eda89d5e35a5cf92b20278ad71894a21cf2a446d74d9ad1f3ef9a7edc1e0d921

Analysis

user interaction
yes
max time kernel
19s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vynx_Launcher_1.2.13_x64_en-US.msi
Size 8.9MB
Sample261024-relybaat61
SHA256 eda89d5e35a5cf92b20278ad71894a21cf2a446d74d9ad1f3ef9a7edc1e0d921
MD5 a4d714115d6ba02624dbb3bc70c81e1c
SHA1 02b5aa099c0d0d69745047f98564703aa6968197
SHA512 c4be443148d9a6caed68661be9b27743bbfb1c21030098650467e09a3c1bdbe0634dc20f4df063849109d3dab7c1978095ed2aa6a18671308bacbad20d58f22a
SSDEEP 196608:UGdJ8U4qEPsEaKugBSaIJ1sgia5yXV/J025+aH/yRt5b88:UqJd4nn9BuJ1Rt5ylJn5Ru5A
TLSH
T1AF96331B7E90C932C4B70E3245B6E7604E39FC604BA0A4872791371DDDF42E19B79AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2592	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 12 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6036	tasklist.exe
1636	tasklist.exe
1744	tasklist.exe
3460	tasklist.exe
5496	tasklist.exe
5616	tasklist.exe
5688	tasklist.exe
5844	tasklist.exe
5208	tasklist.exe
5388	tasklist.exe
5904	tasklist.exe
5976	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59235d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59235d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4028	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4028	msiexec.exe
Token: SeSecurityPrivilege	4904	msiexec.exe
Token: SeCreateTokenPrivilege	4028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4028	msiexec.exe
Token: SeLockMemoryPrivilege	4028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4028	msiexec.exe
Token: SeMachineAccountPrivilege	4028	msiexec.exe
Token: SeTcbPrivilege	4028	msiexec.exe
Token: SeSecurityPrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeLoadDriverPrivilege	4028	msiexec.exe
Token: SeSystemProfilePrivilege	4028	msiexec.exe
Token: SeSystemtimePrivilege	4028	msiexec.exe
Token: SeProfSingleProcessPrivilege	4028	msiexec.exe
Token: SeIncBasePriorityPrivilege	4028	msiexec.exe
Token: SeCreatePagefilePrivilege	4028	msiexec.exe
Token: SeCreatePermanentPrivilege	4028	msiexec.exe
Token: SeBackupPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeShutdownPrivilege	4028	msiexec.exe
Token: SeDebugPrivilege	4028	msiexec.exe
Token: SeAuditPrivilege	4028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4028	msiexec.exe
Token: SeChangeNotifyPrivilege	4028	msiexec.exe
Token: SeRemoteShutdownPrivilege	4028	msiexec.exe
Token: SeUndockPrivilege	4028	msiexec.exe
Token: SeSyncAgentPrivilege	4028	msiexec.exe
Token: SeEnableDelegationPrivilege	4028	msiexec.exe
Token: SeManageVolumePrivilege	4028	msiexec.exe
Token: SeImpersonatePrivilege	4028	msiexec.exe
Token: SeCreateGlobalPrivilege	4028	msiexec.exe
Token: SeCreateTokenPrivilege	4028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4028	msiexec.exe
Token: SeLockMemoryPrivilege	4028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4028	msiexec.exe
Token: SeMachineAccountPrivilege	4028	msiexec.exe
Token: SeTcbPrivilege	4028	msiexec.exe
Token: SeSecurityPrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeLoadDriverPrivilege	4028	msiexec.exe
Token: SeSystemProfilePrivilege	4028	msiexec.exe
Token: SeSystemtimePrivilege	4028	msiexec.exe
Token: SeProfSingleProcessPrivilege	4028	msiexec.exe
Token: SeIncBasePriorityPrivilege	4028	msiexec.exe
Token: SeCreatePagefilePrivilege	4028	msiexec.exe
Token: SeCreatePermanentPrivilege	4028	msiexec.exe
Token: SeBackupPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeShutdownPrivilege	4028	msiexec.exe
Token: SeDebugPrivilege	4028	msiexec.exe
Token: SeAuditPrivilege	4028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4028	msiexec.exe
Token: SeChangeNotifyPrivilege	4028	msiexec.exe
Token: SeRemoteShutdownPrivilege	4028	msiexec.exe
Token: SeUndockPrivilege	4028	msiexec.exe
Token: SeSyncAgentPrivilege	4028	msiexec.exe
Token: SeEnableDelegationPrivilege	4028	msiexec.exe
Token: SeManageVolumePrivilege	4028	msiexec.exe
Token: SeImpersonatePrivilege	4028	msiexec.exe
Token: SeCreateGlobalPrivilege	4028	msiexec.exe
Token: SeCreateTokenPrivilege	4028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4028	msiexec.exe
Token: SeLockMemoryPrivilege	4028	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4028	msiexec.exe
4028	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2592	4904	msiexec.exe	87
PID 4904 wrote to memory of 3360	4904	msiexec.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Vynx_Launcher_1.2.13_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4028
- C:\Program Files\Vynx Launcher\launcher.exe
  "C:\Program Files\Vynx Launcher\launcher.exe"
  2⤵
  PID:876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=876.3492.10078025107955449783
    3⤵
    PID:788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fffb6e8b078,0x7fffb6e8b084,0x7fffb6e8b090
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,11633864609684757915,16060857786111656670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,11633864609684757915,16060857786111656670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,11633864609684757915,16060857786111656670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3668,i,11633864609684757915,16060857786111656670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4220,i,11633864609684757915,16060857786111656670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
      4⤵
      PID:3660
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:1636
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:1744
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:3460
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5208
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:5388
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:5496
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:5616
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5688
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:5844
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:5904
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:5976
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:6036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CB31D1FE1D1DEED64CFA9720ECCA945A C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59235e.rbs

Path C:\Config.Msi\e59235e.rbs
Size 10KB
SHA256 a152dcf25af1811e38c925cdde1a70274a216717ba6866bbd63bc7b17f82baef
MD5 487e50bb450bd1982f0438473e60529d
SHA1 4b856e4610e7183eae64289c677436aec026d900
SHA512 2df055d2f3fbe47fa14e0b44d18d0db39d32eec4128e791fe4a36ea2c9cb3851b83dfe132b690f7725c9f9c0f4b9cb35d3cb9f4d7ba9d3af6a6b75ed988b4e4f
SSDEEP 192:m5Jq1aknXNeBZoPGIoPVHh+qvHWli1WWVpiHK:m5Jq1tOoHotH11KHK
TLSH
T17722E083FB0193D2EDD62735C707172237E2C2969384734F48DEE5189E46B896F9928A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files\Vynx Launcher\launcher.exe
Size 19.3MB
SHA256 89cc2506579f47b2f30cd322b3619401fa79829c38b7a5c3d54a87bcbca41c07
MD5 17c98336a5e17c8c1053d5b98572c8b5
SHA1 1406ada9c2da3a52c9937fa1afc44f05c3e0e9ba
SHA512 a464f7c927a80d0e5c71e0a8b5996f24cc8f2e670f3d447c93163e69c86ec1dbb2a10208fe52c89baae05cdf6915412889be56ee2ffaa5ad1c5150d108e7546c
SSDEEP 196608:J0R++REh6qR0pSBpzQqAV+AjQgpSVmTTWVHwwv:OR++REh6qR0pSBCqmrjDpUmTTWVHww
TLSH
T16917F7257B5B9969D09BC47083478A620A3130DB0B39B9FF44C496383F6EBF56F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vynx Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vynx Launcher\Vynx Launcher.lnk
Size 1KB
SHA256 fe056b262a93f59f36e7f580f4120921974efda0def3409a3f28047ad5867103
MD5 7752ef6de881c95e3bebea429afbacaf
SHA1 48a1bd78a5fe2d9ceda8cc34e4acf5da37df1901
SHA512 0b746e7ec4615d0b696f2947a0625ca34154c80668a8f2b5d811e4708be8f654283660e112a3cf605f8143bad2cddc6af658e7f5129f7b427fc2daa098ed6069
TLSH
T16F41CD188BD2036AF3778379AA7146618B73BE07B231AF2A41C5C2854475501B9ACF3F
MD5 SHA1 SHA512 TLSH

Submit Download

~ynx Launcher.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vynx Launcher\~ynx Launcher.tmp
Size 2KB
SHA256 d2f9ac9bd69caf7d1b82efcbb9f995587c48ca30ca880f5e0f198f7c5725284e
MD5 12ca2740acafc9debb7047c67f3a83cf
SHA1 88b6afdd03f425c71730644bdbcdccaf45bbfd10
SHA512 35f9fb60cd1d33ccb5a05016d6edacea50d1c35e471b65cc9fe576d3b3bc33c6bfded11f4975cd23a4c37705883585134af5eb634b97a537e32374ccef68360b
TLSH
T14D41EE148BD20369F33783759A7142624B73BE0BB2319F2E41C5C2850875400B96CF3F
MD5 SHA1 SHA512 TLSH

Submit Download

MSIE28B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE28B.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

060af4d5-7ea1-4f73-ab7e-f3e738c58cf1.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\060af4d5-7ea1-4f73-ab7e-f3e738c58cf1.tmp
Size 16KB
SHA256 439a91a768015b469d2d6494b29bbd4e796a02f7ad98ec323f8a9fca550d30c3
MD5 534863d2ddb64eb4575bf37613939821
SHA1 020b2fe8f8edec7dae138aa59cde7dfd6f8b1d2b
SHA512 fd78bb01079aed0212080a4c7ae6c5dc14e782c39c8774c93ace1082cc83e4baf7d31914c5a974e5df48033986764a5f6063897aa5a1851bc437cee7295b47a5
SSDEEP 384:zj+OBqImmJvGBLx3NaFMJFNNbrfEj0EkesqClEg6rr:ucvGtlNUiiH
TLSH
T1CC72AD6A28356B372CEBC50AFA89A757DA7021A3C0916FE8DCFC4F0F425F1910366C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299a9a3b-8236-449f-98ab-b62c97b77e69.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\299a9a3b-8236-449f-98ab-b62c97b77e69.tmp
Size 3KB
SHA256 fef60631e06eabfe4e63cfa2dba949b8db848b4ef2e9f555a251e56345a726e3
MD5 912875ea22522e8e39849f0e9b38ca45
SHA1 1300e56775f0883c5c07e349b746d2b89e08a574
SHA512 4feebd5537c145a7e04ef0c7391970a50dd79032ea139190071bb5e6eed0e321de8a774c19951d2f58755315e16625855211d797287f6c7912674347723a55f4
TLSH
T14F7174316864B63B4DE2EA05F8852B07BA615167D1912FA8DEFC0F1C05DB3891356C17
MD5 SHA1 SHA512 TLSH

Submit Download

83ef8805-e305-44ab-98df-3162175f4d27.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\83ef8805-e305-44ab-98df-3162175f4d27.tmp
Size 1KB
SHA256 a9c539e859fdaba4506c6df55c0d52ba90eb17c1753b13dce7ac9650a9940501
MD5 4ccd969e1e9aff25a64530762214b80f
SHA1 d44a9faab112d6b5936d4cdd5ec80bbc8d73f66e
SHA512 53debe45e0b662e9b548e5e9e953a0e97e7047a3700aa4b59c58835d4e45d9231f23a134488a3a9b05343bf2e51675219fce207159505fa416edce7defb14b3e
TLSH
T18F316771A4607B765CC2E646F512BB476D2050ABD1104F88BEFD4A1C06DB18D922FC33
MD5 SHA1 SHA512 TLSH

Submit Download

8b442cf4-5ab5-494c-89a4-ba23af9f545b.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\8b442cf4-5ab5-494c-89a4-ba23af9f545b.tmp
Size 2KB
SHA256 5edc0ba76cfb99296fb30ccef11398a3926846691f278132202d5162e0fb8b71
MD5 90e10ac5c4775e0238a413eb3ad09858
SHA1 4989318a15fa91096517c9e2bb84bdd44cb40103
SHA512 cc69674e2a14fa46c5ffacb505b50babf732bc01bfa6d15d3330ff854f53b0ff8bae63a678c008021689814ffc103487c92cfe4a33e90cf799cf741ac8eca62b
TLSH
T141518372A814BB3789E2DA48F9067F13ED3151A696611F94AEFD0B1C01DB29D231BC27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 94aa8db4d8d589d109575c35c2513a48d09b7b4052fb5e8678f311ca053953d3
MD5 240ffc7c7dc09bf871f1f00cedbbda17
SHA1 ecb641445cef2eaf66d638bea79fbce970bbe120
SHA512 a1101a32e478c816ebf4660297c10b2047fcb219c6147c1fb8ed5b8d2e6f13d3ff73df06d8b533e9235eadb4418ad1860528daa4c55dfc303d4b20d0a605b836
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f7e82cf3b19010701e52e1061a96f7bd814ee2a8a33db1bddbbb09c82bc30c09
MD5 285de348ecb8edd28ad534b78fdb8d22
SHA1 dd08f11826527a9cbce7e3979727ee8f4f7e0761
SHA512 14dba8242100f9dbeabe3d267aec8e50a755df8f326b11032bff3e4f9fb0e6f0a531929e5cac060172b5988d01a636f28c79fb0746b4b2a6944e07439561b57b
TLSH
T1D8D01222F2110138C0103473040271199D40C61B81068048543CC91E5E180940E16552
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Local State
Size 1KB
SHA256 f3d405ecb2708fb486cee8559071b9a579c819f1aa2b3e5a6471096d0babde79
MD5 cc4f107d37b356cfe987386c9dc6bbce
SHA1 aeafa5486327978708f122a423c7c60a84dd91be
SHA512 e010ddbf1fd903452e39587ecee6de619be38de2cb32e3b47f9ffba3e7e58627c57855e14c1ce8631856b7406a8e9fed146ab16b2aecc09af269d8566899bcc6
TLSH
T1B0216571D4A07B769CC2A64AF512BB872D5090AB91200F5CFEFD061D0ADB1CD822BC33
MD5 SHA1 SHA512 TLSH

Submit Download

e59235f.msi

Path C:\Windows\Installer\e59235f.msi
Size 8.9MB
SHA256 eda89d5e35a5cf92b20278ad71894a21cf2a446d74d9ad1f3ef9a7edc1e0d921
MD5 a4d714115d6ba02624dbb3bc70c81e1c
SHA1 02b5aa099c0d0d69745047f98564703aa6968197
SHA512 c4be443148d9a6caed68661be9b27743bbfb1c21030098650467e09a3c1bdbe0634dc20f4df063849109d3dab7c1978095ed2aa6a18671308bacbad20d58f22a
SSDEEP 196608:UGdJ8U4qEPsEaKugBSaIJ1sgia5yXV/J025+aH/yRt5b88:UqJd4nn9BuJ1Rt5ylJn5Ru5A
TLSH
T1AF96331B7E90C932C4B70E3245B6E7604E39FC604BA0A4872791371DDDF42E19B79AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 e619e93187af1c6edf5cec4f2b1ffcbd4720730893ac59021aac732a29f978d2
MD5 bd6acce7de1da4aa54e7400c42fde99c
SHA1 f690d411bef6867eb0f50c2ec355db410efe4859
SHA512 6785b343d8879ef2ebcf4212f1e745530b8e22245bce01e4e88608e5af7d8536642195d32b5e87192047db1ab2b0d987ad13d11c903e529ec11874be2b4de7ee
SSDEEP 24576:8u8m+1z8doO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:j
TLSH
T14847A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{70ccf93f-69c3-457b-aafd-11fac5202c49}_OnDiskSnapshotProp

Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{70ccf93f-69c3-457b-aafd-11fac5202c49}_OnDiskSnapshotProp
Size 6KB
SHA256 4851e8f2f6cd7ef4251cdd79679ed585e3a496a36052182f68ad7a044159fc4e
MD5 c46425096309ef18a0217143609c52c4
SHA1 370f404dfa23c05b625acf159d61d9615e5d5243
SHA512 4de3c71f006395397a6007ee573c8961d252625a75d7c488ed5606b031ee7f4b31a1ed09c4809af4fb5be229c605cee3058e955ed1fdc9759c28b6e275dac25a
SSDEEP 96:FzFIDvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Bqb++ZVmN
TLSH
T1AAD1A8085AE54311E2B3AB3129F18557A877B811EF33CB8E0298238E2670A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1464-69-0x00007FFFD4CA0000-0x00007FFFD4CA1000-memory.dmp

Download

memory/1464-383-0x000001D835780000-0x000001D835921000-memory.dmp

Download

memory/2280-175-0x00007FFFD4CA0000-0x00007FFFD4CA1000-memory.dmp

Download

memory/4184-77-0x00007FFFD5A40000-0x00007FFFD5A41000-memory.dmp

Download

memory/4184-76-0x00007FFFD4E50000-0x00007FFFD4E51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads