dda01d9fb4189f1d2dae905609a9270d92ef67df2fd46d8d88909d7c0bf2adae

Analysis

max time kernel
150s
max time network
171s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hydra.exe
Size 7.6MB
Sample260803-d2776sbp21
SHA256 dda01d9fb4189f1d2dae905609a9270d92ef67df2fd46d8d88909d7c0bf2adae
MD5 87b0af6700396722c907ba7765cc3b2b
SHA1 8d696940e4918fafd8ad0d3e791516185b6a5dac
SHA512 df4ae0f2db2cbdd76b4643977714c8672de6f1527a917867a82e8def51307f05a9e66f0e40f6774e7ad1d611bf1512908bd6799694c940d9c5add04e77d23026
SSDEEP 98304:Irtoww8d/DSQGbdVUpT7hFURQXths/ZNQ77:bt86dVooin2N
TLSH
T1D0864A012F8E5999D089CC70C35B8B930E2130DB1A76F9BF49D606292F7E7B95F29319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe
5584	HydraBackend.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hydra.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_1345604421\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_1345604421\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_1345604421\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_797929612\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5800_1345604421\manifest.json	msedgewebview2.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1456	netstat.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1456	netstat.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5688	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3252	msedgewebview2.exe
3252	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5800	msedgewebview2.exe
5800	msedgewebview2.exe
5800	msedgewebview2.exe
5800	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5688	taskkill.exe
Token: SeDebugPrivilege	1456	netstat.exe
Token: SeDebugPrivilege	5584	HydraBackend.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3716	hydra.exe
3716	hydra.exe
3716	hydra.exe
3716	hydra.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5584	HydraBackend.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 5800	3716	hydra.exe	88
PID 5800 wrote to memory of 2516	5800	msedgewebview2.exe	89
PID 5800 wrote to memory of 1580	5800	msedgewebview2.exe	90
PID 5800 wrote to memory of 1580	5800	msedgewebview2.exe	90
PID 5800 wrote to memory of 1580	5800	msedgewebview2.exe	90
PID 5800 wrote to memory of 1580	5800	msedgewebview2.exe	90
PID 5800 wrote to memory of 4784	5800	msedgewebview2.exe	91
PID 5800 wrote to memory of 5972	5800	msedgewebview2.exe	92
PID 5800 wrote to memory of 5972	5800	msedgewebview2.exe	92
PID 5800 wrote to memory of 5972	5800	msedgewebview2.exe	92
PID 5800 wrote to memory of 3580	5800	msedgewebview2.exe	93
PID 5800 wrote to memory of 3580	5800	msedgewebview2.exe	93
PID 5800 wrote to memory of 3580	5800	msedgewebview2.exe	93
PID 5800 wrote to memory of 3580	5800	msedgewebview2.exe	93
PID 5800 wrote to memory of 3580	5800	msedgewebview2.exe	93
PID 5800 wrote to memory of 1372	5800	msedgewebview2.exe	94
PID 5800 wrote to memory of 1372	5800	msedgewebview2.exe	94
PID 5800 wrote to memory of 1372	5800	msedgewebview2.exe	94
PID 5800 wrote to memory of 1372	5800	msedgewebview2.exe	94
PID 5800 wrote to memory of 1372	5800	msedgewebview2.exe	94
PID 5800 wrote to memory of 3468	5800	msedgewebview2.exe	95
PID 5800 wrote to memory of 3468	5800	msedgewebview2.exe	95
PID 5800 wrote to memory of 3468	5800	msedgewebview2.exe	95
PID 5800 wrote to memory of 3468	5800	msedgewebview2.exe	95
PID 5800 wrote to memory of 3468	5800	msedgewebview2.exe	95
PID 5800 wrote to memory of 1572	5800	msedgewebview2.exe	96
PID 5800 wrote to memory of 1572	5800	msedgewebview2.exe	96
PID 5800 wrote to memory of 1572	5800	msedgewebview2.exe	96
PID 5800 wrote to memory of 1572	5800	msedgewebview2.exe	96
PID 5800 wrote to memory of 1572	5800	msedgewebview2.exe	96
PID 3716 wrote to memory of 5688	3716	hydra.exe	97
PID 3716 wrote to memory of 1456	3716	hydra.exe	100
PID 3716 wrote to memory of 1868	3716	hydra.exe	102
PID 1868 wrote to memory of 5584	1868	HydraBackend.exe	104
PID 5800 wrote to memory of 4020	5800	msedgewebview2.exe	108
PID 5800 wrote to memory of 4020	5800	msedgewebview2.exe	108
PID 5800 wrote to memory of 4020	5800	msedgewebview2.exe	108
PID 5800 wrote to memory of 3252	5800	msedgewebview2.exe	109
PID 5800 wrote to memory of 1088	5800	msedgewebview2.exe	110
PID 5800 wrote to memory of 1088	5800	msedgewebview2.exe	110
PID 5800 wrote to memory of 1088	5800	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\hydra.exe
"C:\Users\Admin\AppData\Local\Temp\hydra.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3716.2856.4412363613152706445 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView /prefetch:4 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff902aa5fd8,0x7ff902aa5fe4,0x7ff902aa5ff0
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1960 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3824 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b /prefetch:1
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4212 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4344 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4604 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView" --webview-exe-name=hydra.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4616 --field-trial-handle=1808,i,5772702056201123409,14402723938228944458,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1e2e572516f0c819bccc593f03f76183dc28d13b
    3⤵
    PID:1088
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM HydraBackend.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5688
- C:\Windows\system32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\HydraBackend.exe
  "\\?\C:\Users\Admin\AppData\Local\Temp\HydraBackend.exe" --headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\HydraBackend.exe
    "\\?\C:\Users\Admin\AppData\Local\Temp\HydraBackend.exe" --headless
    3⤵
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_imaging.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\PIL\_imaging.cp314-win_amd64.pyd
Size 2.5MB
SHA256 4a6803bb6c02ce1485cf67efda79143efa64c9982226701d6b0531df1c3024d3
MD5 6b2404ae3ba9b3a530f844ac3b4e7286
SHA1 e5eda67192b38f0461fa3b2cfe2a19cd4ee00d8b
SHA512 911b8d338226476b24295c11465f79744c32ca897ad4c55c8f78fa7015ed6a35c3d90a5c8f9f166dc122fc18e28379b3f5ba09e9f6b09ab331d663802eb6a400
SSDEEP 49152:5SVZ2vtcflslbofAG4RrPRX42fC3iHidC4gu1qdMk:kI/XFidCuqG
TLSH
T11DC57C06E9D19499C6B28034CDAAC116E3B1B80D17F187F77684A7F93E63BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_bz2.pyd
Size 85KB
SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
MD5 b831ff0ab5f28a1f3bae6842896d45ff
SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
TLSH
T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_ctypes.pyd
Size 139KB
SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
MD5 208e7dd066f23080da03b4ebd20fbc43
SHA1 8b56760b26be7c98a6752cacb3e78716972089ba
SHA512 7841d4a3d6b04d00eff9e6a7ebdffea6d5a257bc095bfdfe33ffe78f2d0ce731af5021206b8e3b2e0da5ab0a27b0a65d149c346ea6c1d95fdd75087a411de40f
SSDEEP 3072:7Eyf/PRau5nIktyc7utl1OUIVi0I1sDdMIBU8ISGPiT:oy35aynVp0qUITGs7BUS
TLSH
T146D37E0B736440E6DAA78178C6739E57EBB1F0511A1087CF4264C9AB2F633A26E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_hashlib.pyd
Size 67KB
SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
MD5 4f7f664e8558a6cfc93ede2ae9d6974a
SHA1 0b5ed2b9c68120d5912f12c1d6038afe517547a1
SHA512 89cc41406f4b3da7ea46e15e12f86135ffe8c3fa2d906c8aa370402cfa4bd67fa00e2901e33e3e44daed075ddb9ac35c4dfd3181c44544d17c97522363227b85
SSDEEP 1536:aL0SOWZsPqJWvnKt6RfoISDI1ycA89tfIYke:ULYyJWvnKt6NoISDIYM
TLSH
T1A2636B4AA6984062DA2382B4C8E34F43FA74F652271197DF6779C18D2F233C3537A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_lzma.pyd
Size 157KB
SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
MD5 d412fca808a8dd9178ccf8bd9517859b
SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
TLSH
T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_queue.pyd
Size 35KB
SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
MD5 da5725ad6e85ce51c26e6b166a42e4a0
SHA1 11c7a9e2ad7c88eda5546ebde644d0d4dd748132
SHA512 bd1a145368309230c4898d6d0815b17fcbb0b7ddeed8e6b76ebb8e9d9faf76bdcfd7d2f5fa39ea12ecb82ae474d5277447bc472ecf0baff911951f86cb5d28a3
SSDEEP 768:C6KN6rbeVOX8ISRURnxycTOJh2Ip4iz2Txf1mlRaXUCWP:RbeVOX8ISRURxycA89iyfIYUz
TLSH
T157F27D89AA585197EA63C970C1A6EFC2F934F7D3470187DF2179C18A1F233C1A73A259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_socket.pyd
Size 85KB
SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
MD5 b8732b29606a0d93be25bcd924b50239
SHA1 e7270350e71ce191d5fac5e4a6e5e7be0d0bd1d3
SHA512 489a3c09eb6665b6ee9b460303ac35f1228684723fabe34bb29c5de7b2b12d3fa8853e1eec8b8ba3eb3e80c517cdf1a263e6b963d4e0d2d092c52567a2ccca4d
SSDEEP 1536:QcVunc70XTxn1egypx97XP+N6wSz9GN7WQRcSqIP4fY8ISGwyycA89gfIbHqv:FEna2Dypx97XPs6wSz9+WQyS6fY8ISG7
TLSH
T109834A00AA6040F6EB76C176C6639E63FB74F5C112D4A75F1466C65A1F33382BE3AB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_ssl.pyd
Size 180KB
SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
MD5 6252eee501b79b472903a978872518c3
SHA1 dee9a3ab7444ae6ff203d585ed5b18f2af4b508b
SHA512 752947bce9d8177cb93100911a3c4fb74aa86c72f5b7f4b733636673459fe22f30812e9cfd34d7ee29e34e4ccef37b20559fd05b3f371be1f5d2ba89b64aac09
SSDEEP 3072:6QjyHsqUEao3kfF6Cu3qMX31Wzy4zXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UpnA:SJUEV3QF6Cu538zyAUBzbT0
TLSH
T1C5048C47B1846AF7E913E4F9C6234543EBB4F145332297DE48C6DA860F03346AE66B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_tkinter.pyd
Size 67KB
SHA256 f1d7eebfe85d0b3ef56e9db4d23fe3421de7ed77bfd8bea1df83a1ae96600fea
MD5 888549cae2db0797064287027bd24c67
SHA1 03d21dbeacc728d881675617ff1d5a430cd0fb37
SHA512 db7689afab6276e88f56398478761c4271ed978074ab87b6a21e08efc2ac664d154218390aa4fc86a919e13ca223adab76e746d1b5800805d803be95ba500e5a
SSDEEP 1536:wBXLu/4qEIpF+2RElU9orymeFuoISDSgycA89OfIkB6+:w9nI7b6lPrymeYoISDSoI
TLSH
T15F637D9BA768009BDE66C538C5739F53F679F6520620830F01A4D34A1F373E2A7BA718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_wmi.pyd
Size 39KB
SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
MD5 72a4dfa925a2b6326a005601dcc4cb34
SHA1 645d36a951c9f7c9ef7cf797ed600b25c04a82b1
SHA512 46b7adc94db1ccd8773e3247a0d661784202c7ce05edbcf3a616376e011543a243c21eac776f1a07179a1f491efc23ced854fa68e7d700863463cfd2e947777a
SSDEEP 768:q2/EEqrVmjstuQsQ9VVQIS3izxycTOJh2Ip4YTxf1ml9dHRjLJ:vE9BEbQsQ9VVQIS3iFycA89kfIbHRv
TLSH
T1E1038D89E6640092FA6BCA74C1A5CE93F575F7935712838F326582590F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_zstd.pyd
Size 491KB
SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
MD5 225e0462bf8337155e78b36e3cf9fa79
SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
TLSH
T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\base_library.zip
Size 1.3MB
SHA256 0243d26ac9b878eb5b1c59ff62389586e3a50b34e042bdbc1f14130db7a65b94
MD5 847d7daa672cbee7d0b0297a717e2c2e
SHA1 a7b1fcab326129601849857159198c45645aae8a
SHA512 2e314c7e7d0168903d27d331cbb19479569b63173637ec50e8866d38c3dab1e3ceb5bc1f469c5f267cb2a417695579d2f76c83c22c516e8862a15db869775504
SSDEEP 24576:PdQeOdP2m2df9jUlbeLafukuUFVdIzRpWK:V/1gukuUFVdWRD
TLSH
T1E1552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\charset_normalizer\md.cp314-win_amd64.pyd
Size 10KB
SHA256 394271ca355a08eff4e268efef85f3f817bcc7d8661ac655cb47f24132e7eedf
MD5 4ea7cf2510afa7859e66a1f51931f665
SHA1 22bd8461270e2c649ed45d181a6c0586f0b77495
SHA512 0909b053726c2b5bf9d11d5f5d3ba3bd07ca2b818e26f0eed191231cb55572fccbbf520707f6d915ce3a94c28dba4b77c1a44862372e90b546ddc3cabf243cf9
SSDEEP 192:Sv77JGrmoX+sMl/++Ch9p8uBY5297L58AwJz6:S3J4m446Fw29Z8Ae
TLSH
T1CC22F86CFF7458EAE9168134C9375E8AB132B722170277CF8770906A2FA33E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\charset_normalizer\md__mypyc.cp314-win_amd64.pyd
Size 120KB
SHA256 7d28dad4be5242b16e17e75d94bb1117451754f95c8749aae554caa6973d1c6f
MD5 830c2e39348f37566650474c68141362
SHA1 142b56244a15af3ed014d622a90cdf21d5af151d
SHA512 a32650a50948e366c4216d0d29950ea2611dd069a00702b21a7785bd2045218f88aa51f8b337991701d8635eb295f85e485234d31fe17edf1a2a2c9a811eaa12
SSDEEP 3072:I4rZlz+QdBKzQ2aFYacn6nl5xSJogmQNCbL0e:IUlz+Q1ool3UCbL0e
TLSH
T113C34A56629908B6CA634178CDBB9843DBA1F451073193DF09A4CAB31F0B7E6BD7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\numpy-2.4.3.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\python3.DLL
Size 72KB
SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
MD5 3740e03e444c539461fedcf191758226
SHA1 64499ea6294ed68e616d1ec25ed4892cd3740741
SHA512 4a6e748f1619b59a281e80231f3bf1316330fe058b3860fe5902cd7021795f18a7d716a9a3490414bf637a1edcd77e71d67fb7ccefd7935a19f64d12a0da00d1
SSDEEP 768:hQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIw:MbTrnXngXMT8ISG03ycA891fIbHqv
TLSH
T17E734D5D6B54F8A2DAF629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\python314.dll
Size 6.4MB
SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
MD5 23b7bec4bb8cf109503029b50f5eadd5
SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
TLSH
T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Conakry

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Africa\Conakry
Size 148B
SHA256 d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997
MD5 09a9397080948b96d97819d636775e33
SHA1 5cc9b028b5bd2222200e20091a18868ea62c4f18
SHA512 2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799
TLSH
T17DC0028957180543C410B3F44DC311E8DF15C00DD532537330186708C4665D51A14945
MD5 SHA1 SHA512 TLSH

Submit Download

Djibouti

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Africa\Djibouti
Size 265B
SHA256 c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968
MD5 86dcc322e421bc8bdd14925e9d61cd6c
SHA1 289d1fb5a419107bc1d23a84a9e06ad3f9ee8403
SHA512 d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b
TLSH
T187D0C9885E25E190F0C25834DFF2450BAE5687FC93334CBAB45C586053748546ADE4E0
MD5 SHA1 SHA512 TLSH

Submit Download

Kigali

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Africa\Kigali
Size 149B
SHA256 444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb
MD5 b07064beada5be6289ed9485ecc9733d
SHA1 b0ff96d087e4c86adb55b851c0d3800dfbb05e9a
SHA512 0ce1322f4a6f6568cdf61fc699eead4147015829650e90d791c223b45f3a23ead720ff41b4c8cc10ee915175e052d4740347a4454d23c18a3c57d30ded5a904c
TLSH
T12BC01204911D853FE011A7F56FEB0301AC5B9304C701317710741045E4971905D49340
MD5 SHA1 SHA512 TLSH

Submit Download

Lagos

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Africa\Lagos
Size 235B
SHA256 cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846
MD5 8244c4cc8508425b6612fa24df71e603
SHA1 30ba925b4670235915dddfa1dd824dd9d7295eac
SHA512 560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c
TLSH
T1C5D080C513B00097CA10773C1FE334D1D5150564456E25EB10540CC411250D273FFCE8
MD5 SHA1 SHA512 TLSH

Submit Download

Curacao

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\America\Curacao
Size 246B
SHA256 8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497
MD5 adf95d436701b9774205f9315ec6e4a4
SHA1 fcf8be5296496a5dd3a7a97ed331b0bb5c861450
SHA512 f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348
TLSH
T130D0120ABB5185A8E2A273B107F303C7899CC1444C20EA2EE607326224A48B03AB4C80
MD5 SHA1 SHA512 TLSH

Submit Download

Toronto

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\America\Toronto
Size 3KB
SHA256 a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f
MD5 8dabdbbb4e33dcb0683c8a2db78fedc4
SHA1 a6d038ecff7126ee19ebb08a40d157c9a79964cd
SHA512 35bfd5182535f5257d7ee693eb6827751993915129d7f3cc276783926b1f4db7a00d8f0b44a95ac80c294a9cc1b84bda6418134c2a5c10ba6c89946bd8ef97a3
TLSH
T11C71E6A8A94D74EFDF0112BE1461D03DCB806147872756C6D79807402678F6EC9A9EA7
MD5 SHA1 SHA512 TLSH

Submit Download

EST

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\EST
Size 182B
SHA256 91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0
MD5 0972a9c4c28bf71eeab5f0bac573cdbc
SHA1 a94fbc2d567e41723f03629b6c9a864260108a17
SHA512 ece548f7d840a588523aacddc93891e0dd300390f79de063e60074e00a92ae33a8201642b841ff868387f1ac2188c485cce941d83c7a3617d27ac286dbcc0c17
TLSH
T111C09B589B9D1B26C56136F96E820054DC541745927312B3684D17295058AE76220543
MD5 SHA1 SHA512 TLSH

Submit Download

Greenwich

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Etc\Greenwich
Size 114B
SHA256 6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d
MD5 9cd2aef183c064f630dfcf6018551374
SHA1 2a8483df5c2809f1dfe0c595102c474874338379
SHA512 dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92
MD5 SHA1 SHA512

Submit Download

London

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Europe\London
Size 3KB
SHA256 c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4
MD5 a40006ee580ef0a4b6a7b925fee2e11f
SHA1 1beba7108ea93c7111dabc9d7f4e4bfdea383992
SHA512 316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e
TLSH
T1AD71D8C75455851DC0EC2A7B7CB3424A5A44568D83BE4262F4EEA3C8D2FB7D45E1D9C0
MD5 SHA1 SHA512 TLSH

Submit Download

Oslo

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Europe\Oslo
Size 2KB
SHA256 5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701
MD5 7db6c3e5031eaf69e6d1e5583ab2e870
SHA1 918341ad71f9d3acd28997326e42d5b00fba41e0
SHA512 688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe
TLSH
T1C241845104628756D14C38F259717CCB0B1D2A59087C6BAF39AAA34527F4DD83F193D4
MD5 SHA1 SHA512 TLSH

Submit Download

Skopje

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Europe\Skopje
Size 1KB
SHA256 3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a
MD5 6213fc0a706f93af6ff6a831fecbc095
SHA1 961a2223fd1573ab344930109fbd905336175c5f
SHA512 8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327
TLSH
T18E419591043007D6E10C19F38872688F4A61564DAF5F4F6B1C967A4D16BC5E45F0E2B4
MD5 SHA1 SHA512 TLSH

Submit Download

MET

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\MET
Size 2KB
SHA256 812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0
MD5 355f0d3e2a3ee15ea78526f5eeb0cf7d
SHA1 d90f3247c4716c2e1068d5ad9c88ca2091bec4e8
SHA512 96a5fa48a15167e55ffad5b0241c90caeb7f0433ad62dd43463a4c52c25c59f7357681cb586fc52e812e8173adc12cec9eff66d27d5f41e19d55f6c1fce12937
TLSH
T1575193D6542146ADC42C27FE38A07C86070D6988D4ED52EAF82C1695ADB47E47E066E3
MD5 SHA1 SHA512 TLSH

Submit Download

PRC

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\PRC
Size 561B
SHA256 64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6
MD5 09dd479d2f22832ce98c27c4db7ab97c
SHA1 79360e38e040eaa15b6e880296c1d1531f537b6f
SHA512 f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200
TLSH
T115F05C4C50A84EC7C37CB7F9365B94968B40A5C38F13159F11465A0DA03AFF508181F4
MD5 SHA1 SHA512 TLSH

Submit Download

Wake

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Pacific\Wake
Size 152B
SHA256 53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7
MD5 5bdd7374e21e3df324a5b3d178179715
SHA1 244ed7d52bc39d915e1f860727ecfe3f4b1ae121
SHA512 9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383
TLSH
T169C002C0B71818D3C415577D059B17545D57D5414D035777328A14CDED9479157188D0
MD5 SHA1 SHA512 TLSH

Submit Download

Yap

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\Pacific\Yap
Size 172B
SHA256 9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0
MD5 ec972f59902432836f93737f75c5116f
SHA1 331542d6faf6ab15ffd364d57fbaa62629b52b94
SHA512 e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d
TLSH
T10EC0928152BB0C0BC63012B40A8B47A3ED99954191062BEB210803D9F0B9B8126014CB
MD5 SHA1 SHA512 TLSH

Submit Download

UCT

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\UCT
Size 114B
SHA256 8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2
MD5 38bb24ba4d742dd6f50c1cba29cd966a
SHA1 d0b8991654116e9395714102c41d858c1454b3bd
SHA512 194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac
MD5 SHA1 SHA512

Submit Download

Mountain

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pytz\zoneinfo\US\Mountain
Size 2KB
SHA256 32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9
MD5 648f67a7744849f2ca07f4d5871e9021
SHA1 faa7d6cf4178d032d8ba8a4d77eac0fd47f8a718
SHA512 3dab6d6a04a4856cba78ef499f1a436f1f71b1dea494ee098b76c1702531108ae0a1d7b6de05e9d9315027624b790e084d69b25507738099f6026cd2a9559f31
TLSH
T10F51C4EC80D2B579FB0D703C4867E4500C5804995BAD8D5E25BABA385EB8BBA31B45E8
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\select.pyd
Size 32KB
SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
MD5 6b181cf903a5903f9d8d711a731578d3
SHA1 0f2958ec2e4beb41dfedc912a6c635aeccddeba3
SHA512 c45f0f99bbbfc3d84a5e5782deb4440f6033e46e169209b60cbaf97ccd3c57baa5ee480aaf5239c75e0f2821c66d72a7ad973adcb69ee5666e5e145bd36e3920
SSDEEP 768:UB7YgHfWVHrF8ISRGqxycTOJh2Ip4JTxf1mlIJGp2:UB71/WVHrF8ISRGCycA897fIkGY
TLSH
T126E27DCA6B745047E9A2C631C5A2DF83F939B7A35721868F31B5919A0E233C1B336358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\torch\_functorch\_aot_autograd\__init__.py
Size 211B
SHA256 2503152d1a0508aa3adbd290ff5beee22d74466930c3c1163326670cb1065da8
MD5 052b9d2e09396eb0697c050c8bf41139
SHA1 16049b3ca4f50c398196d268535e6157a534a7c8
SHA512 9f85a48ae69d89509e13c99a65143749c85c5fafe055a1af77810cb29638c0e3fa1356d3b5d69b97c732bbd35c61e74a894cd43f61d0df051947397410e0f5ad
TLSH
T137D0223E238CA2330230C413630EA2CEAB0C2894A33F306BA9248308223283E43A4C90
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\torch\ao\nn\quantizable\__init__.py
Size 38B
SHA256 b04fb4aaf5e74d8e629432aec768d9ba4371ce4791f86da6941a79b2cd9be329
MD5 54a7946252f28e14598915be3050508e
SHA1 8c456681871f607004826b8b1fc9588aba0bc337
SHA512 01e264aa91128e202dd2505e5b55f359c1082056b41ce2c85470b368b14475db7b3fea3391a0aeda56dcc218489de8a33fd0a36cca4507399fc8ae7978e0c792
MD5 SHA1 SHA512

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\unicodedata.pyd
Size 740KB
SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
MD5 d421eab157a93fd255554dc2d31b7a3a
SHA1 f6f8a395fe2f805299867022d1c8067eae636ea2
SHA512 9158db1315582cbc076e13360d764576f25f666996af07c377fff6170699f181702cb6e213f7d169a19fcc31a0dde9d4f19dd10038434c1a4cea4bb72a0a4b1d
SSDEEP 12288:lY0APtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtW0N:lYx5ZmDPqO5ElDJPTMWo
TLSH
T15CF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 09ffcf6cf209b0b5db60f4b0fcaec83345be7b9d1a856e369207e0125d2fa2ef
MD5 1c89fd18600b2b0ecf39fdbd12d92be3
SHA1 59787ee2ec9b00dae8283aa7757f441a475a17da
SHA512 bd5f066244491d02314499434186d36ccc489132fe2140efcb728c29948883699bbb6a686d5451c0f7e823a496ebb7bb728c9e0e7a17f587349bd0bb9a98e46c
TLSH
T187D0121273124A7CC42029774043A30A1401C64F400A41045868D55E5B1C0741A1A841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ec063d5ea42ad4a476be734962bf21bdc4f037ce9bf35fce1ae06c4855f4b803
MD5 5396e7342d4ac8058120896f3e3206a4
SHA1 cf79bcb0c9188754b49ded8bc607112998d732a1
SHA512 bb801c55f32b13b7f174852415dd63286469bf6ea93950a56a9d36797053d303d7130a2d1e23faffa12868b2351d7a5cfcd68be2177d46c8fd50cccbe976bf2c
TLSH
T102D00450D3114D4CD4105D7DC053C3031115CDC70007070404D0504D455C135111D404
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 e232bd1057c897809c4fb73c1789f86a5644b25c63aada8f20b3c6f871473922
MD5 f72b2eefac18fea0826138691e674fce
SHA1 c06a9dcc3381c695bed6809c0e1e5ae54be896d6
SHA512 e035b3a38812b33ac9667fa580e0e9d547d349c0177fdbd1103d0a94b754497180ff29dde062ebbdd5e75db3bb550754e8290ab8930fb3ea4d9cbe1c7b87112a
TLSH
T14BB0120C24ACC302F68CA234B0D240C033398BA5C703DAC2D6673F7A44213C89601004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a94b0.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a94b0.TMP
Size 48B
SHA256 5df482bd26d9944429ec363f0a7199399afe63f7af4e86b94d20b58247902c09
MD5 b214f4188bd9c17540b5aa65dda05861
SHA1 b72a4a33ca16b7dcb71610fef34dde456da922dd
SHA512 9554b6983fc95217a28320e44ec756fcd69fed5f17c101e5494f195f8785fc3580cb5cbd6183e2fbecde9aa91b5a0c4d9a4a3d68897e06d4ea520f5c3d6d8215
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 7ae8d037964da8894cfc1780ffdd35bf9435263ff99f487a7a40536199de02e5
MD5 f4e81be4fafcc4a4c4cdc74775f35304
SHA1 665bf1c46118f5cd5b2961c888281180f7f3416d
SHA512 b7e2312c81ab73f186518d34f303f201f4d9bb12cbf1bd6d206fec9e4fbdc644d8d68d4843c371eb5eeb74f222c962bc802475339a2833297f2caef4969dd54c
TLSH
T1FE11A3A5C2E4C67E8A5126E427343817C93E050592247D27CDEAFBD5ABD2071D22110B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b04b0.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\Network Persistent State~RFe5b04b0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 fbdcbd0eefb22a38168289669c5b40e3cc03f4104c8af26b566031e26e5a5ccf
MD5 16c076c46d4c6076c481102799c5fd98
SHA1 cb50c7303e81f759f093f6d8d69988a3821e20c2
SHA512 be16818838d6c7e0aa3d9a8cf4b4c8575792b368674d7cde2f528deff3fba77002c6d68298721a2a8d3f519d1c28d239b3df199f733909408e6f43b5420a3d18
TLSH
T13401DB6382BAA86B206C183B1E44BD1A7DBFF4351242DCE4E796912CF0914B76713412
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a6d13.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Network\TransportSecurity~RFe5a6d13.TMP
Size 355B
SHA256 d3a8a6acca1685d42947a993d20b396d0c0a64d2e7c57449ea7faea8ee717550
MD5 453af353eb513443a2e2dfcb54f39cba
SHA1 156b9754168561f506d2f666c417f75e3adfec8d
SHA512 670cd7be711ae1a26e28e0fcf70ebfe2c8bb1ca4ce648ae1d04cb9ef459b17d43ca381f4ee062758d6704225b7ef62ec3a7a266d9c17782051d288ad604a6211
TLSH
T178E026B2817AE83760BC1A2B1880BD056F7EB135024268E8EBA7422CE0A04F76613813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Preferences
Size 6KB
SHA256 f51c790d6ede5a4a3be5b68601543a82b89056f30b7f1a3c251d6f7418deae41
MD5 9cf731e00f1e92be8293c165ed14c418
SHA1 c43918e3a7b4f5d0881205a4f26af64f092d38c5
SHA512 9ca474408b29b2cb636de3c7f4fce2f6259247cefc29682b6a6725ec96de07166a7215af3f2acfde3e9e20ea96fe032b6becabf8248242c6e5fa7b448b67215a
SSDEEP 96:stP/dyaPLGFb9qk+Ro5h16Z04as7/x+6MhmuecJ4gEruljeNK+g6DNmOM28XM1CO:stXLTVonvsV+FdbQ2jv8D2G6K
TLSH
T1C4D1A6029E247D7B8CC7E119BA39BB13E2F9607261951E68E7F8551C08DB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Preferences
Size 6KB
SHA256 17badc6f00a32578e6bf9a72629438ac1fd5e459506425734594f4d274e717f8
MD5 7816275fb1c85e472f6c5b30e24c5f7d
SHA1 eb4470e992d7b1ba549c29a08d249bc67a4d60ac
SHA512 f34b27679d22df03aa0f5fa175d8988ccf2ceaf62514476524c243a91e0a8866f837ffa7d1d0c33efe66d4d11816749fa890e29f757e81a342f89efb5f5c468a
SSDEEP 96:stP/dyaPkFb9qk+Ro5h16Z04as7/x+6MhmuecJ4gEruljeNK+g6DN5228XM1C7K:stXLBVonvsV+FdbQ2jv8D6G6K
TLSH
T15FD1A6015E647D7B4CC7E109BA29BB13E2F9607261D51E68EBF8462C08DB6DC6307A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a6b2f.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Preferences~RFe5a6b2f.TMP
Size 6KB
SHA256 30fc2bf4eccba9b646699d99f7574b23a2ea86a52337425638afaaa00906f480
MD5 c6fe7a17a76ca9241b5e2ddd3080cd38
SHA1 80e08e47009c1a7b2fc256b9fff31de910b6f2b4
SHA512 4af6dce0fe04a4bb61fa0727e0bfdd04e96affe88f736e215d3a0589e1cffc1a49cfd03eb819e8755a20c899411635dd287844feb5bf487dd865f57c55a6e985
SSDEEP 96:stP/dyaPkFb9qk+Bo5h16Z04as7/x+6MhmuecJ4gEruljeNK+g6DNR28XM1C7K:stXLBNonvsV+FdbQ2jv8DXG6K
TLSH
T14FD1A7015E647D7B4CC7E109BA29BA13E2F9607271D51E68EBF8452C08DB6DC7307A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 15KB
SHA256 fcf1ffea68efc3889c5c448ca37720de7b2fc07a557a36f305f9589fe32dc9f6
MD5 db5c4ca51acb3e14f113b1a067671190
SHA1 e44e5be1f790b64b2e5832e0dc6c28b63296a2e7
SHA512 d65a5b7473fa76fc97461f2c378d9c79ab89f2b329d0cda085fb8647b2428a8af144011cb029d050021b99aa57af48d3fc5e49745e6f2ab4cd78ae0ab5d0a03b
SSDEEP 384:Q+aQikB+z/xvxjg/qhE0NBSZD71ORAVdprr9zw:v/UxvxjgC+FvURUXFw
TLSH
T1A4729E27947A3E33B5F3EA14791D178BCFB894B291C16EB84AAD5F0D06872D81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 2KB
SHA256 1a2a19b9ba535610ed026003c9457181989b8d4dcbf249c01b9b81643f9768ff
MD5 436f866bfcb9d87710b0bab32cd65189
SHA1 bee5c43b4d305db169bec1f9b8076b1828913f76
SHA512 dc01e6595e6f4f4d399bd4b60844d307713920983693b3c596f639d02f0646368f6ef9c3332ce4d7971d780377394c15be967a8b741518089e334ad546872b22
TLSH
T1E9517433A9556F37A9E34658790A3B22CE7A50AADB512F60ABDD0B1C018659C6306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 3KB
SHA256 c2aab77fef20d97f62d69ae4b0852af52e28a5908589394fd6c53fdff8fde42c
MD5 bffaed7fc75761a1f4be28b90c855bf2
SHA1 6015c56fde7ebfbd31850ca202cfd4e37459de53
SHA512 f29b4807852e3e25e9824a198889766d7d85597efc564f66a797a3fec3942710093402cd6b88f0a5b087c1ae049bd806035bda4fa2612dfcc6bb44a841c3a902
TLSH
T1BA61963399B5AA376DF38A54B8463716ABA5506BD6813FA4D7EC0F1D01C72C82302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State
Size 15KB
SHA256 8a5904ed4a26cc596df2560d72378eb4dd09a5c3b2972fb7a6f93932916d7476
MD5 558d2554ab9d4a8a1f7a4156752477c3
SHA1 5eab368247649a78f652224ed8a33cce24c475d2
SHA512 26ee7fa7a3c42d0909f6614435adbb2ef3ee3d2852bd5b34bd498a60c1425a5823c1b2acfaffc904a3b6c39a057f6256c3b5c6a31b6465ddca94a364684b1cf3
SSDEEP 384:Z+aQikB+z/xvxjg/qhEbNBSZD71ORAVdprr9zw:E/UxvxjgC+2vURUXFw
TLSH
T16D729E27957A3E33B5F3EA18791D178BCFB894B291C16EB84AAD5F0D06873D81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59ee8c.TMP

Path C:\Users\Admin\AppData\Local\com.hydra.macro\EBWebView\Local State~RFe59ee8c.TMP
Size 1KB
SHA256 ff5274034d52d07ee3d4eeee6aa914f8b4554c6036c2df90551b60f4a2a20c4b
MD5 03fc645718f71e3445777eea316c4ced
SHA1 7bbe8968b34b685578a5414b489b8ff88e5ba583
SHA512 5741e0f63505e15430ba899483152639af9ff7ca500a119a47eb250da6809d054c7b8c766280586025c57e6a34aa94e6a87017fbbf293a9e6711b028ae34884e
TLSH
T1DB2162B3C6A51F33BCD2569A710676865E2210BFC3408E50B7CE0B2D02921CCE22AD37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1580-27-0x00007FF923920000-0x00007FF923921000-memory.dmp

Download

memory/1580-1342-0x0000018FC2090000-0x0000018FC2138000-memory.dmp

Download

memory/3252-5069-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3252-5058-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3252-5060-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3252-5065-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3252-5067-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3252-5070-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3252-5068-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3252-5066-0x00000157970C0000-0x00000157970C1000-memory.dmp

Download

memory/3580-73-0x00007FF923920000-0x00007FF923921000-memory.dmp

Download

memory/4020-5007-0x00007FF923C30000-0x00007FF923C31000-memory.dmp

Download

memory/4020-5008-0x00007FF924A90000-0x00007FF924A91000-memory.dmp

Download

memory/5584-4911-0x00007FF90A070000-0x00007FF90A099000-memory.dmp

Download