Overview

overview

8

Static

static

3

Vortex-Boo...er.exe

windows10-2004-x64

8

Vortex-Boo...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    900s
  • max time network
    656s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/10/2026, 19:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Vortex-Bootstrapper.exe
  • Size 14.6MB
  • Sample261009-yn6gmsbv2p
  • SHA256 4ac1c40118de6166bece58b04ec937c4b9975a5541e4ea96eba9d7ba87a48d33
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywarethemidatrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs
    defense_evasion
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vortex-Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Vortex-Bootstrapper.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3904.5624.1839650368146040513 /pfhostedapp:3dcc47e4ae4f0fd6082f5c9c7f21b5844b6fe682
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView /prefetch:4 /pfhostedapp:3dcc47e4ae4f0fd6082f5c9c7f21b5844b6fe682 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff921745fd8,0x7ff921745fe4,0x7ff921745ff0
        3⤵
          PID:4020
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,15725021771795339285,10581834463274153574,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3dcc47e4ae4f0fd6082f5c9c7f21b5844b6fe682
          3⤵
            PID:4016
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2016 --field-trial-handle=1804,i,15725021771795339285,10581834463274153574,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3dcc47e4ae4f0fd6082f5c9c7f21b5844b6fe682
            3⤵
              PID:5688
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1804,i,15725021771795339285,10581834463274153574,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3dcc47e4ae4f0fd6082f5c9c7f21b5844b6fe682
              3⤵
                PID:2852
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView" --webview-exe-name=Vortex-Bootstrapper.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1804,i,15725021771795339285,10581834463274153574,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3dcc47e4ae4f0fd6082f5c9c7f21b5844b6fe682 /prefetch:1
                3⤵
                  PID:408
              • C:\Windows\system32\cmd.exe
                "cmd" /C start "" C:\Users\Admin\AppData\Local\Temp\Vortex.exe
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5080
                • C:\Users\Admin\AppData\Local\Temp\Vortex.exe
                  C:\Users\Admin\AppData\Local\Temp\Vortex.exe
                  3⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Enumerates connected drives
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Reads the TCP/IP host and domain name from the registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3856
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3856.4548.8819597606139637831 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                    4⤵
                    • Drops file in Windows directory
                    • Enumerates system info in registry
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of WriteProcessMemory
                    PID:4996
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView /prefetch:4 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x50,0x7ff921745fd8,0x7ff921745fe4,0x7ff921745ff0
                      5⤵
                        PID:1372
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                        5⤵
                          PID:4948
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                          5⤵
                            PID:4384
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                            5⤵
                              PID:4896
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3368 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232 /prefetch:1
                              5⤵
                                PID:5004
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                5⤵
                                  PID:3432
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                  5⤵
                                    PID:2384
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                    5⤵
                                      PID:4908
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=840 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                      5⤵
                                        PID:3424
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4268 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                        5⤵
                                          PID:4192
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4636 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                          5⤵
                                            PID:4292
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                            5⤵
                                              PID:3436
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4696 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                              5⤵
                                                PID:788
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4740 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                                5⤵
                                                  PID:1744
                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                                  5⤵
                                                    PID:4180
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1056 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                                    5⤵
                                                      PID:4724
                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4860 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                                      5⤵
                                                        PID:3236
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView" --webview-exe-name=Vortex.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4740 --field-trial-handle=1780,i,16008888877410592161,14197570040085479361,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85baa7c30a6baf275dff01066390dd1a4ff46232
                                                        5⤵
                                                          PID:852
                                                • C:\Windows\system32\sihost.exe
                                                  sihost.exe
                                                  1⤵
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3960
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe /LOADSAVEDWINDOWS
                                                    2⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2720
                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5056
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5820
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                  1⤵
                                                    PID:5360
                                                  • C:\Windows\System32\SecurityHealthHost.exe
                                                    \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                    1⤵
                                                      PID:3784

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          prep_Activatable Class_Hermes_perf.cache
                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                          • Size 607B
                                                          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          prep_Activatable Class_Hermes_perf.cache
                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                          • Size 595B
                                                          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Vortex-Injector.exe
                                                          • Path C:\Users\Admin\AppData\Local\Temp\Vortex-Injector.exe
                                                          • Size 41.6MB
                                                          • SHA256 3d831d642db59c579621e3cf218a62f457ff1a1cb14a2fe8422825948632e27c
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Vortex-Module.dll
                                                          • Path C:\Users\Admin\AppData\Local\Temp\Vortex-Module.dll
                                                          • Size 8.2MB
                                                          • SHA256 23d74ad57e23f554d7ac7c310f917ec77084b3e7e3813834826ca132006d2fb8
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Vortex.exe
                                                          • Path C:\Users\Admin\AppData\Local\Temp\Vortex.exe
                                                          • Size 19.9MB
                                                          • SHA256 22680642202a499ae75862a36002ce2e98de3e6f33769d4c1e71b554152bbe11
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          cur.txt
                                                          • Path C:\Users\Admin\AppData\Local\Temp\cur.txt
                                                          • Size 9B
                                                          • SHA256 ab0134de38a77388387b6cf2631fcda66f85d56bc97696aff6fd756833f5ad0f
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          external.exe
                                                          • Path C:\Users\Admin\AppData\Local\Temp\external.exe
                                                          • Size 33.6MB
                                                          • SHA256 353ae3fc4804d809971ad74e86b45414259aebad4972c825787f7a62430b5f90
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          1ef59215-cd9d-4cd2-8911-9a290c5ada3c.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\1ef59215-cd9d-4cd2-8911-9a290c5ada3c.tmp
                                                          • Size 3KB
                                                          • SHA256 b52f00ef1d2ab7eaa8f1d8a5be365612a0b58f69908e2f3c1190b197662e07a6
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          25784296-82bd-45d8-9b0b-a62a74d1722d.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\25784296-82bd-45d8-9b0b-a62a74d1722d.tmp
                                                          • Size 15KB
                                                          • SHA256 66d25edb787f9553fe35b37e6df22ac2022e81e10f08a1f9cf6100e8c16e18c8
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 dda318a1dd3e396fc02e9d5fdd06bcc53751f7b37b80165d8f147fe1fa33598f
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 7752582479cb535ad75f3aab6d01c7731edb330c71a27dda68dcc16d9f9ac944
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 14b89ea9e2f17c77083d3f5964907d098c575cd0e18a1fca57d227b9e1362863
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          throttle_store.dat
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Crashpad\throttle_store.dat
                                                          • Size 20B
                                                          • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          89516a70-ed0d-48eb-9a88-1fbe4be0f416.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\89516a70-ed0d-48eb-9a88-1fbe4be0f416.tmp
                                                          • Size 6KB
                                                          • SHA256 151fc7af3d3cc706062a302e90004ddf39dcd7579c679d2562a2ed3d43756b02
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          78c1e5d1-e088-4b05-a39b-b8da88b0c62a.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Network\78c1e5d1-e088-4b05-a39b-b8da88b0c62a.tmp
                                                          • Size 111B
                                                          • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Network Persistent State
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Network\Network Persistent State
                                                          • Size 59B
                                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          SCT Auditing Pending Reports
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                          • Size 2B
                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Preferences
                                                          • Size 6KB
                                                          • SHA256 bc45fc436290536dd6070fb5cacc0927bef60967bc86500372e5efddc4d1056c
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          CURRENT
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Site Characteristics Database\CURRENT
                                                          • Size 16B
                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          MANIFEST-000001
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                                                          • Size 41B
                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          data_0
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\GrShaderCache\data_0
                                                          • Size 8KB
                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          data_1
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\GrShaderCache\data_1
                                                          • Size 264KB
                                                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          data_2
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\GrShaderCache\data_2
                                                          • Size 8KB
                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          data_3
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\GrShaderCache\data_3
                                                          • Size 8KB
                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\Local State
                                                          • Size 1KB
                                                          • SHA256 b0ea026394666a6ece6b8ca35f40b5866acb919ea118be583cf837bb6ba4e61a
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          b5461a51-ef16-4770-828e-438be5b18a11.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\b5461a51-ef16-4770-828e-438be5b18a11.tmp
                                                          • Size 3KB
                                                          • SHA256 3eeecd8a9e88119e3672280c09acfef4cf56e44e1d6b1576a05e96f0ecb6707f
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          c03efb2a-7520-4877-9a49-cfd66d546806.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.bootstrapper\EBWebView\c03efb2a-7520-4877-9a49-cfd66d546806.tmp
                                                          • Size 2KB
                                                          • SHA256 3ab46f0495ced200b9a1b8c6ba3f472d88db6fa3fe85ef6f810190e67602cd9c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          4f074662-23c1-42a3-b978-9f6541d740db.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\4f074662-23c1-42a3-b978-9f6541d740db.tmp
                                                          • Size 2KB
                                                          • SHA256 8d36e384f432185e1dd4ca728f2f93a83d9b4ce17f433aad42042ac57c841c89
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          67700a79-603c-48ce-a481-018b7279cd58.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\67700a79-603c-48ce-a481-018b7279cd58.tmp
                                                          • Size 3KB
                                                          • SHA256 dc2a0c5638d91eb2038ba0eec1c5aaee40f8de01d381af6e17848b5f3fb811d8
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 38f0231ca7e70b026ccca975f8b53c7a6f3afc03743de2813a4139bab9a3eeff
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 a03f709d51502a132081f28049281d69ac9caf4c5a4f4a4a44f22c896cd5ee96
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          16db14da-d11f-4047-9680-e41b7068478b.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\16db14da-d11f-4047-9680-e41b7068478b.tmp
                                                          • Size 6KB
                                                          • SHA256 8612c9ac5cc4dcc7284b077289f84575c8058de21c472dabb9b52f9cc4cf0431
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          index
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\index
                                                          • Size 24B
                                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          temp-index
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\index-dir\temp-index
                                                          • Size 168B
                                                          • SHA256 f94cd2aa4367937ec82368f013688d7fa447e473da86e535c6495b81eb0c522f
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                          • Size 48B
                                                          • SHA256 3a61d25df4ae1ff2509b2de7900e6883d6d7d850fd249612ee0f633cf07d2426
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          ExtensionActivityComp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\ExtensionActivityComp
                                                          • Size 4KB
                                                          • SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          676f924b-fe42-46aa-b3a0-ad01b8454bf9.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\676f924b-fe42-46aa-b3a0-ad01b8454bf9.tmp
                                                          • Size 1KB
                                                          • SHA256 a5236bc1585b4d9e718319d8c7a8d51727a41cca47cbdaac277ccaa024c6bb8a
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          9fde1279-7abe-47ce-87f4-997287c3a872.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\Network\9fde1279-7abe-47ce-87f4-997287c3a872.tmp
                                                          • Size 40B
                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          d2a62f8d-1f69-4ffc-ae82-ba832b14f075.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Default\d2a62f8d-1f69-4ffc-ae82-ba832b14f075.tmp
                                                          • Size 6KB
                                                          • SHA256 9b4ccccc807bd0d08177318933bace9e4c914874a4310c9c045f98582f9cf6e0
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\Local State
                                                          • Size 1KB
                                                          • SHA256 1889cdfe97d8e5d6ea91559eff45f64e026f938da73e7866017571a35077f32b
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          ae43ab84-5d02-4e30-ad97-c4d2443e131c.tmp
                                                          • Path C:\Users\Admin\AppData\Local\com.vortex.executor\EBWebView\ae43ab84-5d02-4e30-ad97-c4d2443e131c.tmp
                                                          • Size 15KB
                                                          • SHA256 c8763d13c2d1a646748618b7f0f043c389ee515e3c84d62ee1c747de53bea2e7
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Vortex.lnk
                                                          • Path C:\Users\Admin\Desktop\Vortex.lnk
                                                          • Size 663B
                                                          • SHA256 79e11d8379389ef34c3d82ea0b651dee68c3ad0a7d0896dc43bf90fe12128466
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Other
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_10552020\Sigma\Other
                                                          • Size 34B
                                                          • SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_10552020\manifest.json
                                                          • Size 132B
                                                          • SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1373163233\manifest.json
                                                          • Size 116B
                                                          • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1502812064\manifest.json
                                                          • Size 113B
                                                          • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          hyph-as.hyb
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1519957081\hyph-as.hyb
                                                          • Size 703B
                                                          • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          hyph-hi.hyb
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1519957081\hyph-hi.hyb
                                                          • Size 687B
                                                          • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          hyph-nb.hyb
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1519957081\hyph-nb.hyb
                                                          • Size 141KB
                                                          • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1519957081\manifest.json
                                                          • Size 82B
                                                          • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1630643245\manifest.json
                                                          • Size 108B
                                                          • SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1672066339\manifest.json
                                                          • Size 78B
                                                          • SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1852510004\manifest.json
                                                          • Size 102B
                                                          • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1872726394\manifest.json
                                                          • Size 1002B
                                                          • SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_264153918\manifest.json
                                                          • Size 69B
                                                          • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_433918858\manifest.json
                                                          • Size 135B
                                                          • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_665239249\manifest.json
                                                          • Size 43B
                                                          • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_806421671\manifest.json
                                                          • Size 76B
                                                          • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          memory/408-197-0x0000021E44A80000-0x0000021E44B96000-memory.dmp
                                                          Download

                                                          memory/408-99-0x00007FF942760000-0x00007FF942761000-memory.dmp
                                                          Download

                                                          memory/2720-1662-0x000000000F390000-0x000000000FC0B000-memory.dmp
                                                          Download

                                                          memory/2720-1603-0x000000000F390000-0x000000000FC0B000-memory.dmp
                                                          Download

                                                          memory/2720-1342-0x000000000F390000-0x000000000FC0B000-memory.dmp
                                                          Download

                                                          memory/3424-765-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3424-769-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3424-768-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3424-767-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3424-766-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3424-760-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3424-764-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3424-758-0x0000023F6C2D0000-0x0000023F6C2D1000-memory.dmp
                                                          Download

                                                          memory/3432-685-0x00007FF942430000-0x00007FF942431000-memory.dmp
                                                          Download

                                                          memory/3432-686-0x00007FF943980000-0x00007FF943981000-memory.dmp
                                                          Download

                                                          memory/3856-379-0x00007FF9443F0000-0x00007FF9443F2000-memory.dmp
                                                          Download

                                                          memory/3856-380-0x00007FF944400000-0x00007FF944402000-memory.dmp
                                                          Download

                                                          memory/3856-381-0x00007FF683470000-0x00007FF6864FC000-memory.dmp
                                                          Download

                                                          memory/3904-238-0x00007FF736180000-0x00007FF738185000-memory.dmp
                                                          Download

                                                          memory/3904-242-0x00007FF736180000-0x00007FF738185000-memory.dmp
                                                          Download

                                                          memory/3904-228-0x00007FF736BD6000-0x00007FF7372E0000-memory.dmp
                                                          Download

                                                          memory/3904-2-0x00007FF944400000-0x00007FF944402000-memory.dmp
                                                          Download

                                                          memory/3904-241-0x00007FF736BD6000-0x00007FF7372E0000-memory.dmp
                                                          Download

                                                          memory/3904-0-0x00007FF736BD6000-0x00007FF7372E0000-memory.dmp
                                                          Download

                                                          memory/3904-1-0x00007FF9443F0000-0x00007FF9443F2000-memory.dmp
                                                          Download

                                                          memory/3904-6-0x00007FF736180000-0x00007FF738185000-memory.dmp
                                                          Download

                                                          memory/4016-196-0x000001EA53160000-0x000001EA53276000-memory.dmp
                                                          Download

                                                          memory/4016-33-0x00007FF942760000-0x00007FF942761000-memory.dmp
                                                          Download

                                                          memory/4948-790-0x0000018A6A910000-0x0000018A6AA26000-memory.dmp
                                                          Download

                                                          memory/4948-621-0x0000018A6A910000-0x0000018A6AA26000-memory.dmp
                                                          Download

                                                          memory/4948-666-0x0000018A6A910000-0x0000018A6AA26000-memory.dmp
                                                          Download

                                                          memory/4948-652-0x0000018A6A910000-0x0000018A6AA26000-memory.dmp
                                                          Download

                                                          memory/5004-622-0x000001F69F220000-0x000001F69F336000-memory.dmp
                                                          Download

                                                          memory/5056-1180-0x000002AF001E0000-0x000002AF002E0000-memory.dmp
                                                          Download

                                                          memory/5056-1181-0x000002AF001E0000-0x000002AF002E0000-memory.dmp
                                                          Download

                                                          memory/5056-1179-0x000002AF001E0000-0x000002AF002E0000-memory.dmp
                                                          Download

                                                          memory/5056-1197-0x000002AF13DB0000-0x000002AF13EB0000-memory.dmp
                                                          Download

                                                          memory/5056-1195-0x000002AF038E0000-0x000002AF03900000-memory.dmp
                                                          Download

                                                          memory/5056-1211-0x000002AF03B40000-0x000002AF03B60000-memory.dmp
                                                          Download

                                                          memory/5056-1225-0x000002AF140C0000-0x000002AF140E0000-memory.dmp
                                                          Download