1bd6cc7d1374fa0fe03a4ef1894a99a2384e31f3544d79521c8f8118809fe5ce

Analysis

user interaction
yes
max time kernel
126s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Water Executor.exe
Size 3.7MB
Sample260828-sms72ay1cs
SHA256 1bd6cc7d1374fa0fe03a4ef1894a99a2384e31f3544d79521c8f8118809fe5ce
MD5 03362f6701f5317d6dc6136a5d2c356a
SHA1 e1e064ec05d4241e8b3aa027c29946498c8eddec
SHA512 00736d27976cd08d94adf0322cca66d5a71df7790dcd662d3d9d82191a4d08c23cc364ca7cfc262733919843f389696273e7d97eec7ab9e99c01619cbe470311
SSDEEP 98304:why0czMAyuEFhAB26lj+6J8pWD3wAfi5u9OdGws:Ky0QMAPbfly88pWDgAfs0+Gw
TLSH
T1FA06335A2702E008EEC1CC3944225D548F4ABA6A033D53EBD1683BA958F9DB7F7371B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4180	hydra-installer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hydra-installer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Water Executor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Water Executor.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324037133206426"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	msedgewebview2.exe
2648	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1692	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4180	hydra-installer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4180	3620	Water Executor.exe	83
PID 4180 wrote to memory of 1692	4180	hydra-installer.exe	84
PID 1692 wrote to memory of 3712	1692	msedgewebview2.exe	85
PID 1692 wrote to memory of 3332	1692	msedgewebview2.exe	86
PID 1692 wrote to memory of 3332	1692	msedgewebview2.exe	86
PID 1692 wrote to memory of 3332	1692	msedgewebview2.exe	86
PID 1692 wrote to memory of 3388	1692	msedgewebview2.exe	87
PID 1692 wrote to memory of 564	1692	msedgewebview2.exe	88
PID 1692 wrote to memory of 564	1692	msedgewebview2.exe	88
PID 1692 wrote to memory of 1408	1692	msedgewebview2.exe	89
PID 1692 wrote to memory of 1408	1692	msedgewebview2.exe	89
PID 1692 wrote to memory of 1408	1692	msedgewebview2.exe	89
PID 1692 wrote to memory of 2648	1692	msedgewebview2.exe	113

C:\Users\Admin\AppData\Local\Temp\Water Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Water Executor.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\0197FD7B\hydra-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\0197FD7B\hydra-installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4180.4748.9815607535250783112
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0xe0,0x16c,0x7ffe7180b078,0x7ffe7180b084,0x7ffe7180b090
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,8031649518291610749,13905173293766084716,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,8031649518291610749,13905173293766084716,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,8031649518291610749,13905173293766084716,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3580,i,8031649518291610749,13905173293766084716,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2088,i,8031649518291610749,13905173293766084716,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hydra-installer.exe

Path C:\Users\Admin\AppData\Local\Temp\0197FD7B\hydra-installer.exe
Size 10.9MB
SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
MD5 22a7efa9705ee6fcc45c21e13d760f4e
SHA1 14b19bc1233ae1c35b80d91bfcb464c967fcd019
SHA512 bbcc1ebbca30c0157a54dae343516c0118c76b244b685c7f7874bd2e3fc96236019f7aee943cd08237e8fe93af1a7c2153c5ec77b5e13839a0d6a9e7995d389f
SSDEEP 98304:ptFsk/Tuu7zYj0aBzRr2WekYOjmkPJTY0d9A3lVVPuiGX4vvrf07GGovDy9VFce:ekD7A0a8Qjmkozftvm9Y
TLSH
T1FDB6D5216A5E99ACD15AC474824A476309713CEA0B37FBFF648573393E79BF41E38218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b30fa015975bc1c4b82afc143f798f72ad37d758e2b8b5a45cee01fb1c1ae274
MD5 c3d75c15ce9b77ddae0dd0de7aa099f9
SHA1 577950614bb245ad4bab6adf1d2750e877794d73
SHA512 0ff5279a517072715e6e24e0486d354eaba68fd030d58ab5f10fa10f6f1f939f25c852113e192e5664a44edf65daf7648a0145c3ade71ad48b4642726608988d
TLSH
T1A2D0123232010574C0142073014665083400C10B628740015C2C871D2A044940903462
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 38eaaf98312884deca969db82fb9602e18837c6c5b452c44bb51c804f9743102
MD5 0032465a6dfda9185dd79fd845f5b077
SHA1 82cc97d68f920e6719b82797aec1f1acc740a179
SHA512 41ef577d817579f3718d4133edfe22fa3d6abdf11079498b619f5aab0e2842faf5eeae5c48ff94a18620ed477b0b3daeacbdcef9dac2413a6300f9c647fff4ac
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 264c8e7e9404ab6445b6c0dd1ed69c7588f5509c5dabc18a99bd67349677d4d9
MD5 71e1db20819a40f0edec563f1070a58b
SHA1 d9e1527e76803b74a357108f55b0274f0146796f
SHA512 c3b990f1e8341923ec533972803668d5de41526eddb83105e00d987dea2f10f05e6a8a6187ea3856645316f209265cd4f6cce9c9485940a4c75045b1417cf90d
TLSH
T171A0025111AC0842C1705BB164D383DC32388D2813171A6764B840758C503514715580
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 483a56da9e5ab0813ba2e861a761bdb3bac511e516a7d81502a6a9bde242f0cf
MD5 7d41ceaa841ab34cbcc9c35a5768d91a
SHA1 ba859fca84af46294758fc2adde94ad6313ff093
SHA512 5aa1a56d6102c4742c55c81fab5a5e9e0232667221503f2d7092461275867d1dfef3dde182d9065a629a0191e49ec25d77ce46c54fd222135e5960d4fdb27a56
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 8e5ddd70e2096ec4605ee44b05e858854efab033af747754178b4c0d063ef2d3
MD5 958cffcb3a1d40fb5f164748c17d80c9
SHA1 8ad595bff8dd3d73d3fbd374f3539233a2b6732d
SHA512 79181d0a9f0e4dba9282f54a51b75c1e80173868f673d6f84ac91296fe85a78be6d5a38e2d0d345ff409aaee88acd833f28ded9b1f4ec2874e08e321f2586db3
TLSH
T1B031A0B2C3E8CA7D89E517F86E39B927CD1D0D1441793E1AC8D5AF8B93E2461D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59388b.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\Network Persistent State~RFe59388b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Preferences
Size 6KB
SHA256 eb7ae3c42b70aff566c2f3581db8ba40ebf66fe2a95437c8576dbccb90926c40
MD5 728f206095e9fa63b69c385cdeee5a31
SHA1 f36984a6e17357ff3bdae2ab245da7b56ff0a095
SHA512 89f4dce3771bccbf09729f658778845a4c7cbd9708ce01ebd58d89e10308310e79a63d3f86fd5258dc1fe0edd32d77a330a9e07928c1e434ed66228794559140
SSDEEP 96:stj05wmxdb9tmffBEZ8i0vhEPkK4m/7qx+WVHMSm+uecd0y6FYOQjxI+g5Y2MOB:stj0OKmfyZ8pa1x/S+Wiv0y2YODjY2MC
TLSH
T14BE1C8025F6879B74CCBE749B925BB16E2F7506265D00E94EBFC862C05E75CE520B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58be98.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Preferences~RFe58be98.TMP
Size 6KB
SHA256 803f4a4784eae7421cef1b33c28fba327c7eaf8a44ab2b3253be6e42f5bfcbf1
MD5 9d59f64f7f5487896df278fbe9722e46
SHA1 a9523cef2b0c35c15a320e22ac8a57d2b5396da3
SHA512 479fa5a58821101490dd89fee819238985ff43b70067a9afb1c34fd492a91969dfe534e538c53b4cd7e2bde26fb6620331abf2bbf2dcfeec9312c5d7d2a30839
SSDEEP 96:stj05wmxdb9rmffBEZ8i0vhEPkK4m/7qx+WVHMSm+uecdF11iYOQjxI+gE2MEB:stj0OsmfyZ8pa1x/S+WivF1wYODS2M8
TLSH
T190D1A8025F6879B74CCBE759B935BB16D2FA102265D40E94EBFC852C09E75CE530B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 1KB
SHA256 f7e544f974425ca6391668ec2db2936adb4da39b000d2197feb5ef937e4d1d5b
MD5 665a6194bbc36f3729e3bd1f5dc6bc6f
SHA1 98976b9905e084de835da5be85874655945c06c9
SHA512 d36be909d8385eaf5673cd3de13f840a0cd4f2b801c1986009c72c912879c3b10592761d8c6ddeb97f94a5851814757f794c9b11b430f86722c5cb93e6476b83
TLSH
T10B31B57395D46A736D82BAC9B1467F4B8E60523AC1009F4861EE072C02F729D576AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 2KB
SHA256 0ba184428ff0c53ccb0dc79b3d65b5425023850fb029a6d6d3589b0f44a881ed
MD5 207196a2dd813fa9804d2f2206c0c8f7
SHA1 dc3f71ab949e31be6f90b97dd4039811b88e3242
SHA512 1602881a069c8362b9d7ed5f671547cec6e238f09378c193236e73639e52c22efb00adea8b083371cab5d028876cba75283dba9abab2572bc4bfc75a5f8177d1
TLSH
T1415108336888E67389E39AC8F94A3F03CA369265C6513F5055DD0B1C01FB25D2306C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 3KB
SHA256 019ca0bda12e16c93775b512722e27fadb60b608fa0171cf5600b25de27dc9bc
MD5 0552571b67bb90623c39d64d1f8cc159
SHA1 a876516577330a8165b9c02fc674e87e66e8b14d
SHA512 962cc6b9cc23ea9417097d1a9d5c883ed67ce3c47c998a83ae72f13943bcee378c4d27130924fb214380b3093d767751b304ba986315dd1fa7f558ac5f37558c
TLSH
T10371B62269A8E5374DE2EA84F8863F07E6A55237D1903F98D9ED0F1C02E73991342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State
Size 16KB
SHA256 6128fa3f4c333af89ead1001e6e39e920a104162998104443d425cc7d9648097
MD5 2543e6182c67d0e20b42e304ca6046f0
SHA1 05cab2bc68a58d566795bfaf0313ac7511e1cf0d
SHA512 adc87a03d998659f14b3382f86463a98248767ae390e2a07b16ed51f5ff9ff0f87a57fa9d13e7ee74c17a98b9c891e9b9d18ececc7f46b7b564c1cc5b6a05363
SSDEEP 384:z3+aQikB+z/xvxjg/qhERNbL4/+gfGgcf9z8:S/UxvxjgC+dgeXfF8
TLSH
T1D3729F3755787E2758F2FA48B9490B4BCBB5857280C12FA84AED1F0D069B3A50306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe581fd7.TMP

Path C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Local State~RFe581fd7.TMP
Size 1KB
SHA256 7d4beafeca23e39bf45b5bc1d0e889b62441a4ef5a2e722f830d07191be52dc0
MD5 273daaaa88a158b9cb2baad06e217760
SHA1 d7960cf76eda0eacc2016932c189229e3f4b9e2b
SHA512 e78b94c81cf98a9b2d82105541c531cd9a2160d9c563c96985283af0912f53e7487d04b2ec1b4d4889a33e606ab96dc124843e73ac260cc3e46cc1ab7dfd27a8
TLSH
T1A9216573C4C866737D45A9D9F142BF4B5D60927AD1009F0861DE032D02E729D576BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-68-0x00007FFE8C310000-0x00007FFE8C311000-memory.dmp

Download

memory/564-73-0x00007FFE8C9E0000-0x00007FFE8C9E1000-memory.dmp

Download

memory/1408-128-0x00007FFE8BF30000-0x00007FFE8BF31000-memory.dmp

Download

memory/2648-308-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-307-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-309-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-317-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-319-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-318-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-316-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-314-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-315-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/2648-313-0x000001CB2C480000-0x000001CB2C481000-memory.dmp

Download

memory/3332-30-0x00007FFE8BF30000-0x00007FFE8BF31000-memory.dmp

Download

memory/3620-0-0x000001DB47800000-0x000001DB4791C000-memory.dmp

Download