9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hydra-installer.exe
Size 10.9MB
Sample260823-v9f74ayene
SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
MD5 22a7efa9705ee6fcc45c21e13d760f4e
SHA1 14b19bc1233ae1c35b80d91bfcb464c967fcd019
SHA512 bbcc1ebbca30c0157a54dae343516c0118c76b244b685c7f7874bd2e3fc96236019f7aee943cd08237e8fe93af1a7c2153c5ec77b5e13839a0d6a9e7995d389f
SSDEEP 98304:ptFsk/Tuu7zYj0aBzRr2WekYOjmkPJTY0d9A3lVVPuiGX4vvrf07GGovDy9VFce:ekD7A0a8Qjmkozftvm9Y
TLSH
T1FDB6D5216A5E99ACD15AC474824A476309713CEA0B37FBFF648573393E79BF41E38218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hydra-installer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_960282789\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_960282789\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_960282789\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1921741485\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_960282789\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_960282789\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_537205016\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_537205016\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_537205016\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_160855580\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1921741485\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1921741485\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1921741485\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1384	msedgewebview2.exe
1384	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
860	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5840	hydra-installer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 860	5840	hydra-installer.exe	89
PID 860 wrote to memory of 4080	860	msedgewebview2.exe	90
PID 860 wrote to memory of 3276	860	msedgewebview2.exe	91
PID 860 wrote to memory of 3276	860	msedgewebview2.exe	91
PID 860 wrote to memory of 3276	860	msedgewebview2.exe	91
PID 860 wrote to memory of 3276	860	msedgewebview2.exe	91
PID 860 wrote to memory of 980	860	msedgewebview2.exe	92
PID 860 wrote to memory of 4224	860	msedgewebview2.exe	93
PID 860 wrote to memory of 4224	860	msedgewebview2.exe	93
PID 860 wrote to memory of 4224	860	msedgewebview2.exe	93
PID 860 wrote to memory of 1052	860	msedgewebview2.exe	94
PID 860 wrote to memory of 1052	860	msedgewebview2.exe	94
PID 860 wrote to memory of 1052	860	msedgewebview2.exe	94
PID 860 wrote to memory of 1052	860	msedgewebview2.exe	94
PID 860 wrote to memory of 1052	860	msedgewebview2.exe	94
PID 860 wrote to memory of 4604	860	msedgewebview2.exe	98
PID 860 wrote to memory of 4604	860	msedgewebview2.exe	98
PID 860 wrote to memory of 4604	860	msedgewebview2.exe	98
PID 860 wrote to memory of 1464	860	msedgewebview2.exe	99
PID 860 wrote to memory of 1464	860	msedgewebview2.exe	99
PID 860 wrote to memory of 1464	860	msedgewebview2.exe	99
PID 860 wrote to memory of 1620	860	msedgewebview2.exe	100
PID 860 wrote to memory of 1620	860	msedgewebview2.exe	100
PID 860 wrote to memory of 1620	860	msedgewebview2.exe	100
PID 860 wrote to memory of 1384	860	msedgewebview2.exe	101
PID 860 wrote to memory of 3932	860	msedgewebview2.exe	102
PID 860 wrote to memory of 3932	860	msedgewebview2.exe	102
PID 860 wrote to memory of 3932	860	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\hydra-installer.exe
"C:\Users\Admin\AppData\Local\Temp\hydra-installer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5840.3244.15974877947337715950 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView /prefetch:4 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9cf355fd8,0x7ff9cf355fe4,0x7ff9cf355ff0
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4620 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4756 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1048 --field-trial-handle=1764,i,13871159152280679131,11992422592786576528,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5
    3⤵
    PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 da849724513fad4230666c9f03ed9d0b309170d3246423138f7982097b40e435
MD5 988750892d51b5d537d04b6fd7f47e52
SHA1 de84658bfb4b508f99b0f67889f590a3b50ba226
SHA512 ba49bbaa2aa59b655b3b1ab9fc3ce38f1f787a0a8c603847745fbeff3021159d621dce87d6797b722055fe0186b0bd49f13e645cc87b852b6f4afefff0153bdd
TLSH
T19DD0122332438134C0102533000271880401E11B41064140643DC61E9B442540E02442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 633219866b06a686b1d444d3858d233a8a1d62c079f1e60dc0432e9491ad3ab8
MD5 43a452e5db6980508cf33b0d9e28607b
SHA1 d3e6c016c42097cbafd9a9f247b8b0e5169c96eb
SHA512 a11d1c0296a9ea39f8b741cf78b44a03d5a6a9b28e8809e97f3033e8d6fe3beda53d670a58a49b5d8f5bee71d944aa9e08dab6456151083c710e8f797d2d76ed
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

04eab645-59a1-4e73-b831-54f57d863389.tmp

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\04eab645-59a1-4e73-b831-54f57d863389.tmp
Size 6KB
SHA256 9fd6d6c8488c7b28bbaff0d3a69549aa343ffa027f4010c404dd5762a41d9bfc
MD5 7734677722c09cf78bc963f4ee75cad3
SHA1 2e40fe4aec2a5c224d82a1f0bfc0d80584fc6651
SHA512 a4b3f95f2928c535b1a1f1f3954c6ddedd32b56e10bd1f39a03759f8f644c71d6d98af792d52255c7103b37b2e755598161b5ad2e4e4f8b520ed3a3cd6f83134
SSDEEP 96:stI/d25Dgb9ok/o5h16ZXvs7/x+6MhmuecdN45k6fjeNK+gD9Z28XM1C7K:stssTMoMvsV+FJS2KjvtG6K
TLSH
T191D1A7026E24797B4CC7F519FA25BA56E2F5903275D12E59EBF8462C04EA6CC230BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f9073ca344a742a87a4fcc7494d9db78b5c31339c076b3efb257123cc354dc09
MD5 1d90caa209b54d11e085ea828d98e327
SHA1 f2304b393c7574b7b71a024c6050d3b6c8aea89b
SHA512 9728bad135619617224db07d5009a30d8f657f902d4791190ac02fba0a4b6a7126f4506415cd8b3770b45412c358e3db9087e3af2f58512f569a6ade3c3ad8ae
TLSH
T118A00260659C4247C6404B7114D55A603F34C964422F174B94E62078AC657454902449
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59500a.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59500a.TMP
Size 48B
SHA256 35fab8d183f12d816617499395720ff309c8c647daccb0973b6b4f96e438def6
MD5 94cf4fe06a9e98636ea437224808bfd2
SHA1 942e2cf910bf89f2b23f1f526af11fc4e76d3eba
SHA512 163247f50508748ddea7e00e10008821a49c1716d21dc13496b81954ba229ddce7e653b5872f7f91f99766068f863e74e2d61be7bc8dd143a148ff138c2c94b1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 1af0d1c836819fe27039a085a0c10cf38bfe19ad005ede2b2c62ca968153f159
MD5 4f7d47756fd97083a1c010f4e9a0b51e
SHA1 05c03949d8f8cf5d8595919c0b142410952ad4ea
SHA512 a01bcc7aac2a001fc0a1f76610a661b105171722df3426c3d7b3b1ecf6e75e9675fc0d7caf1b4cf76a8d8a43bf787bab654fb7e181a6073f2a0e9489cc61ca96
TLSH
T1E93171B2C3E8CA7DCAA116F86E296927C91D0D14416D7D1AC4E9AB4FD3E1461D21054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a11e3.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\Network Persistent State~RFe5a11e3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Preferences
Size 6KB
SHA256 5a0aef1c57766e82fcafbe56ec36cc7a550c7ccf767975bab64b0fa442d1fa4c
MD5 9db439441dd21d172b3fa018afbe7e7e
SHA1 bfe3013f2274c523228910c9d4697251c2c4abba
SHA512 03269c3877917b70ca5429a289f13ff982bc22922c0856d0fe0118a6ee4aa0fe0512a7340fb655d7cb081d2a767398c098f14ebe6be0258776a5e4f4a7a90170
SSDEEP 96:stI/d25iGgb9ok/o5h16ZXvs7/x+6MhmuecdQiSg9jeNK+gDB528XM1C7K:stssRMoMvsV+FJQFqjvtG6K
TLSH
T121D1B8025E24787B8CC7F519FA25BB52D2F5A03265D11E58EBF8551C04EA5DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 2KB
SHA256 de76de2aaf84309e7cabe1f236fe25e24e9aee7b985b010db902139fb299b47c
MD5 6e8e9417300c04df41f116381e77dc69
SHA1 0d0ab9fcaba6e42fa26c49908cf8c804a47df95d
SHA512 471a67b2acfddfd554fa83d199871904733e14802909fe827c0180c9686054a23d77e2fb46ab54ff90f4acb3b1a1e862bbf7b1af614b64cb3a32723bf0a36924
TLSH
T1CE51B8337C119B3B86E39A59B94B7F53CE65D1A59B626F6099DC1B0C00E368C2306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 3KB
SHA256 5456e55075740288de894550f366ecbe46a509a9a6d55614c0124ea951e00f80
MD5 2891b6736435f7284bde0997092ba99a
SHA1 17d21b522ef988e4ee9e4f52f8672c90ffa53975
SHA512 16aa918828d20acda0c8b563dd4c6e5203bae80b8a887f19c2adee3b1fabb5f73c9b068353c0ddb4a2f4cf250ddc24f0e46ff9011068f170878b1d6b57402d42
TLSH
T1416185376825A93B4EE3EA09B9863B06A7959137E5917FA4D5EC1F0C01E73C82342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 15KB
SHA256 17cdb2cbfa6bdb87eaeb2ae5d6821f4b4fe7935e170b39c4bb48d8e4cc31b5cf
MD5 419a16e8f2974c5c679416d4cb5ccee7
SHA1 55390d4a6af67d37cc03558d21fbce61bba42c85
SHA512 97db05c0f9a0c798176ada6946d55b759e4a582d59ae4c764c086879c689124d2c1a5085ab2ac3ff7433970bf4cccb956e97cf1ad26fa9d44ca308e89432f340
SSDEEP 384:j+aQikB+z/xvxjg/qhE3NBSYPERDAVdprqk9zR:C/UxvxjgC+ZCDUrqkFR
TLSH
T1CA729E37582A2E7766F7FA19795D078BCBB8C4B250C16EB849EC6F0D02D72D81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58fd28.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State~RFe58fd28.TMP
Size 1KB
SHA256 ef008db8134851434de0e508ea714e9cedb9409f0df8d5c8d230bf7c3436e961
MD5 0e409def4fc3d0baf6d75a7dda04b5ed
SHA1 cc65d6aa548cc76bec39c73cb81b7e6bcd5bac89
SHA512 ce895f65520ca5df44b9e2bf211a33103836163e070928a6e53a10080077870db2eb0ef8f8b85ce04ca32e07284777c94d348a0711795729ae2fd8bc756268c8
TLSH
T1F32165B3E8265F775D82659A7157BB879E50917A82218F5460DC0B0C11F21CC963FC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1052-102-0x00007FF9F01B0000-0x00007FF9F01B1000-memory.dmp

Download

memory/1384-349-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/1384-347-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/1384-356-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/1384-358-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/1384-357-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/1384-355-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/1384-354-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/1384-353-0x000002234BDB0000-0x000002234BDB1000-memory.dmp

Download

memory/3276-26-0x00007FF9F01B0000-0x00007FF9F01B1000-memory.dmp

Download

memory/4604-254-0x00007FF9F1310000-0x00007FF9F1311000-memory.dmp

Download

memory/4604-255-0x00007FF9EFF80000-0x00007FF9EFF81000-memory.dmp

Download