a958590ad4a3505caf86fa8f473dc4ff11081d8b03b0cf850efece9e00a9dd96

Analysis

user interaction
yes
max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vortex/Bootstrapper.exe
Size 3.5MB
Sample260509-zppqysds91
SHA256 a958590ad4a3505caf86fa8f473dc4ff11081d8b03b0cf850efece9e00a9dd96
MD5 a5b2b44bee8533b903877fbf5538f3d6
SHA1 b8d1b2c836358215fdd0da611e042de1dde11751
SHA512 5eea50aec1b09a542ed611e39e8425ff78de92d47962438ad7ec9649ae5d650d4bb663107d6d1b2de73196ec2667072f4ed98cdefb5a94f2086dc3255237ebe0
SSDEEP 98304:q1ojI+B7crZMj0IBP4WNiKvhMGIYqopMfcf9ho:rMSmqjbP4HKvMxcf
TLSH
T1C50633D6CBC25E55C3FE637309BAA98F4EC9565EC658464CA81948EF02431F0DE17F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Bootstrapper.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
8	1916	Bootstrapper.exe
8	1916	Bootstrapper.exe
8	1916	Bootstrapper.exe
8	1916	Bootstrapper.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Bootstrapper.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Executes dropped EXE 1 IoCs

pid	Process
2896	Vortex.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1916-0-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral1/memory/1916-1-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral1/memory/1916-2-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral1/memory/1916-6-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral1/memory/1916-9-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral1/memory/1916-21-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral1/files/0x000700000002430e-284.dat	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Vortex.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
71	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
49	raw.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
70	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1916	Bootstrapper.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4280_1961210403\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4280_1961210403\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4280_1961210403\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4964	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228336630142339"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{BCD66CA3-DBE0-4079-9EC8-533956D93431}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1916	Bootstrapper.exe
1916	Bootstrapper.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4280	msedgewebview2.exe
4280	msedgewebview2.exe
4280	msedgewebview2.exe
4280	msedgewebview2.exe
4280	msedgewebview2.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeIncreaseQuotaPrivilege	4964	powershell.exe
Token: SeSecurityPrivilege	4964	powershell.exe
Token: SeTakeOwnershipPrivilege	4964	powershell.exe
Token: SeLoadDriverPrivilege	4964	powershell.exe
Token: SeSystemProfilePrivilege	4964	powershell.exe
Token: SeSystemtimePrivilege	4964	powershell.exe
Token: SeProfSingleProcessPrivilege	4964	powershell.exe
Token: SeIncBasePriorityPrivilege	4964	powershell.exe
Token: SeCreatePagefilePrivilege	4964	powershell.exe
Token: SeBackupPrivilege	4964	powershell.exe
Token: SeRestorePrivilege	4964	powershell.exe
Token: SeShutdownPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeSystemEnvironmentPrivilege	4964	powershell.exe
Token: SeRemoteShutdownPrivilege	4964	powershell.exe
Token: SeUndockPrivilege	4964	powershell.exe
Token: SeManageVolumePrivilege	4964	powershell.exe
Token: 33	4964	powershell.exe
Token: 34	4964	powershell.exe
Token: 35	4964	powershell.exe
Token: 36	4964	powershell.exe
Token: SeIncreaseQuotaPrivilege	4964	powershell.exe
Token: SeSecurityPrivilege	4964	powershell.exe
Token: SeTakeOwnershipPrivilege	4964	powershell.exe
Token: SeLoadDriverPrivilege	4964	powershell.exe
Token: SeSystemProfilePrivilege	4964	powershell.exe
Token: SeSystemtimePrivilege	4964	powershell.exe
Token: SeProfSingleProcessPrivilege	4964	powershell.exe
Token: SeIncBasePriorityPrivilege	4964	powershell.exe
Token: SeCreatePagefilePrivilege	4964	powershell.exe
Token: SeBackupPrivilege	4964	powershell.exe
Token: SeRestorePrivilege	4964	powershell.exe
Token: SeShutdownPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeSystemEnvironmentPrivilege	4964	powershell.exe
Token: SeRemoteShutdownPrivilege	4964	powershell.exe
Token: SeUndockPrivilege	4964	powershell.exe
Token: SeManageVolumePrivilege	4964	powershell.exe
Token: 33	4964	powershell.exe
Token: 34	4964	powershell.exe
Token: 35	4964	powershell.exe
Token: 36	4964	powershell.exe
Token: SeIncreaseQuotaPrivilege	4964	powershell.exe
Token: SeSecurityPrivilege	4964	powershell.exe
Token: SeTakeOwnershipPrivilege	4964	powershell.exe
Token: SeLoadDriverPrivilege	4964	powershell.exe
Token: SeSystemProfilePrivilege	4964	powershell.exe
Token: SeSystemtimePrivilege	4964	powershell.exe
Token: SeProfSingleProcessPrivilege	4964	powershell.exe
Token: SeIncBasePriorityPrivilege	4964	powershell.exe
Token: SeCreatePagefilePrivilege	4964	powershell.exe
Token: SeBackupPrivilege	4964	powershell.exe
Token: SeRestorePrivilege	4964	powershell.exe
Token: SeShutdownPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeSystemEnvironmentPrivilege	4964	powershell.exe
Token: SeRemoteShutdownPrivilege	4964	powershell.exe
Token: SeUndockPrivilege	4964	powershell.exe
Token: SeManageVolumePrivilege	4964	powershell.exe
Token: 33	4964	powershell.exe
Token: 34	4964	powershell.exe
Token: 35	4964	powershell.exe
Token: 36	4964	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2896	Vortex.exe
2896	Vortex.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2896	1916	Bootstrapper.exe	90
PID 2896 wrote to memory of 4280	2896	Vortex.exe	93
PID 4280 wrote to memory of 3920	4280	msedgewebview2.exe	94
PID 4280 wrote to memory of 3884	4280	msedgewebview2.exe	95
PID 4280 wrote to memory of 3884	4280	msedgewebview2.exe	95
PID 4280 wrote to memory of 3884	4280	msedgewebview2.exe	95
PID 4280 wrote to memory of 5076	4280	msedgewebview2.exe	96
PID 4280 wrote to memory of 412	4280	msedgewebview2.exe	97
PID 4280 wrote to memory of 412	4280	msedgewebview2.exe	97
PID 4280 wrote to memory of 2140	4280	msedgewebview2.exe	98
PID 4280 wrote to memory of 2140	4280	msedgewebview2.exe	98
PID 4280 wrote to memory of 2140	4280	msedgewebview2.exe	98
PID 2896 wrote to memory of 764	2896	Vortex.exe	99
PID 2896 wrote to memory of 4964	2896	Vortex.exe	101
PID 4280 wrote to memory of 4128	4280	msedgewebview2.exe	106
PID 4280 wrote to memory of 4128	4280	msedgewebview2.exe	106
PID 4280 wrote to memory of 4128	4280	msedgewebview2.exe	106
PID 4280 wrote to memory of 3824	4280	msedgewebview2.exe	108
PID 4280 wrote to memory of 3824	4280	msedgewebview2.exe	108
PID 4280 wrote to memory of 3824	4280	msedgewebview2.exe	108
PID 4280 wrote to memory of 2656	4280	msedgewebview2.exe	109
PID 4280 wrote to memory of 2656	4280	msedgewebview2.exe	109
PID 4280 wrote to memory of 2656	4280	msedgewebview2.exe	109
PID 4280 wrote to memory of 892	4280	msedgewebview2.exe	110
PID 4280 wrote to memory of 892	4280	msedgewebview2.exe	110
PID 4280 wrote to memory of 892	4280	msedgewebview2.exe	110
PID 2896 wrote to memory of 3272	2896	Vortex.exe	111
PID 3272 wrote to memory of 972	3272	cmd.exe	113
PID 972 wrote to memory of 4820	972	msedge.exe	115
PID 4820 wrote to memory of 4112	4820	msedge.exe	116
PID 4820 wrote to memory of 4732	4820	msedge.exe	117
PID 4820 wrote to memory of 2796	4820	msedge.exe	118
PID 4820 wrote to memory of 1020	4820	msedge.exe	119
PID 4820 wrote to memory of 2796	4820	msedge.exe	118
PID 4820 wrote to memory of 2796	4820	msedge.exe	118
PID 4820 wrote to memory of 1020	4820	msedge.exe	119
PID 4820 wrote to memory of 3156	4820	msedge.exe	120
PID 4820 wrote to memory of 1640	4820	msedge.exe	121
PID 4820 wrote to memory of 3156	4820	msedge.exe	120
PID 4820 wrote to memory of 3156	4820	msedge.exe	120
PID 4820 wrote to memory of 1640	4820	msedge.exe	121
PID 4820 wrote to memory of 1640	4820	msedge.exe	121
PID 4820 wrote to memory of 4372	4820	msedge.exe	122
PID 4820 wrote to memory of 4800	4820	msedge.exe	123
PID 4820 wrote to memory of 4372	4820	msedge.exe	122
PID 4820 wrote to memory of 4372	4820	msedge.exe	122
PID 4820 wrote to memory of 4800	4820	msedge.exe	123
PID 4820 wrote to memory of 4800	4820	msedge.exe	123
PID 4820 wrote to memory of 5268	4820	msedge.exe	127
PID 4820 wrote to memory of 5268	4820	msedge.exe	127
PID 4820 wrote to memory of 5504	4820	msedge.exe	129
PID 4820 wrote to memory of 5504	4820	msedge.exe	129
PID 4820 wrote to memory of 5756	4820	msedge.exe	130
PID 4820 wrote to memory of 5764	4820	msedge.exe	131
PID 4820 wrote to memory of 5756	4820	msedge.exe	130
PID 4820 wrote to memory of 5764	4820	msedge.exe	131
PID 4820 wrote to memory of 5980	4820	msedge.exe	133
PID 4820 wrote to memory of 5324	4820	msedge.exe	134
PID 4820 wrote to memory of 5324	4820	msedge.exe	134
PID 4820 wrote to memory of 5808	4820	msedge.exe	135
PID 4820 wrote to memory of 5808	4820	msedge.exe	135
PID 4820 wrote to memory of 6092	4820	msedge.exe	136
PID 4820 wrote to memory of 6112	4820	msedge.exe	137
PID 4820 wrote to memory of 6092	4820	msedge.exe	136

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
764	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Vortex\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Vortex\Bootstrapper.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
  "C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2896.2032.355913698317234655
    3⤵
    - Drops file in Program Files directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x84,0x7ff9c520b078,0x7ff9c520b084,0x7ff9c520b090
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
      4⤵
      PID:412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4424,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5144,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4760,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4432,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
      4⤵
      PID:892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4532,i,17277065677941731652,351088223738867032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
      4⤵
      PID:4796
- - C:\Windows\system32\attrib.exe
    "attrib" +h +s C:\Users\Admin\AppData\Roaming\Madium\AutoExecute\!!!!!!!!!!!!.txt
    3⤵
    - Views/modifies file attributes
    PID:764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command " $cpu = (Get-CimInstance Win32_Processor).ProcessorId $bios = (Get-CimInstance Win32_BIOS).SerialNumber $board = (Get-CimInstance Win32_BaseBoard).SerialNumber $disk = (Get-CimInstance Win32_PhysicalMedia | Select-Object -First 1).SerialNumber \"$cpu|$bios|$board|$disk\" "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- - C:\Windows\system32\cmd.exe
    "cmd" /c start "" "https://vuotnhanh.com/FzsO"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vuotnhanh.com/FzsO
      4⤵
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://vuotnhanh.com/FzsO
        5⤵
        Checks SCSI registry key(s)
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff9c111c188,0x7ff9c111c194,0x7ff9c111c1a0
        6⤵
        
        PID:4112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5327229300953760818,4441921788727258473,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,12336377065681924032,13053269602399589553,262144 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:2
        6⤵
        
        PID:2796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,4395231298354418649,234360210417482033,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
        6⤵
        
        PID:1020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3106901809537530092,6153394004732682578,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        6⤵
        
        PID:3156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4107681283260267445,3089638750326791205,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        6⤵
        
        PID:1640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,2167840859734515816,9066284769927413864,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
        6⤵
        
        PID:4372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,17169110747668766922,10097229585587713878,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
        6⤵
        
        PID:4800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,13991033171272622148,4830834742350571633,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
        6⤵
        
        PID:5268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,10031328944684712768,9420261930162199075,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
        6⤵
        
        PID:5504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,122680095524816035,7876927799212740510,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
        6⤵
        
        PID:5756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,6727323753564503140,13881722270794396244,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
        6⤵
        
        PID:5764
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7575253931573146673,3343914703487694403,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
        6⤵
        
        PID:5964
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7575253931573146673,3343914703487694403,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
        6⤵
        
        PID:5980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,15708240821300259162,11977030690122240144,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
        6⤵
        
        PID:5324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,5717975363307887493,1610039760458663900,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
        6⤵
        
        PID:5808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,5546144211734568505,10262050843934702485,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
        6⤵
        
        PID:6092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,7115627223525341215,14841140945128994783,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
        6⤵
        
        PID:6112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,146099807617800891,3123595218503373861,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
        6⤵
        
        PID:5860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6484,i,10116072783801240151,537244159691774,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        6⤵
        
        PID:6068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6364,i,10397307416333433873,9405192627118139242,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
        6⤵
        
        PID:5276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4328,i,2397753198759612319,11933339315307922529,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
        6⤵
        
        PID:5356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6340,i,15807045771827632053,5483461589306553411,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
        6⤵
        
        PID:5588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6916,i,10784531707077028447,15260376073316955595,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
        6⤵
        
        PID:5260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6312,i,6144660906338386623,1978472546411233736,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
        6⤵
        
        PID:5676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7032,i,897419326729909481,393756453142382404,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
        6⤵
        
        PID:5852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7068,i,3504436624466504,7709815784670896430,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
        6⤵
        
        PID:6132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4820,i,15638448352113355758,5377584617517169288,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
        6⤵
        
        PID:5732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6840,i,5242250811152008041,9838684210365023804,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
        6⤵
        
        PID:6044
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4328,i,4414293024276531983,11033833432837763927,2097152 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
        6⤵
        
        PID:5260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,2305258553568505590,16311768037735926007,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
        6⤵
        
        PID:5932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4654636611276581586,15151306461050172959,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:8
        6⤵
        
        PID:5812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,9777566337521122749,13587319334318423008,524288 --field-trial-handle=2800,i,2426275687727106864,14625148832492744658,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:8
        6⤵
        
        PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4280_1961210403\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4280_1961210403\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
MD5 3c974a700ca35a09f8c2b49b1532d825
SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a68569752b554830bdaeb1e8a10446a2bf48a5c40d9055644b0ff7d12eb909e
MD5 619aee87184943036a7fd0a470ee34f3
SHA1 f2e0d05b802871a84b6abab52ce17fbe477f2644
SHA512 618e8ac028bfff63cbfb3dc8165970fe8da37fa98ba9c72a9b4a3b3eb9d922078cf4371b48f699b16e64d0205ac715cb0a1b9fccd6953e5bda90f6d945b76ad1
TLSH
T157D0805C53B1AC70C7CDC9B1585677453D1AC5629A4287252C732D7D0C435C174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 499f1baf84ccad9aec7e713f14831c28ec8ef6c26551e081f63481da9e10b787
MD5 0b7b7a3907c43b76a43eea92605bfc69
SHA1 b3d127433999df0affab0fc41fa6d73226ec079b
SHA512 67d637e6bb845665c58d6f0a256303841a077e8a03562447569857bb2f980056eb08233e2e8f7e3c0c468adc11695b7c60631f1f3f77f122b5344c0ccc3b2c7c
TLSH
T1D3D0805C9371AC70C7CDC9B1585777453D1AC5629A4247252C732D7D1C4258174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 224KB
SHA256 70f4aceef61937bc090cda8eb8f0e3cd161a61ec8298718a9d5ad7b9acedd0de
MD5 7c8848f056410a1edacd0d495b009767
SHA1 a7f4783488d54e90c19364673ec881af270e53ad
SHA512 11d1d2e2c425d99a9f61bc471d02c5595794f14eebf2dd278490a1abd074c5cb9e0e208c4fe07b791cb5b7b3f7cf5737038351b5345d6c9566e92e7f5f93e5e2
SSDEEP 6144:jlNd7kZYFWbwicBzhak4K89tLLvefXGZdeh0gJ:jljKYgbwTB9aRbnQWZdoRJ
TLSH
T1CB242387411BBE0997B3702BEA32327F476F55CDC8A612D31B56F4F9B92054AEE04B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1310d4717c39f0acb85f27fa8e93e759b0f9e2d7ebdc2e32a6fff9011750f67b
MD5 6e991e75ec74a74813fd2cd18ffed59c
SHA1 3dc5a4e94e97792c98bdbbad8a368f19cba6457a
SHA512 7bf82fd111d926d50625304dbeacdc9e5b7027385838cc0633eb40cc38f0ffec4a94b28629009f3316af0cc2507038ebd642e9033aee758e5fae346cc75f4a1a
SSDEEP 192:sxZBRf5yM//K1Ml8Miu/fQshRrG7YyAIdpq0SVHW6+WNrl2N/JIgH7W5HJd4Ig4J:sxZBHqu/fQshRqsyBsHbW/ONUc
TLSH
T1A462E852AA34597BCCDBD219F554BB67D6F5146292900E58AAFCCA0C01E6BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 209523b22705bc8dea1ad2498c02849a278dbc0b1412d74738bcc78d2d96e299
MD5 e80dcba63eb226f1169fa4ceaa6bc315
SHA1 a19ddde1465c4779586f2bd59c20dfeb31d590c7
SHA512 55b342ffa28ca38de209170246c8bed1827ca917b903f65599eba99bb6ec34e2f7d0b40cc3e5e7e3a7b6d3d57a6fc3f0eb414cb607ef3f5eeb69b65c6e460d36
SSDEEP 768:1h0G9pQ7pLuLnFJWvFnIP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/4k8LlSMdFGroC:1h0G9pcEnFJWvFnIPu1jau4k8LcEF9Vc
TLSH
T1C5F20B3B680CCB7E4F844E9CEC2ABE9E6DE8018B96DC895447F9444C03C66EF15165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ac5c67c69c3c79366dbf6c5277b232fe2ccc95e7f2fd20caececa6eefcbdbae2
MD5 f30e073d489885313d39e3339e89e31f
SHA1 15a764fffac5fe3530408022e8eca2aea8ff3c09
SHA512 5081fec8c704ea17639ee64b689b3b845be13f3816edf1f6c95c068249557eb9c50d4f5f98e85d49a50dd3259d6caa0911a934f3f9ecd6e2dcaf9f6cd4119008
SSDEEP 96:KkgAKtGKymoKXKxA5UQa2qgW+Lz44gKQ14SgEI47ygtug:SjPOdf
TLSH
T1C991581035774252393E698DA5A9A81F8A813563341CE52FBFBA15F11F27E108DFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9285d78715fabfcf104f4de9935770a49cebe856c5f56475ed561dc682f9336e
MD5 e4fa5c75fd51f63d25f23693e4b10f6b
SHA1 c34acfa44728b304393e67feac3cf297ee40c525
SHA512 fa2b4b3afad0cb2ae52d022947b7422ddb70379ce36282d52f1392022bb9276f400fe4da554157c75a9669ea2f580a786cc04a8b3b2cf6813dd0bde12735f426
SSDEEP 384:n+CcmyWCXsN/FKLysCZ6jr2X+udgqcize4KV8p0yLc:9cpX+K2sCor8PlzI8p0yLc
TLSH
T10C826C3268781C6B8D96A214F49B21178EE4947B9AC57FB4D6ECDF0D01EA2AC130B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b50a0441429c7d1835ca8895a42e21ec6cd34b98b3ab23440d4686d8df01bb49
MD5 1db6b9c353d8396b6b4caa2a8eb63408
SHA1 e49076acb73e064ac7db15d848803074e22bac1d
SHA512 7c3bb2e9b3a2070ba489b544d3bea96f616e4f1e92a6c4fb055b52a450100df88c03c4675e038f6db7542655af521f833990c0df8d9bd51704cb649724600c59
SSDEEP 192:jONS6TZ0/QmiUytC2ab+jN+FdgXkNc9RcXwqpU6:jONS6TCBT2g+udgqcSzU6
TLSH
T1A9120936A8785C6B8ED2A551F08731235FE4817BDECA7B94E1DC5F0C01EB66C2317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7589679aa59ce0c9545612b2f6be89b3a6c2a09cf2aa322d7c38b299c99ea3fd
MD5 42e046517cd4a058acfcbd49f477b6f0
SHA1 8efb1a928bd0d58131ec0d6312e81a61b8c080aa
SHA512 481beebffe54b8b47d69fc7aa747a396de96a3ee513013c98cf4b5919996a904afb7b09551252e20eadf72c8d5f204079fd331d7182c4ed1a3bfd57d0b041feb
TLSH
T19AE00203930051D7C418037000CB2E1136F3C0B20663030A0E1005B81C123001D12A40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe598a83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598a83.TMP
Size 392B
SHA256 e8893b28f9be7439c50f1ecfca121e015eedabe237b8c145f583ac2ba43e7e3b
MD5 9084d2e9fadef0d1b7f0454b2f5146a1
SHA1 1540fa7e146b8afec1663cf853e57a7e288b5fb9
SHA512 9c22c194ec8fe19e618f5d94ef6d1ffef1ad184fe106094c0ddadb0a6b6ca67c3d416fb9827051ba4c9130e0002f5d2841311430a4bc2dbdd2bdd8e76d8d3b2f
MD5 SHA1 SHA512

Submit Download

bd58a932-353f-4179-9684-92c5942da0a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd58a932-353f-4179-9684-92c5942da0a8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f8f70c2c-199e-494e-b230-0d00fb48bfbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8f70c2c-199e-494e-b230-0d00fb48bfbd.tmp
Size 8KB
SHA256 70c5566d7caf3e47f6f112d04efa8f00ffff71e88275b714228a650e456f82b0
MD5 db1fe55d96624c81ef29a2fa69587716
SHA1 6317f7b3fb65edf547843cd0ec320f601b1c38d4
SHA512 3bd9e4e0a61939656b8999e3fb40c55c55e225de3e54e9b9c607c3fb1cb47a441e5517cd98291e7858fdcd10b1f0b807aa9a9dac9f67a6604216c33bf1ad09d5
SSDEEP 192:YONi6TZ0qQmiUykClab+jN+FdgHo8AaVU6:YONi6TCmAlg+udgFPU6
TLSH
T1FA02E7356C782C6B8EE2AE45F48B36235FE4107BE9D52B98E5E85F1C00E775C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 23c50fd87ab76851c3565dfc7cead2141299ae4c2164c0888b9afd3b2937bdc0
MD5 a72822a4c184a2f11ecb617d35311d8a
SHA1 b764c2698f60492d3975f5b5360b0c4612374925
SHA512 89a0d94081f0dd6612d68eb3b2db32d659daf8a8f177470880e384e6c1057702d54afc0da733cf0926382fe754e212969eda46b14559ac60d836b423ca833c99
TLSH
T121410948A6F91148B3B7AF569BF6A86D487F7D372F06949E00010E4F4A22B00C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

0e88a6e5-20b5-4ff8-99d4-1db0dca182e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e88a6e5-20b5-4ff8-99d4-1db0dca182e0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7065deec-03e0-4233-97b8-dfa86b7248ae.tmp

Path C:\Users\Admin\AppData\Local\Temp\7065deec-03e0-4233-97b8-dfa86b7248ae.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex-Injector.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Injector.exe
Size 36.0MB
SHA256 eca688f3e1ad649ba3c71b5a5fb4f26d72278644971605b10d967dfbd55dc198
MD5 7a814daeddad009fd8d249a9304095d9
SHA1 7789d05ea56781cba826c18971b1d54d7222c88f
SHA512 268a48d92b2d919cf192c5c31c3278d25800f5a69c8251767981be8a6bea4b1987b3c6c3304220a992050b1a76e8d5051e46ecd15f55e700c8e51d2648a30c4f
SSDEEP 393216:Pz9oLwZS0t7X1MUG5xAXY8YcynFUoWMHWDJZHnkGRRoiTHzWK6yI0j4NU5N6sDlP:PpoUg0qUIAUc0FUmmHHRJTTToPSY46HS
TLSH
T1B68733EB93E6B3E894C35A48654E51D278C434BBD6EFC5282CCB4C032664CAE468DD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex-Module.dll

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Module.dll
Size 7.9MB
SHA256 7e1db1702a215c6e024b6ed9473988a33ad09d3e53aa6630983494472f4a31a3
MD5 a2ca84d5a7789ff495765ee3a84d14bd
SHA1 28fdb9145e6d2ac683497024178a1ea09555d6f5
SHA512 a56ef5564313a2c7416627094d360704220691f3af961c363222c0998311ab1806f8980a4c6b48ce5d5004589c301983fabc2a7ceca588999ca8e8581cc0fd5f
SSDEEP 196608:QH5ufwQ5E3XLgNp2usTS25QLZZNKirsk7yK:YQC3Uk4duzs
TLSH
T11786029279E520F8D0B3CD3586D7A39BA0D272BA87578A4F01C559031A23DD29F47B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
Size 19.2MB
SHA256 ec9a5cd08233ad7dfc63797caee9bf4581ad8c6ede7f0fbfdb1f43398e93a85c
MD5 e85e7fad3fd0fe81ecc617a6ba62946f
SHA1 deccbe5fefb125e9c337585afafbef4d51c4520f
SHA512 2ee9fad47c1bd7e4918095b9bbedaa992adcaea5bc94dc647f2728d65be1e0c9b2d7d0f24325cb8e0b5b7eecd41979ece4005a79b9397c6eaef4c317823701da
SSDEEP 98304:FZUaIn/T9DjH4rS0VW0HyAe88vCpocY/iRb8IGtCJ/Pohy+zOATFpbRzjiiDinNw:FZUaHS0t7ps/ib/bkOA8Mv
TLSH
T14117F821BB5B996CD04AC4B483478A764A3170DB0B35B9FF44D496382F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cur.txt

Path C:\Users\Admin\AppData\Local\Temp\Vortex\cur.txt
Size 7B
SHA256 82d908ad3f68bc38e88bb3724ae477bb0ab5b48a2120bda2a4de78bb6794cb3f
MD5 388995f3175fa5f6d56c670da1b8dc5a
SHA1 2db3b08536dcd7120f2f9b5a8db0e7c315ca6244
SHA512 03ad279aecf3928c6f47e15548b8f9915c7c585e4e19e0b33bc568b8a893a4e7859f01a1f231a195dc069660aed7a0146e4539f1e82fb1ff5c0bb35e864540ca
MD5 SHA1 SHA512

Submit Download

external.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\external.exe
Size 5.1MB
SHA256 107533e44853ce019f6bb8b6a59cc007344185ddadd37b103f5e535ae647a4af
MD5 d66058a25670ebbd080a67ddd585a6d5
SHA1 c6305cbf872394515321bbd03092388ae9e478f1
SHA512 4af53f2c2c9cf7794fbbb4e569daea0c8aa35e402bcf521c4e5548e5f947d4395ba38d8ebd38b54308a3638eee5cc444f60d779b7a9bf15df1ecc4e6b4c9a436
SSDEEP 98304:aih5A9ZtKjP3Oyam9Y3MzABY7j9AzqUqfVs430rbZDK:Dcrt03OyaTczqcjeOXVs43d
TLSH
T10736333008443EA6F427A3B9E5F31A254E411C2619C6F3EE6F396E65CBAD44B05C1BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_j0q5etn5.on1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j0q5etn5.on1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4820_1021907788\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eff27709-635c-47b6-b5f6-2600a803189f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4820_1259979011\eff27709-635c-47b6-b5f6-2600a803189f.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 caa9f7b59b826f41b0b94984edc31d6c4c1cd1834d70e10f125050914f9fdfbf
MD5 edcb271367207606e7e0ed80c3646aa5
SHA1 efd80635de128ea87f329188ea3951aa5983f8b3
SHA512 fbd52ffe1d41e847ec291146296b2e215b1a14ca3178451623741505061dd85e8e5d79090fa8a5fd9a7e05c6316652cf13a2f14338d4df6f3a46ae138d517304
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e0403752946cb0cfcfdd6c1842512245b3180ceb97e0d4268745c8559c913e09
MD5 0e0b191a7990e4d30217edff12161eb0
SHA1 17311c158afa24127fb26cf7bee680e9dd0c044a
SHA512 a5de897a25aba30f675fa90b60c987a27fd9dd9db9057e1d0884821d4488abcfb5fd94610418a0d5dc8604c728c4baeb33e2e5ed56a2ba6f66b48822ac0f24cf
TLSH
T12FD024373301C174C11135F31003754D1D00D10F4007404054FCC51D1F145700D13CD1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 65de8b6767403b9700d5d004a2c680979248aae501f7a26a4211b9acc979bb7b
MD5 8b8c47a73ef8d4ba75a72e161f768a64
SHA1 01ec4c7050354c27456353236c4684b00bc2ede2
SHA512 2cd8ee2149794d44fb95176a2277d9cdb20f5a78ec04018bf85ed8eaa8909cf012cb917ee1fa44070cc598ab778595ba29dd1a63f4d8e66d58f47a951e135754
TLSH
T157F02B00F1B3D943D7022D7D519E0E8432B1994504815717F658E1B52C7DFA0DE9B142
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595e24.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe595e24.TMP
Size 48B
SHA256 19a519446644ae825636f5ed9e63dbba20a9b4d35658e5800852cdce249f20e2
MD5 8fdc48b8ded6d91d75d13f790a7730cc
SHA1 76de6ee453c84b2b08a5d1bb3d343f4c2245f0ab
SHA512 71a509d227fa6c3a543ea6d5e38c179d03c2b1c40260caaf11f3d97b1e9a894d34bc648839d79be8751d9298b85f4862c3f808149c59149d60116ec3e2616a03
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 78af33baa3b6a792649f22b0f199a8e2b73712151b8ffc63e7cbe6e09293794c
MD5 2a37e372e0bb4b20c7628aebdb6cbf6f
SHA1 d0b073c3bc4d98082e425b21c8d76781036f0e92
SHA512 05672a7f7314074a381427eb5e4028e62049728fa6b98fca98424b5faa9dde7b29bdbc981306e47acfea23b6f1ef034417490654dff65652e4b6ad99914f67b5
SSDEEP 3:LstlNllkll/lK:LsX3lEtK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\Network Persistent State
Size 12KB
SHA256 3e0f7318c64f9e915bc55ca3fb477753c12665632e0b8ffaeea6a407341c4537
MD5 5d7e65403a79b03f989738c8e22802b8
SHA1 447b04fafcbcfc6ae7cdd5afbb9eaa225827dc4e
SHA512 806c85e1ddb7d842bc9f348cf08c1d2193b0f75ca1895dd875c565232dd9f431d098fb186b0916e809ce6cf0f59bc8c1ed289140007c75840f5e80ef8ca8b74b
SSDEEP 384:D4aozAtNRM26r6nAA5A4qXHwuVSnRviXBvepOYWF/YYib+H8rQMiIcap4ZxDHC6c:zi4mML04
TLSH
T18B428BA6C2D88B2DD95116F927343E2BCD2D192443683D3AC9DAEF8FA3D1471E31164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State~RFe59a81d.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\Network Persistent State~RFe59a81d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\TransportSecurity
Size 2KB
SHA256 6951a8d1e93081ac0f06a09b8133140ede6e4f33667e775a910a4678027cae86
MD5 f8da4e7c549c4736e45ed9f080742f39
SHA1 44201ead308aabc07ef00b6ef369c9a7f5873521
SHA512 267dcb49522b35db413290453b55913e69bb42b84720230b31cec9d5ad8c46efa094a3f0ca5c12ae52ec275ad2a28fc74b6e57c8bfbc8f6e5e416ea987650f41
TLSH
T10F414D93D2BFB89B317C49BF5D867C8519BAB4320591B0F8DE66C3AD74884F76612022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\TransportSecurity
Size 2KB
SHA256 156a614b0c497ec572b2a8d24d788a7dcca691f26b49d51f61b6fb9c2d7e6bac
MD5 962875252d3e8c6c86e4075d7dcfcbbe
SHA1 adc77d0c0228c050fda59634e03acd8281cd9c98
SHA512 33d97bc3097a4941dd2f28ff6d57ce50a364a72b585d663e970fb402c59d20ec2029f0ffaee2cd93b9b2bc8a966f92f9e8c443d8802fc07170f6ff0570e0730c
TLSH
T1AC416D93D2BFB89B307D49BF5D867C8519BAB4320191B0F8DE66C3AD74884F76612022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\TransportSecurity
Size 2KB
SHA256 da9cdcb7987546320978fe01aa5b7f3c20fa81cd56ec3295c8c5662274d7be8f
MD5 b7240e12657049f860cb0bd239f614c9
SHA1 85e0c55d8e1e6b8cbe69d01465dd9319491c8c33
SHA512 0f86c7d88afd803c7d2e73c0c3e4e041f0603f34510f854a968f811dafb9e5f9418a694bf4c280bb0e0e80875b24daedd7a249fb7079e2246dc08b3914a5131f
TLSH
T12E417E93D2BFB89B307C49BF5D867C8559BAB4320591B0F8DE76C3AD74884F76612022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58f99d.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\TransportSecurity~RFe58f99d.TMP
Size 1KB
SHA256 4dee7e90a1e54cb3f6c6809cf1fe74114a25b74a742c1eafdf60282653472f1e
MD5 90889d85c5692821f6cdf9ccc6440c01
SHA1 bdf4a2a15a1e2973907842b5b472142c1a1ae724
SHA512 553ce75aefa3c3575ece96b4ea420607a5bd8c93c6a57c7f7bd79bd9daa54ba1a103b4866ada0a4de2259909a3b710646e1a14a8618f90b6813c4ec3ec9d2d9c
TLSH
T1C4113BE7927FB46B217D85AF5E817C456AB9B4324192B0F8CEA2C27D70884E75713422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Preferences
Size 7KB
SHA256 b0ca6a8ed47c387e9055f1dea36d94dde1386addb0b5d23ebb667aafe8dbdb38
MD5 822883cb42b9483488735143a617a863
SHA1 a616092f0a8e1ded52e60af409681d323422b041
SHA512 4d88c95bb7d3303901a430cf65c2eb9d8cb1eb1ade8df4857fdceccb8018e0efc95696f18f5cb2d2356791cf7efef4fe7e88bd52f3f257b2152308d7458d3005
SSDEEP 192:stA0O7fLZ8paIhnS/S+WiTW1ATjowxgE00vtazKrIxVrXpfKpMC:stZO76o/VwAAwxRrQ9fC
TLSH
T16CF1B49369345ABB4DC7E215B920BB3AE2F5106256D40F96ABFC864C04F76DC6207887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Preferences
Size 7KB
SHA256 852a6263c5c67913c930716eb62535c19d68f2f23264336e68da4f6e8d6bbdba
MD5 0c06dc622d33ef0401b00c90666ea495
SHA1 76f621a196e3eb3a99bfec78b8080b0d460ee99a
SHA512 d4573c2aa3a3a7f0643661159ba45bc2e9542c21123fd2ac63bb084ee21be30e95de230d2cbcfaf455d31c16e2ee7926627930c3dcec917d84f4e3fff756ae5a
SSDEEP 192:stA0OEf9Z8paIhnS/S+WiTWUgjowxgE00pt3GzVr+KpM8:stZOEAo/VNzwxxf8
TLSH
T1B2F1B6936E3459BB4DC7E629B934F73AE1F5142262D40FD5ABFC860C04E62DC610788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f8f1.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Preferences~RFe58f8f1.TMP
Size 6KB
SHA256 3861937937bddce4b70c7c85eb94b2702a2f53f1df8565163a3101c1502c296a
MD5 155bff564dcf7430133b936b2c8bbc42
SHA1 4a8822c1ade98cd963cba13de853c33b730f6a1d
SHA512 a295927b9d972031f3171188042355693ff232823cd97987b0fa09a27aae6f1ba8653049300672c887672b037c4221ac58007dfa37b039903f8a476526a19c12
SSDEEP 192:stA0uBEf4Z8paI7/S+WiTAGwxgiT/rB7KpM8:stZuBE/7/VxwxTJ7f8
TLSH
T14ED1CA135E28697B8CC7E2197A35FB26D2F5103262D50F99EBFC861C05E66CC620B94F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 1KB
SHA256 64c0812a527fb514f0d8835ba9e8ae5943dd93ae2482e0facdd2611c078d667a
MD5 3e3f5c496595c7ddeca2af08364b458b
SHA1 b60c5bd9e67419ef6262d88d857f37a68f10b9f4
SHA512 1f8fe53b42f1880b3eca60689b89915d9ad80bc84541a3f5b634b74a333a4c5700a9eae9a087b34f424ab6d27b8195336c3e51ecc29501f47699ed876cbb1fa0
TLSH
T17D31A7B3E4716F776D86A289B226BA571D200036D1809F5891EE4B4C13E75CC1317D33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 2KB
SHA256 0ad8f16d879524887cd75ffaf58fe0f3cd490f4de78c1c01bc23afcd217300c9
MD5 71bfc55f2e6f65769dbc335c93127795
SHA1 f3fd428d110cb16f3ff15e3d75858e6b07d04e85
SHA512 f932bad3014a1bcb98ad7a279b327afb58dc351d160d60b011537d5f5fd2a793c3c490a123758d9e65d3a17434190168e39cba7e8d7dc965e22104d55470aceb
TLSH
T1EF51A773B824AF7B5AE39648B91A7F235D355061EAD12FA095ED0B0C02DB59C1343C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 3KB
SHA256 06a550472c32c28a091b06ad66d7556868f2d9c64c7c5c8848ba173c5f749fe9
MD5 b99416ac5b57685c71912057a0503bd1
SHA1 02f77c8243210379011c523754162a2e5d1d0fcb
SHA512 cecd283248136340dbe1c4d0a674f35ccc23def70ca7aec0ac9ab085346ef5a56de21156ef3e88582108faab708f6d0639a236017bec609048e564a26cbb2452
TLSH
T1A571A7736974EA2B4EE39A44B9862B166A655133E5C43FA9C5EC0F0C02D73D81343C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 16KB
SHA256 bcbc5302a82f4999fe665bdab929c3f7e19383b32ae2e462b0e4e236bf3c493d
MD5 8a8b96ea5fc29d8ffb68278674a85476
SHA1 14411451cb42c92fd370d43d9607bbd6c6a61cfa
SHA512 d6f1e9216fbcb72299f76b93b5d78392e168b74de0f12dd92382b8f9554b615e9298c65eef2b73d436d790f919dd8b88796734ce443d4a9b44cb7c81bd65478c
SSDEEP 384:z4vsrvyOiyp4+IWA1eUVWGfvvLhNbLL/r97LywwXuUW:U0raxyp4sQe6WGfvLL/BuG
TLSH
T1A072BFB11A74997BADE6A88ABC4F3A1B7D945467D9C02F94A4D4AF0D024B5CC0707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 16KB
SHA256 d186e5d7c450613e7478afe7e7c31a8442e893611d2459dad01ea1072b4b3d0e
MD5 7946940715e62a23e795b203fa19b297
SHA1 601a6686a70036d5b2366249dc3229bdcd7170bc
SHA512 9bc0d281cf2e389fc0e033d033ccd354eefefabf633beafb2e511ca52b1c32a714b8bf349668cfa0304999ad43d876468c80c476d7c101011a61dda63a0383aa
SSDEEP 384:zGvsrvyOiyp4+IWA1eUVWGfvvLXNbuL/r9ATyqwXuUW:a0raxyp4sQe6WGfvEL/YIG
TLSH
T1BB72BFB11A34997B9DE6A84EBC5F391B7D94546BDDC02F84A4E46F0E024B6CC1707C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5891ac.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State~RFe5891ac.TMP
Size 1KB
SHA256 a0d73dd4b7ef680f24f38c50c52785672dbefa2ab6292a0e2f0d4870722e1e54
MD5 324d240f919bdc2004b7d213f92290bc
SHA1 9bd08e935480dd4b197a2a413ceea34020cb0f30
SHA512 50c005e78b3919041816653470a6f60750eebe9597fc3131357014fb9c991e87c48dc2decca98d2b1023ded879e967121394cde9063110faa788ef4e6ff5bbe8
TLSH
T1C32162B3D4616FB77E869289B222BA8B1D204036D2809B58D1EE474C12EB8DC0323C33
MD5 SHA1 SHA512 TLSH

Submit Download

!!!!!!!!!!!!.txt

Path C:\Users\Admin\AppData\Roaming\Madium\AutoExecute\!!!!!!!!!!!!.txt
Size 101KB
SHA256 3f822d520ea7275697b6736398c7de99aded553d9809d54b2c513b6bfa26f8fd
MD5 e6e71392108da60f0f9070923deb3b24
SHA1 ec6bbc05c17d1b4a26b18d656033c6b8f4090766
SHA512 a218a605cd45cbfed4b9fffbe9c05e2fdaa73035fde0afb30c2cb2f6e1dc9c50ca177960df462353ffa07aa24a84256f1c389f0fb299c58c457fa7cb21f9aa51
SSDEEP 3072:MFTpuyUxuTuLPVdCIfm8thoKo14aHT0XshKv+mjO5J:MFTpPK9IIe8thOTksAvBa
TLSH
T102A39E64BC342083AE6C79D72C6D544501FEDDF3A44C20BB2AF988C75ED727B725892A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 9446eca4b78b06b46e752b2ed3a7130fc21b28cf3c84301c5d450ebb7b611d8a
MD5 7b917d4f868d83221ec2a41dc86e6904
SHA1 6b6277a3f41a40952fe3f92fc0a6a6357ae08886
SHA512 be24c388d6daa7d875458a8b837582f35f9f72a2f6fc817b82441c0f312e5bf68b8ee340d8716d42c2451e4c7c0ee9b1622cd9d8e2de77b1e9586c391b78ec5b
SSDEEP 48:fGl6dORtzldmwPlwzuJ9zdYpdDzXXulkz7qnpsXY6dOotNmwtzuJ9zOoYtpdDzX7:uRwzoJdwzHumzSozoJpyzHumzd
TLSH
T161A1CE0457FA1A16F2E7DE7285F37A119977B845DA048F8D00C087041DB3A84ACBDFB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 b9c167e2ee0e1c168aedfe0a824f66f00630ac23bcb1431ede0dbe5ed2f042e2
MD5 545aa99662915f9ce46e2a5e2dad1b22
SHA1 a123f29f1dfd248eb5e96f37d340838775e05027
SHA512 3abe852c71ae42c8870fc52cf4a338e7bf5768a533b96c7778744cf2d5946ce6c0295ca4499053a18c589d48c8da6fb87321a6dce45b396405867ed5aefae314
SSDEEP 48:fGY6dOotNmwtzuJ9zdYpdDzXXulkz7qnpsXY6dOotNmwtzuJ9zOoYtpdDzXXulkx:IzoJdwzHumzSozoJpyzHumzd
TLSH
T191A1AC045BF71A16F2E7DE7285B26A119A77B845DA048F9D01C087041DF2A84ACBDFB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-98-0x00007FF9E07E0000-0x00007FF9E07E1000-memory.dmp

Download

memory/412-97-0x00007FF9E0C50000-0x00007FF9E0C51000-memory.dmp

Download

memory/1916-21-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/1916-9-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/1916-6-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/1916-0-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/1916-2-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/1916-1-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/2140-168-0x00007FF9E0780000-0x00007FF9E0781000-memory.dmp

Download

memory/3884-475-0x000001D1F2480000-0x000001D1F2485000-memory.dmp

Download

memory/3884-477-0x000001D1F24C0000-0x000001D1F24C2000-memory.dmp

Download

memory/3884-470-0x000001D1F2490000-0x000001D1F2492000-memory.dmp

Download

memory/3884-469-0x000001D1F2480000-0x000001D1F2481000-memory.dmp

Download

memory/3884-472-0x000001D1F24A0000-0x000001D1F24A2000-memory.dmp

Download

memory/3884-471-0x000001D1F2480000-0x000001D1F2481000-memory.dmp

Download

memory/3884-474-0x000001D1F24B0000-0x000001D1F24B3000-memory.dmp

Download

memory/3884-309-0x000001D1E9F80000-0x000001D1E9FAB000-memory.dmp

Download

memory/3884-476-0x000001D1F24B0000-0x000001D1F24B1000-memory.dmp

Download

memory/3884-47-0x00007FF9E0780000-0x00007FF9E0781000-memory.dmp

Download

memory/3884-480-0x000001D1F24B0000-0x000001D1F24B6000-memory.dmp

Download

memory/3884-479-0x000001D1F24D0000-0x000001D1F24D3000-memory.dmp

Download

memory/4280-299-0x000001394B820000-0x000001394B847000-memory.dmp

Download

memory/4280-300-0x000001394B850000-0x000001394B88B000-memory.dmp

Download

memory/4280-298-0x0000013943E60000-0x0000013943E6C000-memory.dmp

Download

memory/4280-297-0x0000013941DC0000-0x0000013941DEC000-memory.dmp

Download

memory/4964-242-0x00000295B9F40000-0x00000295B9F62000-memory.dmp

Download

memory/4964-279-0x000002959FFD0000-0x000002959FFDC000-memory.dmp

Download

memory/4964-276-0x00000295B9FC0000-0x00000295B9FE4000-memory.dmp

Download

memory/4964-275-0x00000295B9FC0000-0x00000295B9FEA000-memory.dmp

Download