Analysis date (UTC): 7 April 2026, 12:31Analysis environment: Windows 10 Pro, build 19044, x64

https://uploadnow.io/f/tlqsL5h

MD5:17BE9ED72582EF92FDA3DD4B463A6B68

SHA1:724676AF201A7853E4FB017DCF3FC6D8A576F0D9

SHA256:C5D9ED9BA1BA949B794E0E02783C896FA55FFDE5BCEFF99CA24A6810AF59D974

Analysis result

Threat level:Malicious activity

Tags:

arch-execanti-evasiongenericevasionstealerhijackloaderloader

Full analysis:Analysis https://uploadnow.io/f/tlqsL5h Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

GENERIC has been detected (SURICATA)

lnstaIer.exe (PID: 8876)

Executing a file with an untrusted certificate

VortexControll32.exe (PID: 7920)

HIJACKLOADER has been detected (YARA)

VortexControll32.exe (PID: 7920)
yzBTum2BT.exe (PID: 5160)

Steals credentials from Web Browsers

VortexControll32.exe (PID: 7920)

SUSPICIOUS

Starts POWERSHELL.EXE for commands execution

cmd.exe (PID: 8996)
cmd.exe (PID: 1504)
cmd.exe (PID: 8444)
cmd.exe (PID: 6952)
cmd.exe (PID: 508)

Starts CMD.EXE for commands execution

cmd.exe (PID: 8780)
cmd.exe (PID: 8996)
cmd.exe (PID: 8444)
cmd.exe (PID: 2316)
cmd.exe (PID: 8372)
cmd.exe (PID: 1504)
cmd.exe (PID: 6952)
cmd.exe (PID: 508)

Accesses local storage devices (Win32_LogicalDisk) (SCRIPT)

powershell.exe (PID: 8028)

The process drops C-runtime libraries

lnstaIer.exe (PID: 8876)
yzBTum2BT.exe (PID: 5160)

Executable content was dropped or overwritten

lnstaIer.exe (PID: 8876)
yzBTum2BT.exe (PID: 5160)

Checks for external IP

lnstaIer.exe (PID: 8876)

Possible stealing from crypto wallets

VortexControll32.exe (PID: 7920)

Browser sandbox disabling

chrome.exe (PID: 1456)
chrome.exe (PID: 5848)
chrome.exe (PID: 2660)
chrome.exe (PID: 2324)
chrome.exe (PID: 6084)
chrome.exe (PID: 5412)
chrome.exe (PID: 8040)
chrome.exe (PID: 8856)
chrome.exe (PID: 6116)
chrome.exe (PID: 8660)
chrome.exe (PID: 3580)
chrome.exe (PID: 4692)
chrome.exe (PID: 8300)
chrome.exe (PID: 8172)
chrome.exe (PID: 1772)
chrome.exe (PID: 5608)
chrome.exe (PID: 7908)
chrome.exe (PID: 8364)
chrome.exe (PID: 1504)
chrome.exe (PID: 8380)
chrome.exe (PID: 8044)
chrome.exe (PID: 3076)
chrome.exe (PID: 4236)
chrome.exe (PID: 7248)
chrome.exe (PID: 9004)
chrome.exe (PID: 9192)
chrome.exe (PID: 7836)
chrome.exe (PID: 8368)
chrome.exe (PID: 6116)
chrome.exe (PID: 9160)
chrome.exe (PID: 5700)
chrome.exe (PID: 9172)
chrome.exe (PID: 8000)
chrome.exe (PID: 8020)
chrome.exe (PID: 2312)
chrome.exe (PID: 8172)
chrome.exe (PID: 7988)
chrome.exe (PID: 7960)
chrome.exe (PID: 8468)
chrome.exe (PID: 8044)
chrome.exe (PID: 9088)
chrome.exe (PID: 2316)
chrome.exe (PID: 7516)
chrome.exe (PID: 8492)
chrome.exe (PID: 5704)
chrome.exe (PID: 5524)
chrome.exe (PID: 8028)
chrome.exe (PID: 8488)
chrome.exe (PID: 9212)
chrome.exe (PID: 8860)
chrome.exe (PID: 7836)
chrome.exe (PID: 5704)
chrome.exe (PID: 1868)
chrome.exe (PID: 6520)
chrome.exe (PID: 6384)
chrome.exe (PID: 684)
chrome.exe (PID: 6840)
chrome.exe (PID: 6448)
chrome.exe (PID: 2300)
chrome.exe (PID: 9008)
chrome.exe (PID: 4692)
chrome.exe (PID: 8784)
chrome.exe (PID: 6116)
chrome.exe (PID: 7780)
chrome.exe (PID: 3156)
chrome.exe (PID: 6236)
chrome.exe (PID: 8856)
chrome.exe (PID: 7516)
chrome.exe (PID: 7944)
chrome.exe (PID: 7608)
chrome.exe (PID: 8772)
chrome.exe (PID: 8256)
chrome.exe (PID: 7380)
chrome.exe (PID: 9212)
chrome.exe (PID: 4960)
chrome.exe (PID: 8924)
chrome.exe (PID: 4124)
chrome.exe (PID: 4600)
chrome.exe (PID: 8200)
chrome.exe (PID: 2812)
chrome.exe (PID: 8596)
chrome.exe (PID: 7904)
chrome.exe (PID: 6092)
chrome.exe (PID: 552)
chrome.exe (PID: 9036)
chrome.exe (PID: 7616)
chrome.exe (PID: 9140)
chrome.exe (PID: 3008)
chrome.exe (PID: 6076)
chrome.exe (PID: 8140)
chrome.exe (PID: 7192)
chrome.exe (PID: 4124)
chrome.exe (PID: 9032)
chrome.exe (PID: 8000)
chrome.exe (PID: 7516)
chrome.exe (PID: 4960)
chrome.exe (PID: 8480)
chrome.exe (PID: 4056)
chrome.exe (PID: 8200)
chrome.exe (PID: 5920)
chrome.exe (PID: 4624)
chrome.exe (PID: 7620)
chrome.exe (PID: 5748)
chrome.exe (PID: 2216)
chrome.exe (PID: 8596)
chrome.exe (PID: 5632)
chrome.exe (PID: 6392)

Searches for installed software

VortexControll32.exe (PID: 7920)

Browser headless start

chrome.exe (PID: 5848)
chrome.exe (PID: 6520)

Browser launch with unusual user-data-dir

chrome.exe (PID: 7456)
chrome.exe (PID: 5548)

Possible stealing from password managers

VortexControll32.exe (PID: 7920)

Possible stealing from browsers

VortexControll32.exe (PID: 7920)

INFO

Reads Environment values

identity_helper.exe (PID: 2316)

Reads the computer name

identity_helper.exe (PID: 2316)
yzBTum2BT.exe (PID: 5160)
lnstaIer.exe (PID: 8876)
VortexControll32.exe (PID: 7920)
Crisp.exe (PID: 4128)

Checks supported languages

identity_helper.exe (PID: 2316)
lnstaIer.exe (PID: 4692)
lnstaIer.exe (PID: 7452)
lnstaIer.exe (PID: 5616)
lnstaIer.exe (PID: 8876)
yzBTum2BT.exe (PID: 5160)
VortexControll32.exe (PID: 7920)
Crisp.exe (PID: 4128)

Manual execution by a user

WinRAR.exe (PID: 8324)
lnstaIer.exe (PID: 4692)
lnstaIer.exe (PID: 7452)
lnstaIer.exe (PID: 5616)
lnstaIer.exe (PID: 8876)

Application launched itself

msedge.exe (PID: 7484)
chrome.exe (PID: 7456)
chrome.exe (PID: 5548)

Creates files or folders in the user directory

WerFault.exe (PID: 8640)
WerFault.exe (PID: 2220)
lnstaIer.exe (PID: 8876)
WerFault.exe (PID: 6832)
yzBTum2BT.exe (PID: 5160)

Executable content was dropped or overwritten

WinRAR.exe (PID: 8324)

Create files in a temporary directory

lnstaIer.exe (PID: 8876)
yzBTum2BT.exe (PID: 5160)
Crisp.exe (PID: 4128)

Uses string replace method (POWERSHELL)

powershell.exe (PID: 8028)

The sample compiled with english language support

WinRAR.exe (PID: 8324)
lnstaIer.exe (PID: 8876)
yzBTum2BT.exe (PID: 5160)

Reads the machine GUID from the registry

lnstaIer.exe (PID: 8876)
VortexControll32.exe (PID: 7920)

Checks operating system version

lnstaIer.exe (PID: 8876)

There is functionality for taking screenshot (YARA)

lnstaIer.exe (PID: 8876)

The sample compiled with chinese language support

yzBTum2BT.exe (PID: 5160)

Threats

PID	Process	Class	Message
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Hosting Domain (uploadnow .io) in DNS Lookup
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Hosting Domain (uploadnow .io) in DNS Lookup
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Sharing Domain (uploadnow .io) in TLS SNI
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Sharing Domain (uploadnow .io) in TLS SNI
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Sharing Domain (uploadnow .io) in TLS SNI
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Hosting Domain (uploadnow .io) in DNS Lookup
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Sharing Domain (uploadnow .io) in TLS SNI
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Hosting Domain (uploadnow .io) in DNS Lookup
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Sharing Domain (uploadnow .io) in TLS SNI
7468	msedge.exe	Misc activity	ET FILE_SHARING Abused File Sharing Domain (uploadnow .io) in TLS SNI

Rows per page