4ac1c40118de6166bece58b04ec937c4b9975a5541e4ea96eba9d7ba87a48d33

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vortex/Vortex-Bootstrapper.exe
Size 14.6MB
Sample260822-e91zhaeq8v
SHA256 4ac1c40118de6166bece58b04ec937c4b9975a5541e4ea96eba9d7ba87a48d33
MD5 b098024d0c8dbba834f76bb49c62e2b0
SHA1 1b01ec9117032f9a37c46d130e988304467595f5
SHA512 b8fa33248851d4262acb14868faeff569d77c37f05f1d739a1b8b42f9865679b6b585a1c14b69cfcc9a40bee17332ff7b86064ad4b9ff6f80e5bd6249a7757e1
SSDEEP 393216:WJsYIdRMOzHN+jg9yD4ty9TPRuUrzQLOW/Ki/8lZG3:6udRMOxQGyDtDRuUrzUChlQ3
TLSH
T182F623C3A1DE87EDD48396156A4712CAA4C5B056DAFA17143ECE0D0EFE06C4907CBBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution themida trojan

Malware Config

Signatures

Downloads MZ/PE file 5 IoCs

flow	pid	Process
13	3204	Vortex-Bootstrapper.exe
13	3204	Vortex-Bootstrapper.exe
13	3204	Vortex-Bootstrapper.exe
13	3204	Vortex-Bootstrapper.exe
116	2392	Vortex.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	Vortex.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00070000000244d9-890.dat	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Vortex-Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Vortex.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Vortex.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
2392	Vortex.exe
2392	Vortex.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_1985582690\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_1985582690\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_72791006\ct_config.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_72791006\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_72791006\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_1985582690\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_1985582690\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_72791006\crs.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_72791006\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1708_1985582690\keys.json	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2772	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318471881487925"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
3204	Vortex-Bootstrapper.exe
564	chrome.exe
564	chrome.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
564	chrome.exe
564	chrome.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe
2392	Vortex.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2064	msedgewebview2.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
1708	msedgewebview2.exe
564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: 35	2392	Vortex.exe
Token: 35	2392	Vortex.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3204	Vortex-Bootstrapper.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
2392	Vortex.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2064	3204	Vortex-Bootstrapper.exe	84
PID 2064 wrote to memory of 436	2064	msedgewebview2.exe	85
PID 2064 wrote to memory of 3176	2064	msedgewebview2.exe	86
PID 2064 wrote to memory of 3176	2064	msedgewebview2.exe	86
PID 2064 wrote to memory of 3176	2064	msedgewebview2.exe	86
PID 2064 wrote to memory of 2036	2064	msedgewebview2.exe	87
PID 2064 wrote to memory of 388	2064	msedgewebview2.exe	88
PID 2064 wrote to memory of 388	2064	msedgewebview2.exe	88
PID 2064 wrote to memory of 4156	2064	msedgewebview2.exe	89
PID 2064 wrote to memory of 4156	2064	msedgewebview2.exe	89
PID 2064 wrote to memory of 4156	2064	msedgewebview2.exe	89
PID 564 wrote to memory of 828	564	chrome.exe	95
PID 564 wrote to memory of 3032	564	chrome.exe	98
PID 564 wrote to memory of 3032	564	chrome.exe	98
PID 564 wrote to memory of 1988	564	chrome.exe	99
PID 564 wrote to memory of 2060	564	chrome.exe	100
PID 564 wrote to memory of 2060	564	chrome.exe	100
PID 3204 wrote to memory of 2772	3204	Vortex-Bootstrapper.exe	101
PID 564 wrote to memory of 2740	564	chrome.exe	104
PID 564 wrote to memory of 4024	564	chrome.exe	105
PID 564 wrote to memory of 2740	564	chrome.exe	104
PID 564 wrote to memory of 4024	564	chrome.exe	105
PID 564 wrote to memory of 4412	564	chrome.exe	108
PID 564 wrote to memory of 2072	564	chrome.exe	107
PID 564 wrote to memory of 4412	564	chrome.exe	108
PID 564 wrote to memory of 2072	564	chrome.exe	107
PID 2772 wrote to memory of 2392	2772	cmd.exe	109
PID 564 wrote to memory of 5004	564	chrome.exe	110
PID 564 wrote to memory of 212	564	chrome.exe	112
PID 564 wrote to memory of 212	564	chrome.exe	112
PID 564 wrote to memory of 2828	564	chrome.exe	119
PID 564 wrote to memory of 2828	564	chrome.exe	119
PID 564 wrote to memory of 1888	564	chrome.exe	121
PID 564 wrote to memory of 1888	564	chrome.exe	121
PID 2392 wrote to memory of 1708	2392	Vortex.exe	124
PID 1708 wrote to memory of 1068	1708	msedgewebview2.exe	125
PID 1708 wrote to memory of 4756	1708	msedgewebview2.exe	126
PID 1708 wrote to memory of 4756	1708	msedgewebview2.exe	126
PID 1708 wrote to memory of 4756	1708	msedgewebview2.exe	126
PID 1708 wrote to memory of 4264	1708	msedgewebview2.exe	127
PID 1708 wrote to memory of 2220	1708	msedgewebview2.exe	128
PID 1708 wrote to memory of 2220	1708	msedgewebview2.exe	128
PID 1708 wrote to memory of 5260	1708	msedgewebview2.exe	129
PID 1708 wrote to memory of 5260	1708	msedgewebview2.exe	129
PID 1708 wrote to memory of 5260	1708	msedgewebview2.exe	129
PID 564 wrote to memory of 3564	564	chrome.exe	130
PID 564 wrote to memory of 3564	564	chrome.exe	130
PID 2392 wrote to memory of 5896	2392	Vortex.exe	134
PID 564 wrote to memory of 3300	564	chrome.exe	143
PID 564 wrote to memory of 1188	564	chrome.exe	144
PID 564 wrote to memory of 992	564	chrome.exe	145
PID 1708 wrote to memory of 4632	1708	msedgewebview2.exe	150
PID 1708 wrote to memory of 4632	1708	msedgewebview2.exe	150
PID 1708 wrote to memory of 6108	1708	msedgewebview2.exe	152
PID 1708 wrote to memory of 6108	1708	msedgewebview2.exe	152
PID 564 wrote to memory of 5616	564	chrome.exe	153

C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Bootstrapper.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3204.3676.7583590412368930934
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdf7b5b078,0x7ffdf7b5b084,0x7ffdf7b5b090
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,17622262948995324118,9177900693479140324,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,17622262948995324118,9177900693479140324,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1716,i,17622262948995324118,9177900693479140324,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3568,i,17622262948995324118,9177900693479140324,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  "cmd" /C start "" C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
    C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2392.3648.13607748174970206257
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x178,0x7ffdf7b5b078,0x7ffdf7b5b084,0x7ffdf7b5b090
        5⤵
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1792,i,2132828858495606012,4454868638255909524,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
        5⤵
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1876,i,2132828858495606012,4454868638255909524,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:3
        5⤵
        
        PID:4264
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2092,i,2132828858495606012,4454868638255909524,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:8
        5⤵
        
        PID:2220
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3388,i,2132828858495606012,4454868638255909524,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
        5⤵
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4484,i,2132828858495606012,4454868638255909524,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4580,i,2132828858495606012,4454868638255909524,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
        5⤵
        
        PID:6108
  - - C:\Windows\system32\reg.exe
      "reg" query "HKCU\Control Panel\International\Geo" /v Nation
      4⤵
      PID:5896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf5f7c728,0x7ffdf5f7c734,0x7ffdf5f7c740
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,16771006958754277087,3565187027880273760,262144 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,11335926976295844402,13382833013573741370,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,10013859967213094971,16865058023341808484,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,16002879217794335221,15735023042252664854,2097152 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,3098778134402947147,3994301256238661864,2097152 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,2543293908559260781,1345331875764492479,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4400,i,18237428242319575213,13642330912039295203,2097152 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,2561040195212183274,4768301526596325138,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,11163118495034551604,2180919608715710820,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,8541237261465921796,13469627008959565033,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,2560171129985453325,8927876792708516156,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5432,i,4061537667370856116,12199065927078594971,2097152 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,15379748780407456686,78937062516597476,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4388,i,6211442736324858725,16070579524305840240,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,5688300794437018686,8848746737367323031,524288 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5180,i,10130884511880826551,5020491127258656811,262144 --field-trial-handle=1976,i,10729188055615274886,16648961164122826529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1708_1985582690\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1708_72791006\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1708_72791006\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6309ab8b23398470db2455441c24a4ca4d72920e68586c354960af8852b1c203
MD5 0daa3d146c56aa1109f87c79ed5a2fdd
SHA1 a8159501155e1cb8901b1829875d4a03fde0f4bb
SHA512 a2a203742be5635cd3b7ed76aa727021ef7d6586b8c87386e8d1d84845da60bae0397cbe590d826b73f62f8632b687298031b1d7ec62b76e3ea03586f4e4c9a8
TLSH
T155E02BB9C961EC2B28FE1718A0A54746F654135B2A40494B7A3C850CCFF5B3B9795C2C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a8a0bf9e2fdb1e4c40645709bc943a8a03fbbbf419dca2428005660b7089ca79
MD5 5bce767c0dc7783cd53dedfada77fd43
SHA1 a57c356b2f7c41c25cc15548e952c71907c14ce0
SHA512 fb8d124ac3dd84dfbd0cb61c53c8a228c4123e0d0464339a659121545aaa93a1d9e2093ed97209f10eeca4c5b0173b3eef49b51ac4ff7badf1a07c09410beb45
TLSH
T1173168B7C7D8857D890156F5BB156E1FCE290D14532C3C5AC8D4EE0B53E18B1D24068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cd69494d5c7a9e4623c814549b674b33c1402bf028346e1be822f8c534637af2
MD5 c86f3703b02540eeb38133b701599198
SHA1 a4f34d8846e37b6e59490ad5207319f3f1c6f993
SHA512 2c7ee1fad001ba5d384bc5c4f34a133d9411fca1337d6e6ffdc6c476be498185892cd8622bd4a2dd0716896be378ebe1457180f1e3ecf1c61e8f33c8d9a5269b
TLSH
T1593168B7C7D8857D890156F5BB156E1FCE290D14532C3C5AC8D4EE0B53E18B1D24068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e9c17b0213a0f21329cd2e804995b6c8f927f1e253cff7eb0dc297625326fbee
MD5 24617161c958b2e0ea8139aa8ac01b68
SHA1 4c28290dcc580b8e85d9081419ddc1e00a8bcaed
SHA512 10337c446beb6974aaa6fc015e6d75c480ff911949a641388c7a95a93a526ef24eaaf1e084c4e86508b329e7b96831f3e2429b9d79626e995286be05f2cd460d
TLSH
T1CC5189B7C3E48A7D881192F49A216E1FCD290A28021C3C6688D8EF5B53E2872D21179F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0924076c2528c938f214fc7fb44b13669e7a516eb4c123a5152c1ae924074eb3
MD5 02db4cb1dfb637eed7ee0aa5f43ba54d
SHA1 32d377c7f38c88c22f71cf24aeecc02c658e8ae6
SHA512 dba59119aa9b9b06eafb0e3702c3fbc35dfc970873dd8551229c03bb5a74f80ee181e1cd93ea4bd659a2fe3e2836b8cc536a5615bab1b982a1f3e8cf429a736b
SSDEEP 192:YuRg4HotMGv72vAPRp299THsb+WNnm90A86CwevkwdsVyIsnAUge:zRg4IlC6XuFwM0QCfvWe
TLSH
T11C32C76EA924293B5CDBD22AF9617B57E7F5103235942E84EAFC892C14DB5CC313701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d54c112c65851b6081b356c69fe6aa5e30595d9cce8f530d6001b066e2d2e8bc
MD5 14db408be1497d15da3513f704abcde7
SHA1 3b6c699e39473eb5a0f26613aae63a8a7aaa99f2
SHA512 fc71ff66ad7680b99db0d1ece88994bdb93ba69b53661f49087c279e89c311c9caec143f3a82d3d259e24ddd2713649e14db27000c919d9c9a166c6dd3fef47c
SSDEEP 192:YuRg4HotMGv72vFPRpN99THsb+WNnm90/86CwevkwdaVyIsnAUgE:zRg4IlC1XjFwM0pCfvME
TLSH
T11242C76EB914293B9CDBE229F9617B57E7F5103235942E84EAFC892C14EB5CC312701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 334e405913b94803bf630ff92d31323ce9618e9059bc4e0ab46d3b97baaef1db
MD5 4fd69f9c4120c5a09f2312ad3865b646
SHA1 f4cf4896eadcd7513586f88543db7a2ab64a201b
SHA512 c839dee66617d8ef7af0b42557df1b4505292022eec88ac9f89a980e4f40e8906942a977d9a7ad1f32eb9d23bb5257acf28b7fe724d10aa33c1b304d3a19700c
SSDEEP 192:YuRg4TotMGv72vFPRpN99THsb+WNnm90/86CwevkwdaVyIsnAUgE:zRg4slC1XjFwM0pCfvME
TLSH
T1CA42D76EB914293B9CDBE229F9617B57E7F5103235942E84EAFC892C14EB5CC312701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4ffa49ad5468a9cbf4bc9e67810dcf41c7f288230e066ec95831667b55337d31
MD5 6b64d8bcdfc0bbb34fc52498d046ecb5
SHA1 5cc1128ce9d54305ac0a397b74dda59c7a302f85
SHA512 f608e8ff2afd7fedcf15359ec1f1c6697be53655d1468bd14f115fbe09613800c4c524abe078b43acf7e5df08f38f58ccb67af24fadb786f83bf0c9bf472895b
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9VIB3Wh/+W:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcG
TLSH
T1A432D827948D9A3F4FECD55CDC526F4F6DB502A272780C2896FB9C0403AA7CE115A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 97f8fa7081606cb16f01e9eb1d61e19c8cdd76f3400b2805e17046b505582571
MD5 fb883b224471c8ef0b263d7a2b76bdaf
SHA1 50eeab5514cee35e5b740546f1070c4b8b51aa0c
SHA512 044ad33dd3588cf7dd3ef7b9e7bc743665f023e207ae66fc54aa8503776b04319477e954b9a1eef2f2abab035399e1798f2ce5c1466b183a404987163d2ea0e1
TLSH
T1A3B012118C35102BCD64C2F0505100A02330883151430389608DC070CC6B6CC7000204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597f67.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe597f67.TMP
Size 72B
SHA256 04cff5f19ffb16b47857aebc79e6fedca44da9ad6429f40da244aeec0eed8292
MD5 63e12120f75d7e3d9d62da979628e7da
SHA1 fbd1ab37191644328e075cd6e1956783036592cb
SHA512 810910a022b8529492d4f866eacc4ab3e2c5072154735ca45548ab50120dc58d4cf5f6165782ecdeaeac1380d43dffbf8f7ea1659d5f58ca740c9e34262510c4
TLSH
T139A002615B705515CD3A467070A102953261C8677EA21A5B559244689EAA7C08505102
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ca139b21f0c68e553e0921d05c477716f66a3fd560c7769e93c8f4e9129f0926
MD5 50484f373952ec951295b54fe65e553c
SHA1 bbcd5afda53add11b69b4222ec9249ce5245dae3
SHA512 d117a4d04f2648a1bcc6110c912fea69109974c6658b2a54cf6644be6749a1b90466bf988fbcf385d51609267b9811dceea76b57f307c722fe6fe67ae61fc620
SSDEEP 6144:r4j/a7Vd+pbYgrP5qAm7Rkm1tYpBeh2BAog:Um09nP5qz9oBGcAog
TLSH
T1CB3412732D759C765F1DE70C704E2B1F1EF648579D7E989149842E08A3AE3E84E09EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 0901af26a58244ba221549f0a03f4b9532b29c3ec43ee0d9cfc86484d1a3d0e0
MD5 04b8dcccc72165c840d556e6181f16aa
SHA1 5ee669d884da251416f0b4beb50af90be6b9a72f
SHA512 4a30f5c703b3e1b00f776b778e788567c3e832cf207831758cc733cd781a347b6625c7a4db89e889d408d0cc8beeeecf66f22813195ccb54dcde9b5066b35de3
SSDEEP 6144:Mrj/a7Vd+pbYgrP5qAm7Rkm1tYpBeh2BAog:Sm09nP5qz9oBGcAog
TLSH
T1CB3423731D79DD365F1DE70C604E3F1F1EF64C569D7E94A14A802A09A3AE3E80909EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c4f242d71133d3da6f7938a39d9d6c8074f94cfa097c82c23d66ae7b203fc4d4
MD5 d7b08154e4e3e48dc567e9e238702a37
SHA1 d2070a440fab21749821654aaf45913d0fa98c9b
SHA512 c0f6807c531f0a7a7386fe6e3788142af81857413b7219e88fcc2c823aee470a93592e5adbd7079b67bf8c5b135248ca599faf3ea713e77f1f155231c1c83519
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:im7Rkm1tYpBeh2BAom
TLSH
T19BC3123B5E74A9775979B74EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 a958a6f0941fb148ebe9532d8da26fba649d3b0bc91b2c480a1287b79f964cd9
MD5 3240ab78dd5253737d911afacb9be55c
SHA1 cd71fb2502a8fc7aeaf12f97643d74b251d22356
SHA512 d9a935111d70158013eaa478777517fb85fb13f7623656ac072d7bc8f2e05b648ed8764a1d5ee674703e55c485acebd6a72c8e763f84887c47843bfa66902c43
SSDEEP 6144:Trj/a7Vd+pbYgrP5qAm7Rkm1tYpBeh2BAog:rm09nP5qz9oBGcAog
TLSH
T11D3422731D79DD3A5F1DE70C604E3F1F1EF64C569D7E94A14A802A09A3AE3E80909EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ab675cfaa3837dd17e2c02c2659ab577cad14a0485c3e623baa05ab7bec72d32
MD5 f12b0a653dc9ce1245eacbeffbe9aebf
SHA1 e9633ded6c0511dcda4567f2e4203b5b47a9c34e
SHA512 eed094335c530674ae9b283c9d9e7c45c4e556fa9538f1f3992ecc667fea7d92a30987361ddf9a280ec8e507a98ad202e80f4223a1c0de9b73787bd78dc51a39
TLSH
T19A413B49AAEA1144B3B76E069BF6686E887FB8772E07945D10010E4F0B73B44C962B37
MD5 SHA1 SHA512 TLSH

Submit Download

Vortex-Injector.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Injector.exe
Size 36.6MB
SHA256 5b1ac74fde5a19912c3f6bc8fe4ab8215ffc74258893278e5d700ce79ceb9f83
MD5 61f3c04dc517609f21a0a390d47ced8a
SHA1 136d118ee224a85b7becb1dd8e739373816f5db7
SHA512 de65e0b6dee4406f3d8dc3d0c9725592a1c7265b21347b8e0e2fcf97d27535b4c6f5a10f5c5eacef941029ebb0a95c3d0146ce1c94099b926adc7d0f38395df9
SSDEEP 786432:FRBLuMk3V6xQbCyOblJT09xF9q9+WxL18owQ8xYjazDxs:FfklkyOT09Q9+WPMssDG
TLSH
T18587235779D5A3E5C0C30504728F429F72C0A57DC2EE8A2D3AC76C037A61DA74A8EA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex-Module.dll

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex-Module.dll
Size 7.2MB
SHA256 1d33d90286244108a366929511b3723284abc81998d393ed878e7583591df8cd
MD5 36db165450f1cbb9aafeea98ae1573f1
SHA1 3ac0b254efa1b691f69a1f7eb8c004bf0c34bafc
SHA512 509ee5a6ee0c27e10a11e2602c81959e4d904b9e40f82770162982e2447245862515ed5273b4a322d0bd70426f15d0cbd78edc737fd4c7ba13ddde393093d22b
SSDEEP 98304:3ajQL5QX7fFGEk0LsF0ClsNV9XDJi3350lFXE7RM02fe0xpxBgu1DHp1d27b:36QtQX7dLgYVRg5mE9122cAwnd27b
TLSH
T10A7602127AE520B4C0B3DB3287CB935BD2D272A69B975A4F168159022A33DD39F07737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vortex.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\Vortex.exe
Size 19.3MB
SHA256 6bd6e88328d5824680ca0c222b59681155af92922f295d04e9accce96b345fae
MD5 43714e7e4db89a59e2eb8074eda0b85b
SHA1 c24e6f62cda4388dab8f7a21a33ac6018d1a1432
SHA512 1805e006f9c7c62aa82e96f3c65e91cc2a942145926d87c38af80d4cb4fca84c7b0789e5521225a8a71eef4983d4dfad21ccfb42bd80f841f1b790276a3f1372
SSDEEP 393216:GZsnal75GPlkTAzuZj15xLZPhjsM1VfTwvFk31XzvMwSG8:znPoZj1LLZPWMbqFk31XYwS9
TLSH
T13B17235A51E9A6DCDB8222D5354A40CA30D0985DC0FDAE283FCA1C13BD68D7E49CDEF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cur.txt

Path C:\Users\Admin\AppData\Local\Temp\Vortex\cur.txt
Size 9B
SHA256 ea10aaa8e65335567dcb91691a2ffacbc42f58f433cb61f3b0586ab8470640e7
MD5 b45b050cd74c5f739740d741678290b4
SHA1 e4c755f3e7f4c1105343a4b5708aab6ece434be0
SHA512 259ef2227a127281a1d43a9f5393d4ab559f01d02b99c880df5d02ccfc32a71dfad0bc46868e7520b4b474a3021d83375af1f19025a066531e6cfe2588269b38
MD5 SHA1 SHA512

Submit Download

external.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex\external.exe
Size 350KB
SHA256 4c298a14fca9e45a05e0e5a64750eb5b5337d6333358dec7f3a1e9bf341b8d9e
MD5 b87fd10ecca7a4a63b3be432371d5fb6
SHA1 3fc40bef0980b95186c9f7470e305b4c2ff2a3ca
SHA512 93505b0afe141153db8d12c11554cc6a7ff8db046a4b4674d238d05216b128cff343dfc616a9f45d6fa5f353fa76719d8649c9b7cb6235b545f5f484deeb5e9d
SSDEEP 6144:W9l4o8bVqooBGI2BH9HiRQpPs5wGp8p7aD3WDz+yX8WsJDiznasfkZG9xnsOZrBO:W9l4oaxoBGI2BH9HdpPshiZbDzLX7Jfy
TLSH
T1B47423A3F0E065F5C6E10B7971FEF5233987097300B8C65B785EC69292806A59ADC37B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98c650eb-d792-45a4-adaf-681fe76149d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir564_1508672971\98c650eb-d792-45a4-adaf-681fe76149d7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir564_1508672971\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c4c5cad41866bdea09e4acb2fc748fb778e3a8464c68bf0f9066b6dd39faac7c
MD5 d6b9e3db3ce770c98b9d446224e35dce
SHA1 b7af7c7f5bf81f80bd52c456a943604af1812c80
SHA512 4bd2f5fc929f5ca734e8b4b0d7d084de9772d6ec45e9fad1c0e7893351291ecef8de145879109c69f059fc58bccf57cfcdaa4a87294d3bb98b500c99c074b4e2
TLSH
T171D0041453015515D0003071045045D74304C44101111504401C03140D410440505577
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 760a6d8d17750f7f3ba3e48c42632c7b8f98c16621b67e5dba4d65f7bd22eb73
MD5 7db26d81f7781fa9719a26e535243985
SHA1 8cf008ecf16ad0c81d2ce046ef67661b9c5b36c2
SHA512 1bd5717a9f56368b83ddfc0db21980c409098ab4fc48e993f45d0e727c69711c6ef19c00fd8d5fc14cc84349a7e959dd62bb20589cf93c74b08a9360032fb3f5
TLSH
T17CD0121633024638C01030730442658E0600C10B41054004942C872D1F040940E068B3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58faf5.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Network\Network Persistent State~RFe58faf5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Preferences
Size 6KB
SHA256 c83e94f9bd8f9c3301fea99ea5ca5df86a945f65aae13574a995eecdbb5fae22
MD5 5b08d9df92c5dd8c52c121e5d507ada6
SHA1 b5e85cd56ba0738e3bbc96a3fea5e9ccd3bc426a
SHA512 9d2eb5f4e40cf09b2edfd00f7e5965d29332fabdfd6cc1d0703c857cac167dcce46fc1a66b8ff2d6b6622b3b933aeb9c14d11adcdee5509995e85b704c138644
SSDEEP 96:stj505W+dRTb9Wzffq5Z8i0vhEHktSm/7qx+WVHMSm+uecJTw1idQjo+g+3TIxK8:stj50gY8zfEZ8paqP/S+WiTTwwddEeK8
TLSH
T1F4E1A7029E28797B4CCBF619B935BB52E2F9106261D55E48EBFC851C04EE6CC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f911.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Preferences~RFe58f911.TMP
Size 6KB
SHA256 f8dd18a70cd1a942fb73bcbf598318e602f0d150a13c9ed4e23daffacf733565
MD5 3698898a9a1923eae4fa26be9fb20595
SHA1 6d096a9af1ec376f427d27f557a5f8d95cc96f09
SHA512 63acf826da734f6bf89251a5434f6e8418a5343b324b68b0ed895410c1bed1a42f625063175ce68bcc7e0a61d0b7c34318132fc34ee393227debb2d1aa562c4e
SSDEEP 96:stj505W+dRTb9WzffJZ8i0vhEHktSm/7qx+WVHMSm+uecJTw1idQjo+gUqaMEB:stj50gY8zfxZ8paqP/S+WiTTwwdd5aM8
TLSH
T1D2D1A8425F6879774CCBF619BA35BB52D2F9106261D51E58EBFC861C08EE5CC220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Local State
Size 1KB
SHA256 70f1115c3a0d966bc2bf611e7109f9f238f76301f1fe0572732c2bf037c2c9c6
MD5 074868593744ceed06e133b9bffc3800
SHA1 05ca487fa984be22969b7c4cf815d3bda241f862
SHA512 d6794f83b117548d33a59500247d5e91236cdeede13275519e21248cc44a122d809628f71dd9cdee1d8de43c1efef05eee7ee5d41de918c74cbcde5d3bd42c98
TLSH
T17031B773D458FB31789161C5B1466F873E34003AC0624F04A6DD4B1805DF1CCA52AC2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Local State
Size 2KB
SHA256 8531b14dd0385e92bbe879d2e3091380ac9f102a87b398f31f3fca7374affa1d
MD5 e61d06dcf286f11867135fc21a7cc45e
SHA1 986cf20e32348833e8774b28ec6c7731b2c8bdfd
SHA512 a7223d526a96ad8b08b22622f5ea90ba6fe1f1d02f790dec80bb72ea01d480638975211d5e14804d2023122c41f0cc3f8939f9fd1a3c8de1e6679ed63bfdf393
TLSH
T15651A873B81CFB3799E39584B94A3F13AA3D513695632F50AADD0B1C00DF19C2306C2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Local State
Size 3KB
SHA256 50d650d1b75c456aadf40cc367efeccb6ad956cac8a97f1cea7ce873947a5c95
MD5 cca11137c50d6fe0a8122a952b197085
SHA1 b07301d450e3b506faa467ca4a52a18e46ca92fc
SHA512 205d49f814e66ddc8ca98430ef2c35d93ccd6e7dc41263dc927f8288c8912cecb56a2aa6a665c04746729b30a059298cb724ee1b753fc9fcf7feba64e8ea81ed
TLSH
T1F6718636A868FA375DE29944B8862F16B7791137D5923F65D9ED0F0C01DF2D82302C1A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Local State
Size 16KB
SHA256 57416ba7ac4bfc0398ef34fa0b2239f0720e73798b754bbe9701a0e74e519913
MD5 5fd34726ba531acbf3756c0d5abc7580
SHA1 0656dbe15ca2f86de983ad0751bd74f3fe8bd3a8
SHA512 9eafe4253d9ca2ee5d070275d16085290892f400cfc3a232249de0051c24d54d5f9b66cd925bc0b5ac858222c40fa33be1e0b41541182361e70ab36e3207bbfa
SSDEEP 384:ze+aQikB+z/xvxjg/qhE8NbfDgSetB79zB:V/UxvxjgC+Y0B7FB
TLSH
T131728D2B556CBE36A5F7F54579480B8BDBB8947290C26FA84EED5F09069F2D80303D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Local State
Size 16KB
SHA256 57be8a0dfd1ff6a0c76bb3f244aa98bdd154d26e1c89a0fb583d3d53527e87b0
MD5 09aacc185eda0650a44fb288ee2883d0
SHA1 bc89ee666aa5283c4b95506e791263de45da6891
SHA512 8592e6d21bc17cacb04797ef1b06a70d18d17271d5706f9f4504eb3236db0a6fbc0005d44193ebfe5b494028a8e0103e79cf0a8350b2904d3892c4b51dde2020
SSDEEP 384:zT+aQikB+z/xvxjg/qhE63NbfDgFetDp79zB:G/UxvxjgC+6Y0F7FB
TLSH
T1B1728D2B556CBE36A5F7F50579080B8BDBB8947290C66FA88EED5F08068F3D80307D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58bcf2.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Local State~RFe58bcf2.TMP
Size 1KB
SHA256 f0a8d87a642d8a2736c4b013784cb4167aae87a6ae785db220e17586e23e6771
MD5 cbf4a6ce7d0c5e29f598b9e064eaf690
SHA1 e85ecba17d8d5894b9702313b21b36fe2fe7ab58
SHA512 a38fd84690603ac65d7ddc3ec70d53e81daf1db1b2194782a83825b6011f6c2f393b2a8235e10f8e507b31fee0a40799cf78fddfb119d5b175a65914e2f85b62
TLSH
T190219277C4ACFB3579955495F242AF8B3E34003A81628F08E6DE461805DF0ECA62BC3A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bf027ddbab287f10f5280a6305688c56606e49e78d7b001bafd94936755d4d6a
MD5 0fc5e79a9ceb6758991174de19098935
SHA1 c933822b61f5825312f31632e20b9b65191252f3
SHA512 f3ca3752c45cb512032c540a848ac12a2817502567aab2e7915d7a4949574ec276d6b6497e04f2b48944f0eae3fa460415cbf1777be8c7bb3ef1359524e25bf4
TLSH
T124D00454D1531D04D14C1131035C550443505440515701C05151740C044413340450C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2a5460a226b0efbbb2519057dbe3afd4996e7badfa3079819a3c782714da03a9
MD5 558a3e57b0996797585bf6b2b9ac156f
SHA1 4e6f57ba0ccc043a8b142c23dda0470afebf2bfd
SHA512 b28bc50bb6f1de29152d60e5baf142059d3266c7ac2a9498ad956dea66519acf14b1ee5636828555e7677a1cef1a65c1d8b882bf908e61c24147823e17c8b066
TLSH
T1EED0121672530A38C01821330246750C0540D10B814A40C0A429E91D1A0807109064C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 218eebe375851781c3757766d19eee5508f05a1465c80096294082b85dd0d34c
MD5 5834a41d92a66d0c2cca3981ebcbe6ce
SHA1 b9dccddf80c83c6e87f774f839a5b6d1cf86db77
SHA512 703405f5b1bc1448563f60c3f96414686cc9f9af532323d54767a996154b6fbd93dc5530bb91ee7c4cd6f9414f4408bb1b09b54377a287ae6a390360060cd77c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 aa66c0d243ede1c0deb1cecea8b04583ee052fae2b8e47b71b487a0b47c8dec3
MD5 a57040696566afd35d0bb1915c4f4a38
SHA1 43c50789e7a1c12abd24088184becb7df604d434
SHA512 0a7b9aefd14703e8e16b926c42467ab437ad6372d70ccaaf02f7ebf49b1c096f10753fcd1f86a6eb11d0a3e39d46561fd5a5cfde7b0b2d0378fd813de2d66a44
TLSH
T158C09220EEA0241BFB9822B112AA59A46379681C138203D7205281B6B4938A8B5D22A7
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 b531348a22782d9b8cd83516e22bd2110133067969dc247d46a8f01e72082dca
MD5 f288e98abcbe1550cf297cec8bfe1d6d
SHA1 a2ac8a6182785f2f385a40e44407243ed57f9c1c
SHA512 9aeb0d3a123b5e3f294e96814b85dc5d7a5cf59a8ce2bee98a5fcd35628cb8f46ff177057c3be0c5cc7c2d55577358608fabc636a1d6dea42d2d1a57cab53a44
TLSH
T1B1419DA683E4C66D8A4166E427347817CD2D052992282D37CDDBFBEA6BD2071E21164F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Preferences
Size 6KB
SHA256 2b45575a439ca7940b7ac46327f8371a930f5fd4832586f83b25c8b24f302a89
MD5 74215022db19df07a9c1563387b36972
SHA1 89368cadfaec73e5f561afb9404e344ffedd5ebe
SHA512 403b25a2594af2f164435d6ecedd379ecc7256e01d458de4b470b260a7d73debc4c04125736216474f6dcc6f7ea6f7c855c65aa43813be9401d621fc0f26f670
SSDEEP 192:stE0uBv+f8HZ8paAP/S+WiTYEwxgU75TOMC:st1uBWTf/VfwxhC
TLSH
T13CE188429E28797B4CCBF6197A25BB16F3FE102261D51E58AFFC861C05DA6CC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c6f0.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Preferences~RFe59c6f0.TMP
Size 6KB
SHA256 8dbd2bb6da6ad8ab67242a20adbd39d3c911be76bbdafaf2defe8fb2823b64b0
MD5 ee00685114fd56b6e1b04bb7e3a44bcb
SHA1 39092c5670f8b0ab6bfa30572266c101f364584d
SHA512 38ad8b35a5716827be917839c6c8bd15b7cd9e7c3d820cb80215c8237014ac76428eaff8841dd691b0179a194616bb98fc386eacd9b3202d79a36cb4b28db438
SSDEEP 192:stE0uBvAf8HZ8paAP/S+WiTYEwxgU75POM8:st1uBoTf/VfwxF8
TLSH
T10CD178429E28797B4CCBF1197A35BA16E2FE102261D51E58AFFC851C05DA2CC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 16KB
SHA256 1847370201ed99723d0bbae6b3c0be6d881be5de166eb17b2f96f72013c07bfb
MD5 7854772f19d63671eeabc1fa31a02a9c
SHA1 9197272bf656edc3966f97d465271bcb9c9c4c31
SHA512 12714bbd0562f4a3a132d3f3e025a8a262c7d2973070ddf438ce71855cf3f32e9bd05f20495b462d6e76da695ec25caa11bf69139d6e64b4f6bc719cf9f317dd
SSDEEP 384:z6+aQikB+z/xvxjg/qhEyNb7L8JvjAMfbNL9zD:5/UxvxjgC+tXfxLFD
TLSH
T118729D2B65687E3359F7F6057A580B4BEBB994B290C16EB84EED5F0D06CB3D81302D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 1KB
SHA256 78c23748d92b902e08d8a6a22e0e510734f4085e5fa9ecb8c4e13e0664acdbca
MD5 dad0c8cd79bc5fa5ab799f82c60d650f
SHA1 294374219d876b7ac77a10cac2b47ecb14ee664a
SHA512 3c1b86a9ef8834f2d323f5e5b8f4d028e5767a7ade555e29f4c23dbe60ea762b652beb4b40cb463011034d026db123621c3b30da008ed51fa26699bac454b561
TLSH
T134316273A8A4BF356D8A66427252AB473E26202EC1548F1495DD071803DF7CC562DC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 2KB
SHA256 e5a2302fc5449be40826a1563431a24e7208245ce13821d364fcff7578884a7a
MD5 4387485fa2388cc9a4c5a5642b78026e
SHA1 ae4eeae8f6061f56b947b91934448ae862d2d017
SHA512 8b909f5803f684ac0e561e598243a21517eed5ac15dfa9f63e14b25a6031c5a788742721f0d3fa5c4e0cba0e3413a4292cf34068cf344d7bb60fe4664e14828b
TLSH
T1085184337C58BB3689D69A447A462B12BA3A506AC5562F609ADD0B0C02DF3DC2305C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
Size 3KB
SHA256 76c233fc7030a0276f57068dbad6a284185e720ddeb8b9ee9a8aa3cc4d773349
MD5 6a392a467f41e23e94733cca778b8387
SHA1 1830071fbb32791e770d9d42e74ee9402106e057
SHA512 4e7a61d52ea0af3ddcbb7faf4cb6194abedcdf42985b49faf3233f6330188c9686e1fa0d39312f1ef998bf1add62b717801274a535b5581d99e25ebe46e3fcc2
TLSH
T1007186276868FA374DE79940B9862B06B7AA502BD5953F64D9EC0F0C02DF3C81345C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe592a42.TMP

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State~RFe592a42.TMP
Size 1KB
SHA256 396806038170cfc103d0550abdf40d1eea88f588c7cc4d0d14f044b34f5fbe44
MD5 a42a6a4bc209dd3f26d55ffb6d1a246f
SHA1 2ed49345e55645e5488b47336042c0a0e36034ac
SHA512 4ec4f29774a6b0176690e7ce36bbd624755f2f2fce5a6680a50abdd0ffadf48c065f7147f88a335742648d4e8349728f1f602875ba48b22038d3342232a87da5
TLSH
T1C7216273E8A8BF356D8A5951B252AB8B3E21202EC1189F2895CD031903CF6DC472EC33
MD5 SHA1 SHA512 TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-55-0x00007FFE12F70000-0x00007FFE12F71000-memory.dmp

Download

memory/388-56-0x00007FFE13630000-0x00007FFE13631000-memory.dmp

Download

memory/2392-514-0x00007FF72EC50000-0x00007FF731ADE000-memory.dmp

Download

memory/2392-512-0x00007FFE13B10000-0x00007FFE13B12000-memory.dmp

Download

memory/2392-513-0x00007FFE13B20000-0x00007FFE13B22000-memory.dmp

Download

memory/3176-33-0x00007FFE13800000-0x00007FFE13801000-memory.dmp

Download

memory/3176-227-0x0000021E7D200000-0x0000021E7D2CD000-memory.dmp

Download

memory/3204-252-0x00007FF65A650000-0x00007FF65C655000-memory.dmp

Download

memory/3204-323-0x00007FF65A650000-0x00007FF65C655000-memory.dmp

Download

memory/3204-0-0x00007FF65B0A6000-0x00007FF65B7B0000-memory.dmp

Download

memory/3204-7-0x00007FF65A650000-0x00007FF65C655000-memory.dmp

Download

memory/3204-232-0x00007FF65B0A6000-0x00007FF65B7B0000-memory.dmp

Download

memory/3204-1-0x00007FFE13B10000-0x00007FFE13B12000-memory.dmp

Download

memory/3204-306-0x00007FF65B0A6000-0x00007FF65B7B0000-memory.dmp

Download

memory/3204-2-0x00007FFE13B20000-0x00007FFE13B22000-memory.dmp

Download

memory/4156-228-0x0000014BD5010000-0x0000014BD50DD000-memory.dmp

Download

memory/4156-153-0x00007FFE13800000-0x00007FFE13801000-memory.dmp

Download

memory/4756-946-0x0000028499C00000-0x0000028499CCD000-memory.dmp

Download

memory/5260-963-0x0000018434200000-0x00000184342CD000-memory.dmp

Download