1799476e694bce55b362244be34be35732b80f7efe421b343310bc8c5
MD5 a8af9336a41d4500b2dc8787d6d25919
SHA1 a76258bed990fdd50e6db9ea12d0841eab723146
SHA512 34d56c699c611964b9d60e76e220e5f775565b7a5695d9f06ed982f3d90694b29563dc13fb3807f0ecba36a7d52d238a25ff60998f47e87202e28856ad7b5c64
SSDEEP 192:tONK6JkRtQmiUyVcVAW+RN3OmNOmFHh3iDYROFU6:tONK6UrsW+RN3OKBpKU6
TLSH
T1E102EA357D381C778EF2AE49F94B27135FA4206BE9952F84DAD81B1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1893d7bd2fd4fa58a75a93b7b75646f3ba8e7521031a5f990fab3e034d845698
MD5 89b6eb7a57ef052accd3e9af8f9b3db4
SHA1 bbb98eebd691182edefad1f8f6a3f4a0914efba4
SHA512 252cf90bd672859b7108b5cc3867aa703dd5a2bc1ca5c6072e9410d5e63b0447f9a12424501fd6ae72d41430a3916a0f552eb89026eda67a22c691592e15f9b3
SSDEEP 192:fIONro6JkREMQmiUyVKjVAfC+RN3OmNOmSC9QjMpVciDPqBnU6:gONs6U/JSq+RN3OKZ9Q7tU6
TLSH
T1A4121932BC385C775EE2A945F58736174EA89127EA896F80D5DC1F1C02DBA9C230FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2f4c38d61ff282b560968eb84a81442985f2ce1e980057867b4d461a1c4d2c0e
MD5 57c0db9e5d5f84ba58442685447b3491
SHA1 b64d4d3fefc26406b436c5eea36d7678fd2cfba8
SHA512 5f681a78dcaf0dcec973f7210f87ed796dd7e8acec0091f6e8d561d4b9e15450e0cf4059e22c66715b1694b84bb060026c590c78e2fde909a40c04d2abfb8777
SSDEEP 384:DtNn/s3n9SSsNRmorbyqqOVRN3OKZ9QZtX0IidKzvpxRu:Dj+9xgqMH3Om96t78KzHo
TLSH
T131927D366D384E7B5DE64489F50B3A279FB89277E3852E50D1DC2F0C02DABDC230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3209d8e1e16a879f9eaa88313da9a76d19ca0ed2d5f1040163dcf9155d62a8d5
MD5 2cd671bd7fe9714aaa77c46884e73d91
SHA1 3239025e25838f6f96405923b9ebeac673e6c61f
SHA512 15cc2367d87cf118af0bef0d957f52cf9cfaf4bfaeb8407c1fa465c5b990b9202c367672987c45d6fed01898240d71b123062f6a067f8e18ad28210ced53f877
TLSH
T14141FA58A7EA1148B3B76F579BF7A86D88BABC771F06D49E10010E4F4662B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Hydra.exe.crdownload

Path C:\Users\Admin\Downloads\Hydra.exe.crdownload
Size 806KB
SHA256 27fccf5fa5fbcf476bedc333b8a196267ee2980f9c19719efb96d7b2298263aa
MD5 821cebbceec881d5d8052f242815ce36
SHA1 dfac065c5d6b0a27db75c77e24e733eecf89ccac
SHA512 5afcf160ce097f912698b4a13670c1c6037e0c1f6f79700c50f4319ad7d4d4bf4b55b147d8e993ef07c7e5e6f81debc52b9e495c8988b723f47671406d71e652
SSDEEP 12288:FHRn1bACW/PXRWVZyEUdW6lI86lAKZbT2oO9r2Knv/+InaXzhvZzChFHa2EiJUzH:L1bO3RMyLZlZAFPEXajhvsj0iJUz
TLSH
T1AD05D022F3E14477D1532A7C9C6BA77C9C26BF10292874865BE91C4DAF3A781382E1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-474-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1164-511-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1332-482-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1432-418-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2676-520-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/3240-481-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4328-475-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4740-477-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4780-479-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5116-480-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5124-430-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5124-429-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5272-554-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5740-567-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5760-458-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5772-443-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5824-558-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5924-557-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5944-454-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5956-471-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5980-472-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/6004-452-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/6012-568-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/6028-569-0x0000000000400000-0x00000000004D0000-memory.dmp

Download