a958590ad4a3505caf86fa8f473dc4ff11081d8b03b0cf850efece9e00a9dd96

Analysis

user interaction
yes
max time kernel
62s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vortex/Bootstrapper.exe
Size 3.5MB
Sample260626-x29wjset2y
SHA256 a958590ad4a3505caf86fa8f473dc4ff11081d8b03b0cf850efece9e00a9dd96
MD5 a5b2b44bee8533b903877fbf5538f3d6
SHA1 b8d1b2c836358215fdd0da611e042de1dde11751
SHA512 5eea50aec1b09a542ed611e39e8425ff78de92d47962438ad7ec9649ae5d650d4bb663107d6d1b2de73196ec2667072f4ed98cdefb5a94f2086dc3255237ebe0
SSDEEP 98304:q1ojI+B7crZMj0IBP4WNiKvhMGIYqopMfcf9ho:rMSmqjbP4HKvMxcf
TLSH
T1C50633D6CBC25E55C3FE637309BAA98F4EC9565EC658464CA81948EF02431F0DE17F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Bootstrapper.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Bootstrapper.exe

Executes dropped EXE 1 IoCs

pid	Process
5652	Vortex.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4816-0-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral2/memory/4816-1-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral2/memory/4816-2-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral2/memory/4816-5-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral2/memory/4816-4-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral2/memory/4816-19-0x0000000140000000-0x0000000140965000-memory.dmp	themida
behavioral2/files/0x000c00000001c655-254.dat	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Vortex.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
29	raw.githubusercontent.com
30	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com
53	raw.githubusercontent.com
67	raw.githubusercontent.com
116	raw.githubusercontent.com
141	raw.githubusercontent.com
1	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Vortex.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4816	Bootstrapper.exe
5652	Vortex.exe
5652	Vortex.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2036	powershell.exe
3224	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4816	Bootstrapper.exe
4816	Bootstrapper.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe
5652	Vortex.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2560	msedgewebview2.exe
2560	msedgewebview2.exe
2560	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2036	powershell.exe
Token: SeSecurityPrivilege	2036	powershell.exe
Token: SeTakeOwnershipPrivilege	2036	powershell.exe
Token: SeLoadDriverPrivilege	2036	powershell.exe
Token: SeSystemProfilePrivilege	2036	powershell.exe
Token: SeSystemtimePrivilege	2036	powershell.exe
Token: SeProfSingleProcessPrivilege	2036	powershell.exe
Token: SeIncBasePriorityPrivilege	2036	powershell.exe
Token: SeCreatePagefilePrivilege	2036	powershell.exe
Token: SeBackupPrivilege	2036	powershell.exe
Token: SeRestorePrivilege	2036	powershell.exe
Token: SeShutdownPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeSystemEnvironmentPrivilege	2036	powershell.exe
Token: SeRemoteShutdownPrivilege	2036	powershell.exe
Token: SeUndockPrivilege	2036	powershell.exe
Token: SeManageVolumePrivilege	2036	powershell.exe
Token: 33	2036	powershell.exe
Token: 34	2036	powershell.exe
Token: 35	2036	powershell.exe
Token: 36	2036	powershell.exe
Token: SeIncreaseQuotaPrivilege	3224	powershell.exe
Token: SeSecurityPrivilege	3224	powershell.exe
Token: SeTakeOwnershipPrivilege	3224	powershell.exe
Token: SeLoadDriverPrivilege	3224	powershell.exe
Token: SeSystemProfilePrivilege	3224	powershell.exe
Token: SeSystemtimePrivilege	3224	powershell.exe
Token: SeProfSingleProcessPrivilege	3224	powershell.exe
Token: SeIncBasePriorityPrivilege	3224	powershell.exe
Token: SeCreatePagefilePrivilege	3224	powershell.exe
Token: SeBackupPrivilege	3224	powershell.exe
Token: SeRestorePrivilege	3224	powershell.exe
Token: SeShutdownPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeSystemEnvironmentPrivilege	3224	powershell.exe
Token: SeRemoteShutdownPrivilege	3224	powershell.exe
Token: SeUndockPrivilege	3224	powershell.exe
Token: SeManageVolumePrivilege	3224	powershell.exe
Token: 33	3224	powershell.exe
Token: 34	3224	powershell.exe
Token: 35	3224	powershell.exe
Token: 36	3224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2036	powershell.exe
Token: SeSecurityPrivilege	2036	powershell.exe
Token: SeTakeOwnershipPrivilege	2036	powershell.exe
Token: SeLoadDriverPrivilege	2036	powershell.exe
Token: SeSystemProfilePrivilege	2036	powershell.exe
Token: SeSystemtimePrivilege	2036	powershell.exe
Token: SeProfSingleProcessPrivilege	2036	powershell.exe
Token: SeIncBasePriorityPrivilege	2036	powershell.exe
Token: SeCreatePagefilePrivilege	2036	powershell.exe
Token: SeBackupPrivilege	2036	powershell.exe
Token: SeRestorePrivilege	2036	powershell.exe
Token: SeShutdownPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeSystemEnvironmentPrivilege	2036	powershell.exe
Token: SeRemoteShutdownPrivilege	2036	powershell.exe
Token: SeUndockPrivilege	2036	powershell.exe
Token: SeManageVolumePrivilege	2036	powershell.exe
Token: 33	2036	powershell.exe
Token: 34	2036	powershell.exe
Token: 35	2036	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5652	Vortex.exe
5652	Vortex.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 5652	4816	Bootstrapper.exe	91
PID 5652 wrote to memory of 2560	5652	Vortex.exe	92
PID 2560 wrote to memory of 1408	2560	msedgewebview2.exe	93
PID 2560 wrote to memory of 720	2560	msedgewebview2.exe	94
PID 2560 wrote to memory of 720	2560	msedgewebview2.exe	94
PID 2560 wrote to memory of 720	2560	msedgewebview2.exe	94
PID 2560 wrote to memory of 720	2560	msedgewebview2.exe	94
PID 2560 wrote to memory of 2520	2560	msedgewebview2.exe	95
PID 2560 wrote to memory of 4728	2560	msedgewebview2.exe	96
PID 2560 wrote to memory of 4728	2560	msedgewebview2.exe	96
PID 2560 wrote to memory of 4728	2560	msedgewebview2.exe	96
PID 2560 wrote to memory of 5264	2560	msedgewebview2.exe	97
PID 2560 wrote to memory of 5264	2560	msedgewebview2.exe	97
PID 2560 wrote to memory of 5264	2560	msedgewebview2.exe	97
PID 2560 wrote to memory of 5264	2560	msedgewebview2.exe	97
PID 2560 wrote to memory of 5264	2560	msedgewebview2.exe	97
PID 5652 wrote to memory of 2036	5652	Vortex.exe	98
PID 5652 wrote to memory of 3868	5652	Vortex.exe	99
PID 5652 wrote to memory of 2316	5652	Vortex.exe	102
PID 5652 wrote to memory of 3224	5652	Vortex.exe	104
PID 2560 wrote to memory of 3328	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 3328	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 3328	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 3328	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 3328	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 2932	2560	msedgewebview2.exe	109
PID 2560 wrote to memory of 2932	2560	msedgewebview2.exe	109
PID 2560 wrote to memory of 2932	2560	msedgewebview2.exe	109
PID 2560 wrote to memory of 2932	2560	msedgewebview2.exe	109
PID 2560 wrote to memory of 2932	2560	msedgewebview2.exe	109
PID 2560 wrote to memory of 1804	2560	msedgewebview2.exe	110
PID 2560 wrote to memory of 1804	2560	msedgewebview2.exe	110
PID 2560 wrote to memory of 1804	2560	msedgewebview2.exe	110

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2316	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Vortex\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Vortex\Bootstrapper.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
  "C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5652.2020.1498816854858376294 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView /prefetch:4 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffbbe035fd8,0x7ffbbe035fe4,0x7ffbbe035ff0
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,16288369863958929610,5369615094722084862,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1788,i,16288369863958929610,5369615094722084862,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1788,i,16288369863958929610,5369615094722084862,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3300 --field-trial-handle=1788,i,16288369863958929610,5369615094722084862,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232 /prefetch:1
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4392 --field-trial-handle=1788,i,16288369863958929610,5369615094722084862,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4860 --field-trial-handle=1788,i,16288369863958929610,5369615094722084862,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5004 --field-trial-handle=1788,i,16288369863958929610,5369615094722084862,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
      4⤵
      PID:1804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command " $cpu = (Get-CimInstance Win32_Processor).ProcessorId $bios = (Get-CimInstance Win32_BIOS).SerialNumber $board = (Get-CimInstance Win32_BaseBoard).SerialNumber $disk = (Get-CimInstance Win32_PhysicalMedia | Select-Object -First 1).SerialNumber \"$cpu|$bios|$board|$disk\" "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\system32\reg.exe
    "reg" query "HKCU\Control Panel\International\Geo" /v Nation
    3⤵
    PID:3868
- - C:\Windows\system32\attrib.exe
    "attrib" +h +s C:\Users\Admin\AppData\Local\Real\autoexec\!!!!!!!!!!!!.txt
    3⤵
    - Views/modifies file attributes
    PID:2316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command " $cpu = (Get-CimInstance Win32_Processor).ProcessorId $bios = (Get-CimInstance Win32_BIOS).SerialNumber $board = (Get-CimInstance Win32_BaseBoard).SerialNumber $disk = (Get-CimInstance Win32_PhysicalMedia | Select-Object -First 1).SerialNumber \"$cpu|$bios|$board|$disk\" "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 46013602eb712487c5c4134afa81694570fd6c71d2be3cad888c81ec079db732
MD5 9dc3d9fead34511b2dbec305d5588559
SHA1 cdf1808f087fa4fd3121660931131ff21e49622f
SHA512 4e2b345e8b973fc2a510152addf5b1e65ee098ddec88bbf5fd274b06658e05c0235d46067aa37bc066f44203f80e726bdfaba858a1e7406607880d6435d9e991
TLSH
T154217633B3DC8214C899403A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

!!!!!!!!!!!!.txt

Path C:\Users\Admin\AppData\Local\Real\autoexec\!!!!!!!!!!!!.txt
Size 31KB
SHA256 1ab895d4271f38eca4af29c342ea9fa5f3942fb14ce1a2a4a2d08661aaeb5fe8
MD5 53ac46b052822fbc21f3867d4574f35d
SHA1 db867c1332f03619383130e6fea934838224a8e7
SHA512 870540c9715818f660527523ab39390f280ca546af8e714d01ed9bd12cb545bc30c179115174a2f34d4f05d13515ab5fb630a367704e7574ab08a2aa4f672181
SSDEEP 768:jYOny0qCcMDJqqZ0dNamW1FodpEJF9M+iRsm3XAaEPkl:j1+EAnEr9i3zEPkl
TLSH
T1BBE235E83546A982D30B9DD9C8573C84E73439E3D5CE548243DE98B02EF672DAE61D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex-Injector.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Injector.exe
Size 46.8MB
SHA256 914618b1033aaa99acd54d648a8bef5121c59051e89b0f6431824d44dd67b7f5
MD5 c01bdb0cdb9f571b76989d43182f49f0
SHA1 5896566c827938b880196ee798c64c530205b448
SHA512 be8e356c32779b15d3ca608e46a1ef2d31c59ee1564fd3328af2a9182d1786569ba1323a4b3cbc562f79d26e48e28b921ba385368c11c6796a3e041cfbe0f83b
SSDEEP 786432:RqqxSIcmQzu7nEPGNiMxMJBflVvRkDkqinE53rayZnw:RCzzuDEP6xMbdVvahiEBOunw
TLSH
T17AB723CBA6E953ECC8C30584568F33DA55C055BE82DAD93D26C72C037520DBF9A8A937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex-Module.dll

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Module.dll
Size 11.8MB
SHA256 5ffd7b0f39d980d9a740eed8d1886798ade1a46919aebad6dcdf665875c036a8
MD5 2a00c019e1574ff309a5b7b219544d53
SHA1 7fab3074cf08fd6af47bd663abc673cf53f4c9a4
SHA512 6e09f6ba0f1d1ffd0e7065aca47cf668d2d50177eeb9f9697ae3d8b48e496b124e5e6bd44a95613eea47364145ca555b260522de2f854f34338438a6b75239a1
SSDEEP 196608:/ggpGMrSjyM+Nn96Os7yNiIYcCMgex0G4ofw9AlUZp52AGbfh+8DL7i:/ggplGjyLn96O9g0CMtV9fw9y2pARli
TLSH
T18EC633A03D7508EB6EE4D74332FE5B6F9D2E3C036644D9424327A792A478536FAF8049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
Size 19.4MB
SHA256 db305b75d9a553bc16f095554a76012cc034490405e724c036261c82424e6e54
MD5 27b1c8731cec32be7a0806502994171a
SHA1 8f1a1363324bed94c54f5474bcbe3376f07692fd
SHA512 41ee0df3e3a262f34a15d1713f76ef49d6682173e1f5bb2ae6dae0dfbad2cd6ccd0f57b20e5b118fafd4a8a26961f9f34e10e59d18e6ce601a9e81941089ed2d
SSDEEP 393216:FdrI1Cpadezmnp0STVH9ndeeXv2n2r4nlT5lL+CFtosfBOo:FJI1vfp9TVdnNXvvmlFRRtosD
TLSH
T19B27235691D59BD9CB822694350600DF34C5A86DC0FEAA293FCB5D03BE5CC6E098DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cur.txt

Path C:\Users\Admin\AppData\Local\Temp\Vortex\cur.txt
Size 9B
SHA256 baa6cba2a9f558e7dc82f8b0a603b0ae5333b2ec3c36927bc8d223aa6bc2c02b
MD5 50c175b4dafb03d01b4da164cb1a06d7
SHA1 4161d521d689f9efc6db8a5b7d3f37b183b7b4db
SHA512 d5f1804147525f6cc5e973dc1c386be75aa52af37147cbdade01028e273c309125c70343abcf5fdf5c4a905436b02c91267d39a77751cb8ff593b6e70442aec4
MD5 SHA1 SHA512

Submit Download

external.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\external.exe
Size 8KB
SHA256 20776ee3a5bf2e959d040a573253faafa3e0495c64f7980e3546de549dc4218a
MD5 e94e39cf5346769393aa1ec9a29f109a
SHA1 8ac3852766cdf8a0280b700a5d2ea2db65842cfd
SHA512 8f309e1d4ba9cdd5352b79ab82abdba480b945c04e7431268ce31ff563b5dd27e60bc15674e6db3c6a82db488916af4f0c04cf067481f210f38340fd7e0a2993
SSDEEP 192:fXGrXujnzLQBhU1xgMTfsRbZFz7TJDfFAqPMd0bm:fXGrQcIURbz5F6
TLSH
T1E302AFD652205E7DF94E82B1989E2D0C61170238FBE563022D3F6535AEB02B0FA19EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_aj3fw5uf.msd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aj3fw5uf.msd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dcec700e0ca5f26fcb1778f4447362ecf2b4039f4dfe63ba27c3574bfc05367f
MD5 c907f437de320f48feb7b204916b5896
SHA1 1916716af1b6984b3387641f4752dd9a10bd23eb
SHA512 0d87f691e396cbf8866d65577bfd439db9bd952bcc0b4158ba7e35e83a732ed4ea8a900ab2f42ee106a08aa849ea82535264b98a2f1fc94d4d18b6008ad85717
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 990b8c7ea0978c9622a10d4f67bd0afd00287135054264b475c86b33ec4e1ed3
MD5 2167087a942057453d33c602d712d2ab
SHA1 e4978071174359ed3556b4e76063907f0905d36d
SHA512 d84676fa20ff0a8774bf154b8485eb17a779359857fa82eb7ca5e68106e9b8c34cb504474bc08d7d5e2f9ec2cf4e4e160fbd365d1c20080255f61bb7aee7dd86
TLSH
T1D7D0121736410138C01021331612F24805C0D50B4115800A9828851E2E554A01D03482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Cache\Cache_Data\f_000018
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Cache\Cache_Data\f_00001c
Size 57KB
SHA256 6303475cdd19a7c08d011c6c6862e3789b39f95797602963a78cac17ff73d1e5
MD5 73fe08c0771b0b44243114c8ea8b86bf
SHA1 03015c3d3ea5bb634dd29a50623a6147d206dc0c
SHA512 f4fe1b7b7562c4f1187ca0621ff4006be0fad055e41d772a1ff4a421eb0d18794e3c21dad72cc469b889c6ed9642616ab9c8b5bd27d87d8fb5b8f228c96407d6
SSDEEP 1536:5HBwP9e8JdgrDq3W2leMPq1AOFgHDU3kQj2W:5hc7grO47C9Du
TLSH
T1284302CFF0D8C6FE215052556E6E7628C261891FEB118DB2443F2FB2999D04172FBAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Cache\Cache_Data\f_00001d
Size 49KB
SHA256 5058a107c30e50e677638f0ccadf153012d43e978e0cf24f9b77350b41d5a9d8
MD5 c846d90a4410ff22e5bd16ff246ce0f6
SHA1 6e1d860acd3022d8ada2b756a3e211a805f845eb
SHA512 03abd6a494079250d0da5f7e50b0e2099d4b4251bb262aad66dfc182a917cdb5b647c9f0d042823add6b74d273039224848e2b33818119043644b0f6ad7188a4
SSDEEP 1536:6nOlJsiRl+CXAXFoxk0JYsu/LGWDqeHRR3n:6neJsykHX61JY/LZHL3n
TLSH
T12933F1728E78ADBC8D3FB073CD6B56FDE4E44497A425E9A0C7514EA721337A291808D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Cache\Cache_Data\f_000025
Size 198KB
SHA256 60c7e75019489937ce4fa8774df8eff0094bcfee4b03fa1913bbe06b4ccd9ee8
MD5 f7186834151f1e7643b9706925feba9e
SHA1 131c6f9c6518b605cb1ed4da88fa4105d885c431
SHA512 e09a50e02007779b0ca70dd8b21c6b8265d560baf04ece187310522b6633595544cf5c2bdb8df157547a3b198f5f76ce69430cd4552f91e307ae5f4128ae6da7
SSDEEP 6144:zr/aTDIuw6hArwzlcR+/Tbfos6J+yOq0My:zr/aY4ArwpcY/Tbfo10
TLSH
T14814238B5E17EA42EB81CE024857336593F7B6E6C6DCE085533D51D8A9304325E6E9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c222583cad80f89_0

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\5c222583cad80f89_0
Size 333B
SHA256 8325106e9a47ec389a3d3000ca0bf02242487b1759ade95e26a9a6de62170576
MD5 e48b52d841d4f04f071c79c155fa47fd
SHA1 aca34b18918afc7387801547e83a8a666aabb2a8
SHA512 ebf1ad758390529ff5d4d6a251aea968071aa608509034d85e047e4a7089e98289399ef5f8b707a31063bae0219ec19cbb1ad0285f3a2e0afa901be5021759f7
TLSH
T111E07DDB295529C6C72F85F55E3E620D355391A828CFF8F24488B02372085707631454
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 63c53cfce53ab1034ca5923b4df4634ffc75e3acea5672d291faa44bf93461ec
MD5 181560ba6bd5840ffd57d6c88454b53d
SHA1 1fc42e5f54775aa013ecb9489456665cb40db437
SHA512 378126127326db577313198885bfc37072c94e029f8097a1f3389be5734e52c14ecee6fae6205ce01dbe366622c023aed529a1ff5b7181fd5c11d406e73e0020
TLSH
T1F9319267897EF47F006C5A6B1D80B80595A9F8305272FCFDCE96B13DB0A68E31B19432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 98685c8637fc7d8bcfb1612250b829a8bcb63b815f5230e072ccd4928e9bd37a
MD5 51a84fc4da3ea3e97be0fddf6b4ad8a0
SHA1 448b44a60196aafc1883d028ccbe7641142948c5
SHA512 2b7e6ed43e25f0e09d92be845a1634a28c93e733cb2b4f4384850a00bb9c2a4de9b047faa5eabf0df05dd8a9a1b529436421932fbdfec36bbdd725287a9a56a4
TLSH
T18C3194A7897EB46F106C5A6B1D80780596B9F8305172FCF9CE96B13DB0A68E31719036
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe592745.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\TransportSecurity~RFe592745.TMP
Size 1KB
SHA256 e2dfdafec62dc36ceac9a985c005e7136a3bb21ef208a5c6702ab674fa0499bf
MD5 19184f8202260d6fd061ef884e474f9b
SHA1 897f84d03419975ab7a0956b400d9eeffa85dbd3
SHA512 8c2f651a4b5ad4cee002c9c7a9010649acdf8216a8dec1a42bb715eaa8f9c331ca93f6cbd508b15f1355d1d73992cf25a5cc1b17c07ee55387bbfcf93680c980
TLSH
T1BD117FA3447EB4BF007C55AB1D807C15ABB9F4305263BCF9CA62B13CB0974E30619432
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Preferences
Size 6KB
SHA256 5c46afe41233682370519be4737ab2a1b289d457dd78fe3f294354c1daeb7d7c
MD5 521a591512583351a80f8b433401df8b
SHA1 aff2d91ff399eda7fcc8f6a6854ae18d9f8f1183
SHA512 dd54f935972cccbc6ac9abbff081ef1bc4cc931bc020ba03da956fb14677ba2ed3f37a9adb94a8714e348fa20ce9cd5e41da3450647886f32d32a8834cc4377a
SSDEEP 192:stqOzCndonf0sV+FdzrfvC8QRIDPDDrID8f/oQG6K:stqG0dsGRDQR6r9K
TLSH
T138E18683AD2469BF4CC7E516FA24B61EE2E5502275D51E98E7FC8A1C08DF9DC6207C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59264b.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Preferences~RFe59264b.TMP
Size 6KB
SHA256 c82f47db618cf241d7411c770e57b1de69554c0401590c8a3a59a9e1ab0fc939
MD5 aee6684a77791f1eebe4a24d5d17c7a1
SHA1 ad7099c425d0fab3b9abc7eebcab115f24969c09
SHA512 414fcd3f9e1bc1fe3546f696852ece2e9567b1d3da03202f428faa3a615c2df2251015c7fa4f76a5c5a2de7cc052ab6cee46f97148cbf995a46eb7cfd7b29efb
SSDEEP 96:stS/dmBH1AVb93k8o5h16Z0Cas7/x+6MhmuecJCge41ejeoK+gJW28XM1C7K:stq0BCnxonZsV+Fd9hQjouG6K
TLSH
T1D3D195425E28A9BF4CC7E109BA29BA1BD2F5603275D51E58E7F8461C08DFADC630BD07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\WebStorage\1\CacheStorage\ec303e24-0786-4c32-889e-bd9bb63f76c9\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\WebStorage\1\CacheStorage\index.txt
Size 196B
SHA256 c7d1d24453ecbcc96bd448b9f4ffbde3ad1efeb6d413de8036e6c2f60e549315
MD5 96c9282eac4393c0c3991f8d3bf319f6
SHA1 ef7004503f0e743bee2baf173e525203a78393ef
SHA512 0f38c6ba6c77b69603a7f963d825a04a450de09c7e79d9b7ecf382bb895aedfd48785f6b5f64ed43027deed664ae6eb68fef71866be66b5b3ce6efc835e77b8e
TLSH
T1A1D0229E0842CC13AA312EDAA038B45C804A6E588CC1CEF4A019A0016474B339001C28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\WebStorage\1\CacheStorage\index.txt
Size 132B
SHA256 dbd426afc7f28c2059de62b4a6b65aa65aecab38045530af6140aa4e12040aed
MD5 8ca6f654fb103a326721a31148e7e784
SHA1 0427a9952d5a763ba882da428ee4bf22f7a28a8c
SHA512 5fa401dfe48f9055e2581078b93ff4b32f179568ebf387a34479a474da911fcad660b4152d6450952584b73e9a29d9a162502df904b4cb27ec980b548c6e4350
TLSH
T164C048AB1854999B9A356ADAA038B99DA58A509C8CC5CEEAA42980152864A339002C28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5919f7.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\WebStorage\1\CacheStorage\index.txt~RFe5919f7.TMP
Size 139B
SHA256 88277feb662fb57b059000b212f88b809d7ec99deed1012af61e116694631189
MD5 94d290004b7fed845603b8cb8e5f6e82
SHA1 f7f5c153eab13b0f80c94a96f55409e568156903
SHA512 58759a04ef5b5d0b452dac32e2b548336d7f92d203f227955885324e99bf09be481b5a74c9b2df26a9bbdb9676ef7ad99b8efa801e7e0be8b478f01b71848c1b
TLSH
T1C4C04CAB145495579B3169D6A034F55D954A5C9C8CC4DEE55519A0452474A339001928
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 15KB
SHA256 8aaa44f321f2239581aec3d3270444da828b33af06fa36b1a94720b557c0b57d
MD5 1051815c876d5eab95852d390a6839ac
SHA1 086c1023b4f7beb60cb91725c9536ad795d54235
SHA512 b3d15f7569997617e988fe334458d454668afdc04472e3f239286a85aa957d47c51ca17d83db8071a86c8a20cb8f858a86b48ead6d34419a4fe3ace25878f1f4
SSDEEP 384:Dsrv+89zHqlDNP9oidKNBSZ8fdYL3/YT4fNY:4rv+4UNbdMaL3/i4fNY
TLSH
T1AD72AE73D578AB779DF38409B44A7A0B3F786097A2C20A64D9D81B4C458F4D9330BD43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 2KB
SHA256 54aabb925d2f8f7857858b590822904d8097f0ee5966a6c73c5b16b7962deb52
MD5 e479f84915f84805b013492ec7ce8a77
SHA1 717f9ecf6092fdb8171dadae10087b4d129c729d
SHA512 0990cd4a2dc6b930f90273ec7539b8d2e331a7969ae57bd1f440f76ebf4fb39d03250ef1b54467f4cb4a347ed9b5d0dcea26e11283d7507e3688148affa9dd6a
TLSH
T12051A6F35D50ABBBC6E34A097C4A3E279A355065AB922F55A9CC0B0C05CF99C235BC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 3KB
SHA256 834afd67575161f0ce31d29e459f1ca804e8beb1137ebe9e7676dacd12100910
MD5 dbbeb975d484f407f738d890e269a443
SHA1 90543806f7af3b17cc3263017a211063d196539f
SHA512 b61e220a90ce8ed31b3f56f0abea36224dacd0ded3d141d08fda72d170f3fe27a49a3068dda78906e05d92a8986fa29d55bafda433d805a4105f967facc554b3
TLSH
T16671A9B759A0A9BB8AE399057C863B16B7A55037E9C53F99D5DC0F0C01CB6882357C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58b486.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State~RFe58b486.TMP
Size 1KB
SHA256 e2a14ad5d3073f9dd89cbcc5e14ebfd5bcb1dc9236255e75ed6526614963154e
MD5 82303edd6958c1e88f2080631613539d
SHA1 66d81fbb2fa3aa8dbb74a2880838c17c0f934129
SHA512 80bc9e2dee6429beec57bb45faed46238ec304d181ba58e3d7cc59cda05ee195e3ff26d364a3dca430ef0d5b072b286b2e12d25a310f4eebe664dcbc17e6df71
TLSH
T1B93154F68AE06FF6AD97255B34467A5B6E21507A92520E0861CC070C16DF48CA63FC32
MD5 SHA1 SHA512 TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 9ef2b9cf621a663fa39da069e87f912bb7d7a655fc4cb7fb9a9bc56a4cc5585b
MD5 df471671972c465a0562ed1fa6ac3f7d
SHA1 3faa2405dd00fa8443a9e420b9eb0120e1fe668b
SHA512 05772849dedcde076e4632cecabf821743960f35cc19a0814c8654bdc891c0c0e3a050cd770f0bd08febdbff3931834f99d5ed48f72f66d4b67d49118823ef4b
SSDEEP 96:xNn9j5z/JPQzHu8z9mO9j4z/J7yzHu8zx:xN9jRhKkCjSV49
TLSH
T1E9A1FE050BE20B26F2F6EE72457776569A77B586BB084B4D00CA87050CB2F4479ECF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 bb70e2ca25bf156fb04b957e89cd0a2b5f7b55d3a106351ff2a8c0f1ff5c64d3
MD5 d0e85ab9e143fbbde85f9642059a0845
SHA1 35012546d389727a417075af8e4ba81eba4d5769
SHA512 11d46e435eb119c7c78fd7a82b95ccb4e7994685c55b6ad817eb28f7e21a2352185b6a912ef1526924d69e70b11fcc8926413753c9f6e7ca6d1c1734b4d65140
SSDEEP 48:HEdOMEIOqIzYI2qYzNJ9zPYpdDzXXuPEz9pyEdOMEIOqIzYI2qYzNJ9zMoYtpdDp:CO9j4z/JPQzHu8z9rO9j4z/J7yzHu8zx
TLSH
T109A111080BE20727F2F6EE72857776559A77B586BB088B4D00CA47050CB2B4479ECF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hwid.cache

Path C:\Users\Admin\AppData\Roaming\Vortex\hwid.cache
Size 32B
SHA256 035ce7b0297134f46d01d7592c630419062403ac5438c523e4881f45b4961cfb
MD5 3f06e03d11ea73645d8422cb2624cae2
SHA1 633660a7c806edee77d4a886d58dfaa4660f25b7
SHA512 57467e35e156e0537f5167ae4f1a3a4684e2949c4dcf5116f77bcd518a05941e70918ef52f0dfc9a8d11d6a1a33ede83532f5a50de450c27a28f52a8fbcb9f27
MD5 SHA1 SHA512

Submit Download

memory/720-52-0x00007FFBE05C0000-0x00007FFBE05C1000-memory.dmp

Download

memory/2036-246-0x00000201F4FE0000-0x00000201F4FFE000-memory.dmp

Download

memory/2036-247-0x00000201F5000000-0x00000201F50B2000-memory.dmp

Download

memory/2036-253-0x00000201F5100000-0x00000201F5124000-memory.dmp

Download

memory/2036-218-0x00000201F4F70000-0x00000201F4F92000-memory.dmp

Download

memory/2036-249-0x00000201F50C0000-0x00000201F50CA000-memory.dmp

Download

memory/2036-252-0x00000201F5100000-0x00000201F512A000-memory.dmp

Download

memory/4816-5-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/4816-0-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/4816-1-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/4816-2-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/4816-19-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/4816-4-0x0000000140000000-0x0000000140965000-memory.dmp

Download

memory/5264-102-0x00007FFBE05C0000-0x00007FFBE05C1000-memory.dmp

Download

memory/5652-21-0x00007FFBE1260000-0x00007FFBE1262000-memory.dmp

Download

memory/5652-20-0x00007FFBE1250000-0x00007FFBE1252000-memory.dmp

Download

memory/5652-22-0x00007FF600CF0000-0x00007FF603BA0000-memory.dmp

Download