eda89d5e35a5cf92b20278ad71894a21cf2a446d74d9ad1f3ef9a7edc1e0d921

Analysis

user interaction
yes
max time kernel
141s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vynx_Launcher_1.2.13_x64_en-US.msi
Size 8.9MB
Sample261024-relybaat61
SHA256 eda89d5e35a5cf92b20278ad71894a21cf2a446d74d9ad1f3ef9a7edc1e0d921
MD5 a4d714115d6ba02624dbb3bc70c81e1c
SHA1 02b5aa099c0d0d69745047f98564703aa6968197
SHA512 c4be443148d9a6caed68661be9b27743bbfb1c21030098650467e09a3c1bdbe0634dc20f4df063849109d3dab7c1978095ed2aa6a18671308bacbad20d58f22a
SSDEEP 196608:UGdJ8U4qEPsEaKugBSaIJ1sgia5yXV/J025+aH/yRt5b88:UqJd4nn9BuJ1Rt5ylJn5Ru5A
TLSH
T1AF96331B7E90C932C4B70E3245B6E7604E39FC604BA0A4872791371DDDF42E19B79AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1988	launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
2228	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5496	tasklist.exe
1440	tasklist.exe
5420	tasklist.exe
4748	tasklist.exe
4836	tasklist.exe
2360	tasklist.exe
4112	tasklist.exe
1292	tasklist.exe
2720	tasklist.exe
3408	tasklist.exe
2736	tasklist.exe
5604	tasklist.exe
4664	tasklist.exe
2348	tasklist.exe
2304	tasklist.exe
5080	tasklist.exe
1228	tasklist.exe
6092	tasklist.exe
4216	tasklist.exe
4112	tasklist.exe
4580	tasklist.exe
2660	tasklist.exe
4876	tasklist.exe
4396	tasklist.exe
4564	tasklist.exe
4800	tasklist.exe
3904	tasklist.exe
628	tasklist.exe
6116	tasklist.exe
4932	tasklist.exe
1308	tasklist.exe
2392	tasklist.exe
1900	tasklist.exe
628	tasklist.exe
4920	tasklist.exe
6104	tasklist.exe
4720	tasklist.exe
1772	tasklist.exe
2088	tasklist.exe
1904	tasklist.exe
3744	tasklist.exe
5380	tasklist.exe
3480	tasklist.exe
2260	tasklist.exe
4488	tasklist.exe
1280	tasklist.exe
2612	tasklist.exe
4696	tasklist.exe
2472	tasklist.exe
472	tasklist.exe
2888	tasklist.exe
4628	tasklist.exe
4112	tasklist.exe
4760	tasklist.exe
1228	tasklist.exe
3880	tasklist.exe
4876	tasklist.exe
5748	tasklist.exe
2392	tasklist.exe
4312	tasklist.exe
2708	tasklist.exe
3000	tasklist.exe
1996	tasklist.exe
1280	tasklist.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Vynx Launcher\launcher.exe	msiexec.exe
File created	C:\Program Files\Vynx Launcher\Uninstall Vynx Launcher.lnk	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF003.tmp	msiexec.exe
File created	C:\Windows\Installer\{BA6131F7-2278-47C3-894E-60E2B2082825}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59eb21.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BA6131F7-2278-47C3-894E-60E2B2082825}	msiexec.exe
File opened for modification	C:\Windows\Installer\{BA6131F7-2278-47C3-894E-60E2B2082825}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59eb23.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F61CD8C2AD5B5C5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6B7D0227FC18D616.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59eb21.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF31C13827E79B64E6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF55E6FDAE6C2861AB.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1548	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0b4c806e3f937b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ee0b4c800000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ee0b4c80000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ee0b4c8000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ee0b4c8000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F1316AB87223C7498E4062E2B808252\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\PackageCode = "5EC0D1C140C5D6F42A6E9A4831F0AF43"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\Version = "16908301"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\SourceList\PackageName = "Vynx_Launcher_1.2.13_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F1316AB87223C7498E4062E2B808252\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F1316AB87223C7498E4062E2B808252\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\ProductName = "Vynx Launcher"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\ProductIcon = "C:\\Windows\\Installer\\{BA6131F7-2278-47C3-894E-60E2B2082825}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B09725115750E5854AE620D12C75FF5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F1316AB87223C7498E4062E2B808252\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B09725115750E5854AE620D12C75FF5D\7F1316AB87223C7498E4062E2B808252	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F1316AB87223C7498E4062E2B808252\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F1316AB87223C7498E4062E2B808252	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6068	msiexec.exe
6068	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4700	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1548	msiexec.exe
Token: SeSecurityPrivilege	6068	msiexec.exe
Token: SeCreateTokenPrivilege	1548	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1548	msiexec.exe
Token: SeLockMemoryPrivilege	1548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1548	msiexec.exe
Token: SeMachineAccountPrivilege	1548	msiexec.exe
Token: SeTcbPrivilege	1548	msiexec.exe
Token: SeSecurityPrivilege	1548	msiexec.exe
Token: SeTakeOwnershipPrivilege	1548	msiexec.exe
Token: SeLoadDriverPrivilege	1548	msiexec.exe
Token: SeSystemProfilePrivilege	1548	msiexec.exe
Token: SeSystemtimePrivilege	1548	msiexec.exe
Token: SeProfSingleProcessPrivilege	1548	msiexec.exe
Token: SeIncBasePriorityPrivilege	1548	msiexec.exe
Token: SeCreatePagefilePrivilege	1548	msiexec.exe
Token: SeCreatePermanentPrivilege	1548	msiexec.exe
Token: SeBackupPrivilege	1548	msiexec.exe
Token: SeRestorePrivilege	1548	msiexec.exe
Token: SeShutdownPrivilege	1548	msiexec.exe
Token: SeDebugPrivilege	1548	msiexec.exe
Token: SeAuditPrivilege	1548	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1548	msiexec.exe
Token: SeChangeNotifyPrivilege	1548	msiexec.exe
Token: SeRemoteShutdownPrivilege	1548	msiexec.exe
Token: SeUndockPrivilege	1548	msiexec.exe
Token: SeSyncAgentPrivilege	1548	msiexec.exe
Token: SeEnableDelegationPrivilege	1548	msiexec.exe
Token: SeManageVolumePrivilege	1548	msiexec.exe
Token: SeImpersonatePrivilege	1548	msiexec.exe
Token: SeCreateGlobalPrivilege	1548	msiexec.exe
Token: SeCreateTokenPrivilege	1548	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1548	msiexec.exe
Token: SeLockMemoryPrivilege	1548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1548	msiexec.exe
Token: SeMachineAccountPrivilege	1548	msiexec.exe
Token: SeTcbPrivilege	1548	msiexec.exe
Token: SeSecurityPrivilege	1548	msiexec.exe
Token: SeTakeOwnershipPrivilege	1548	msiexec.exe
Token: SeLoadDriverPrivilege	1548	msiexec.exe
Token: SeSystemProfilePrivilege	1548	msiexec.exe
Token: SeSystemtimePrivilege	1548	msiexec.exe
Token: SeProfSingleProcessPrivilege	1548	msiexec.exe
Token: SeIncBasePriorityPrivilege	1548	msiexec.exe
Token: SeCreatePagefilePrivilege	1548	msiexec.exe
Token: SeCreatePermanentPrivilege	1548	msiexec.exe
Token: SeBackupPrivilege	1548	msiexec.exe
Token: SeRestorePrivilege	1548	msiexec.exe
Token: SeShutdownPrivilege	1548	msiexec.exe
Token: SeDebugPrivilege	1548	msiexec.exe
Token: SeAuditPrivilege	1548	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1548	msiexec.exe
Token: SeChangeNotifyPrivilege	1548	msiexec.exe
Token: SeRemoteShutdownPrivilege	1548	msiexec.exe
Token: SeUndockPrivilege	1548	msiexec.exe
Token: SeSyncAgentPrivilege	1548	msiexec.exe
Token: SeEnableDelegationPrivilege	1548	msiexec.exe
Token: SeManageVolumePrivilege	1548	msiexec.exe
Token: SeImpersonatePrivilege	1548	msiexec.exe
Token: SeCreateGlobalPrivilege	1548	msiexec.exe
Token: SeCreateTokenPrivilege	1548	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1548	msiexec.exe
Token: SeLockMemoryPrivilege	1548	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1548	msiexec.exe
1548	msiexec.exe
1988	launcher.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1548	msiexec.exe
6068	msiexec.exe
2228	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 2228	6068	msiexec.exe	90
PID 6068 wrote to memory of 1404	6068	msiexec.exe	95
PID 1548 wrote to memory of 1988	1548	msiexec.exe	99
PID 1988 wrote to memory of 4700	1988	launcher.exe	100
PID 4700 wrote to memory of 2656	4700	msedgewebview2.exe	101
PID 4700 wrote to memory of 1136	4700	msedgewebview2.exe	102
PID 4700 wrote to memory of 1136	4700	msedgewebview2.exe	102
PID 4700 wrote to memory of 1136	4700	msedgewebview2.exe	102
PID 4700 wrote to memory of 1136	4700	msedgewebview2.exe	102
PID 4700 wrote to memory of 2480	4700	msedgewebview2.exe	103
PID 4700 wrote to memory of 2308	4700	msedgewebview2.exe	104
PID 4700 wrote to memory of 2308	4700	msedgewebview2.exe	104
PID 4700 wrote to memory of 2308	4700	msedgewebview2.exe	104
PID 4700 wrote to memory of 2332	4700	msedgewebview2.exe	105
PID 4700 wrote to memory of 2332	4700	msedgewebview2.exe	105
PID 4700 wrote to memory of 2332	4700	msedgewebview2.exe	105
PID 4700 wrote to memory of 2332	4700	msedgewebview2.exe	105
PID 4700 wrote to memory of 2332	4700	msedgewebview2.exe	105
PID 4700 wrote to memory of 1176	4700	msedgewebview2.exe	106
PID 4700 wrote to memory of 1176	4700	msedgewebview2.exe	106
PID 4700 wrote to memory of 1176	4700	msedgewebview2.exe	106
PID 1988 wrote to memory of 5956	1988	launcher.exe	108
PID 1988 wrote to memory of 1920	1988	launcher.exe	111
PID 1988 wrote to memory of 4224	1988	launcher.exe	113
PID 1988 wrote to memory of 3000	1988	launcher.exe	149
PID 1988 wrote to memory of 4784	1988	launcher.exe	117
PID 1988 wrote to memory of 4876	1988	launcher.exe	119
PID 1988 wrote to memory of 1376	1988	launcher.exe	121
PID 1988 wrote to memory of 2472	1988	launcher.exe	123
PID 1988 wrote to memory of 628	1988	launcher.exe	125
PID 1988 wrote to memory of 6092	1988	launcher.exe	127
PID 1988 wrote to memory of 256	1988	launcher.exe	129
PID 1988 wrote to memory of 5080	1988	launcher.exe	131
PID 1988 wrote to memory of 4564	1988	launcher.exe	133
PID 1988 wrote to memory of 4920	1988	launcher.exe	175
PID 1988 wrote to memory of 1772	1988	launcher.exe	174
PID 1988 wrote to memory of 5828	1988	launcher.exe	139
PID 1988 wrote to memory of 472	1988	launcher.exe	141
PID 1988 wrote to memory of 4112	1988	launcher.exe	143
PID 1988 wrote to memory of 5380	1988	launcher.exe	145
PID 1988 wrote to memory of 1996	1988	launcher.exe	185
PID 1988 wrote to memory of 3000	1988	launcher.exe	149
PID 1988 wrote to memory of 2916	1988	launcher.exe	151
PID 1988 wrote to memory of 4284	1988	launcher.exe	153
PID 1988 wrote to memory of 2260	1988	launcher.exe	155
PID 1988 wrote to memory of 2360	1988	launcher.exe	157
PID 1988 wrote to memory of 2612	1988	launcher.exe	159
PID 1988 wrote to memory of 4572	1988	launcher.exe	161
PID 1988 wrote to memory of 1280	1988	launcher.exe	207
PID 1988 wrote to memory of 2960	1988	launcher.exe	165
PID 1988 wrote to memory of 4216	1988	launcher.exe	167
PID 1988 wrote to memory of 1420	1988	launcher.exe	169
PID 1988 wrote to memory of 4824	1988	launcher.exe	171
PID 1988 wrote to memory of 6116	1988	launcher.exe	173
PID 1988 wrote to memory of 4920	1988	launcher.exe	175
PID 1988 wrote to memory of 3480	1988	launcher.exe	177
PID 1988 wrote to memory of 5556	1988	launcher.exe	179
PID 1988 wrote to memory of 4336	1988	launcher.exe	181
PID 1988 wrote to memory of 4812	1988	launcher.exe	210
PID 1988 wrote to memory of 1996	1988	launcher.exe	212
PID 1988 wrote to memory of 4800	1988	launcher.exe	187
PID 1988 wrote to memory of 5256	1988	launcher.exe	189
PID 1988 wrote to memory of 1292	1988	launcher.exe	191
PID 1988 wrote to memory of 2888	1988	launcher.exe	193

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Vynx_Launcher_1.2.13_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files\Vynx Launcher\launcher.exe
  "C:\Program Files\Vynx Launcher\launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1988.4408.9213809535322002310 /pfhostedapp:2e2558ecbaa392dba144192b901827e368bdd5c2
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView /prefetch:4 /pfhostedapp:2e2558ecbaa392dba144192b901827e368bdd5c2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffec4dd5fd8,0x7ffec4dd5fe4,0x7ffec4dd5ff0
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,11878478858527175798,5937529304407956851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:2e2558ecbaa392dba144192b901827e368bdd5c2
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1744,i,11878478858527175798,5937529304407956851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:2e2558ecbaa392dba144192b901827e368bdd5c2
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1744,i,11878478858527175798,5937529304407956851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2e2558ecbaa392dba144192b901827e368bdd5c2
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3296 --field-trial-handle=1744,i,11878478858527175798,5937529304407956851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:2e2558ecbaa392dba144192b901827e368bdd5c2 /prefetch:1
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3824 --field-trial-handle=1744,i,11878478858527175798,5937529304407956851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2e2558ecbaa392dba144192b901827e368bdd5c2
      4⤵
      PID:1176
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:5956
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:1920
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:4224
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:3000
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:4784
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:4876
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:1376
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:2472
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:628
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:6092
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:256
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:5080
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:4564
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:4920
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:1772
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:5828
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:472
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:4112
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:5380
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:1996
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:3000
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:2916
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:4284
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:2260
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:2360
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:2612
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:4572
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1280
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:2960
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:4216
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:1420
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:4824
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:6116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1772
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:4920
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:3480
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:5556
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:4336
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:4812
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:1996
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4800
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:5256
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:1292
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:2888
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:3696
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:5580
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:4760
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:5956
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4112
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:2008
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:1280
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:2676
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4812
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:5112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1996
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:4580
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:2088
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:3708
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:4500
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:1308
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:2828
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:5000
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5496
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:2392
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:5580
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:2612
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:4308
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:4312
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:1980
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:2720
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4932
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1280
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:3820
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:5112
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:6056
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:3408
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:6036
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:3904
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:4628
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1308
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:1440
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:1120
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:3880
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4664
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:4828
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:4396
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:3360
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:2348
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:2304
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:2320
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:6104
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:1404
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:4908
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:3232
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:3028
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:2736
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:3432
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:1904
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:2588
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:2392
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:1772
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:5648
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:4112
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5420
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:4312
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:2660
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:1900
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5080
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:3700
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:5012
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:2260
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1228
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:4816
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:2888
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:4748
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:5000
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:3880
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:2708
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:628
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4836
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:1744
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:4216
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    - Discovers running processes
    PID:3744
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:3796
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:4696
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:5604
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:3192
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4720
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:1228
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    - Discovers running processes
    PID:4876
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:692
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:5220
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    PID:3712
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:2588
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:2860
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5748
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq Arc.exe"
    3⤵
    - Discovers running processes
    PID:4488
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteLauncher.exe"
    3⤵
    PID:5788
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping_EAC.exe"
    3⤵
    PID:4612
- - C:\Windows\system32\tasklist.exe
    "tasklist" /NH /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
    3⤵
    PID:1944

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 75A3A9F72A6A0196C49A47BA80BDA9BD C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2228
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59eb22.rbs

Path C:\Config.Msi\e59eb22.rbs
Size 9KB
SHA256 db6e990d3cfa81264a7f82414c253f7bc4d3d993944d50932b015fe2a57e63e5
MD5 9c547a13cf0646cf93811b5740293d7a
SHA1 92bb4a7a1f427d23317a3f3fc4f53a852792ece7
SHA512 b2cb1b1d796277d2112512c5944729c48c129ee11783f3690249bfa737c30695d5b8ff133bdac14fc02dd83f72786055417fc18cd0fdf3737fa65bb1e7ea5f63
SSDEEP 192:/EJq1aknvkCIZoPGIoPVHhuqvHWli1WWVpiHK:/EJq1teoHotHN1KHK
TLSH
T17522F183F70093D2EDD62B35C707172237E2C2969384734F48DEE5189E46B896F9928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files\Vynx Launcher\launcher.exe
Size 19.3MB
SHA256 89cc2506579f47b2f30cd322b3619401fa79829c38b7a5c3d54a87bcbca41c07
MD5 17c98336a5e17c8c1053d5b98572c8b5
SHA1 1406ada9c2da3a52c9937fa1afc44f05c3e0e9ba
SHA512 a464f7c927a80d0e5c71e0a8b5996f24cc8f2e670f3d447c93163e69c86ec1dbb2a10208fe52c89baae05cdf6915412889be56ee2ffaa5ad1c5150d108e7546c
SSDEEP 196608:J0R++REh6qR0pSBpzQqAV+AjQgpSVmTTWVHwwv:OR++REh6qR0pSBCqmrjDpUmTTWVHww
TLSH
T16917F7257B5B9969D09BC47083478A620A3130DB0B39B9FF44C496383F6EBF56F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vynx Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vynx Launcher\Vynx Launcher.lnk
Size 1KB
SHA256 22f2f51e93b58e1e6abcf9e0a419f8433e9d95e39dc32022d4333d5c0dbd930a
MD5 36d4332e3db74e8b51084a4405b75d64
SHA1 2c9b330f9931c5797eeba07a8a01247de6e44097
SHA512 843014006ed9d87bb513d06e3c2b07831e087901f68b574b40d1cbba9d5b9b0533fd050f849a227169f8673ec7797707143f371278669813208280701712ba1a
TLSH
T1CD4102144BCA175DF3378335997146628B32FD0BA174AF2F02C581822479100FAA8F3F
MD5 SHA1 SHA512 TLSH

Submit Download

~ynx Launcher.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vynx Launcher\~ynx Launcher.tmp
Size 2KB
SHA256 3f202f1542e838a04a699f042e3e090ea6c4d81f97c06c6864813b4734a9eaf8
MD5 e5f7504a0d316507965c2e888df93b72
SHA1 24ee57df40288547c11b752197811754214beda0
SHA512 b61bce42901c881297c9c0d216f4235aa6c9c8a27895aa8cac1937425ea76e80e961264a1f08031b074eb3e9d03e2930993406441ecb0aaac886c311b56dfcc1
TLSH
T10841D0144BCA176DF33B8335997146624B32FD0BA174AF2E42C582862979100BAACF3E
MD5 SHA1 SHA512 TLSH

Submit Download

MSIAED4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIAED4.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vynx-discord-rpc.log

Path C:\Users\Admin\AppData\Local\Temp\vynx-discord-rpc.log
Size 4KB
SHA256 a82bd10b19e363b12a322af11e4e1697fd87c5ab31a68fd8fae58631cae1a1bd
MD5 ce8cc85b357abf08cca5e9e206b68acf
SHA1 0665f1671d9ce2c188c2538c8d18fb711f15f632
SHA512 f506cb4782a33d4ea040b9a656087ca3720a5466d765e111628bd272e4b5e4b4dee849aa85d1e2178539cc6121690e66c0cb309b6aefdbc62a0c43d356131cfc
SSDEEP 96:ezMchMbyyOXsGyQspyMsNySsby1scyRswy5soy+sfyvsOyTQsTpyTXsTGyTWsTHQ:ezMGMbhO8GyRpyNNyTbyqcyGwyuoyffw
TLSH
T15C918129CFF41017233222859E8AE075E5A685FC17A70928275448F8D86A7D3E1CFFF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25862be0-7026-43d0-859d-dc32bee59a7a.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\25862be0-7026-43d0-859d-dc32bee59a7a.tmp
Size 3KB
SHA256 9119ebf118e96f4d41b23eecf0fa0abf161dc52442957f84daa83ccd8bfb8577
MD5 d86a6f3c72dc3b8b41d7272667a51c0e
SHA1 d637243e65c9e29818cca0aa3535b11359d76429
SHA512 47c78ef02564bbcc75ac2efb15d97b32ccd35ff61af7a21831fe5a13a9ab83e5c5b0424ae7393e088920b2686aeb5636158cabab13f667f0eb9a4cee715b2b84
TLSH
T1B061A4336874B9374DA3DA05B98A3B16E7A55127E5917FA4DAEC0F1C01D73882342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3e9a84706db77d0fce0e61cf322ffa9998c06e774ca4cbfb99f32f9f849870c8
MD5 2f78bedc90faec41ecd1705c936e8670
SHA1 ec37cf27cc0e2c265180550bb6ebc5341e414a8d
SHA512 7cc8b511b0d705f77897581db8c87d296b9395f4602c835d51cc1dc73b596824afdd1fd6977810c0c6b52714f66ee04dd248ade136c46e280a470344935945e7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a3e417e12a6d33ecd4caf645d9a65906668cec96dbfe72d2635f71cf142ec100
MD5 8f938684ac01da17d8cd6136cb856351
SHA1 f18e5c090ae54efe4ee327719b46d16f1f7c6ea3
SHA512 30ad23ffb77ac416e59c58f2b8abd633f756daa9045389ddd5bc687e2969bf697011512b852f6fd8e562d0e048d82810a6358ed5843538ad44e0d83b6ef70504
TLSH
T12AD0113332028238C82830B300A2B20C2800CA0F828E8000B83CEA2EAB880A80A03C82
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2d52bdde-7e0d-406a-946f-65028f788e32.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\2d52bdde-7e0d-406a-946f-65028f788e32.tmp
Size 6KB
SHA256 7a85f78a07ec987186d96782bc6a7132167b510c14809207b42e739475ae5e04
MD5 3b8959e84b165cc3d86cdf1020d46100
SHA1 c3294d76010875ed8a381ebfb2ee11ed07342c36
SHA512 ae7724261109d68a1f71b38eb71fd23ae1b63319fd5936cad67efed9c53a859ef76b6578e1eb228a2ec31efeba995b40baed3f59af169093348414078cc4918a
SSDEEP 96:stj/dXG9eb9/k8o5h16Z0Ls7/x+6MhmuecJRd6fjeKK+gLS28XM1C7K:stb5BbonLsV+FdRdKjy1SG6K
TLSH
T1E8D185025E28797B4CC6E508FA29BB47E2F5607261D51E58EBFC462C04DB6CD630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 20d1a6a2d558826a098f41ca793cfd3d0fb4b60de41a82f90948096e12a6d6f5
MD5 0a495b2a88e5577a553ff1a19b1d9d27
SHA1 7f6e84576d8b59ba016aad78f313f51d58b9cd10
SHA512 6b2afe20cb349f925c8e50d4c7b5e0080982d9773ec7b8314d314929d1a1138ffde21eea206de946507631accc396b163005dd93ea80d6b215d92dec7f7dd040
TLSH
T1C0F09A5778F15503CFE346B212EC5E003234C383587BEF6286948E71B952FD9101B25C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 96ead65cb857e1e5fffe76885b2e1205755a4e8d0e8500074ee6995d75f79614
MD5 85cec743fb721c2b98351f533704f7ba
SHA1 1d8beee635087e7d349418b1f5e525a3cda05260
SHA512 da545d06a7a06885f155f462b067a12ddbccfe0d3384d2470f18eaaf52841f9406f9e518eaa574a0475caecf09dc1448fcc27fdc151f0626de3f9273c37900d8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

84d6e26b-386f-40bb-9ae5-a652ae6dddee.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Network\84d6e26b-386f-40bb-9ae5-a652ae6dddee.tmp
Size 451B
SHA256 1c24c67ef55ccdd0303e7eb7a1e06590fd978cb8e7e75fff39650cf5d49c8ea9
MD5 8baa5029c5da969c926aa82c8647086d
SHA1 083f3726ab34c866cc2f9ff438917c78e99d85b0
SHA512 2df5d67568be4319c842ff0c5398c0d663e5d0a9232dacfff8a969557321b80b2d6e80b120a08b307c8c3abf2aaabad5de285a2c9d45e15cc4f6585db4920bf2
TLSH
T12EF05CA247E48BBE4B4213E05A38F817CA3E0505522C6E3BDEEBB7E54FD2075D02190B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\Local State
Size 1KB
SHA256 2be51d7691df323359e5d1027bdc9d3ca588096edc927374d0d87a90dc157a7b
MD5 0392f80e39ef865ecf9ce594673fea04
SHA1 b9f4baa8e22b989bc94e527d3595ed336ee23945
SHA512 76de47c656bf970659e29dd877303ecef1c3c16b163012771d0d9f90de396f751d70a3b760b3cd7ab4cba72a41aeca679a1773501d86ceb1c5032db9fe5aae9d
TLSH
T13F213873A8646F33AD5296467267B53BAD30516F91109E00A1DC872912E714CA62AC37
MD5 SHA1 SHA512 TLSH

Submit Download

a061c3fe-70b7-4c30-b30c-bad9f8b2ef82.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\a061c3fe-70b7-4c30-b30c-bad9f8b2ef82.tmp
Size 2KB
SHA256 d12672ebc8959600336769eca6b3ecec098be0adc92a61c6c191d1d3a8e8e1fe
MD5 ea25ca9a2982c9c27fdf26c6aee00967
SHA1 7a635a1559ccc6ae99a286ced1928ddcf1e0319d
SHA512 0c099847e918ffe9c327db9264392317af14b408d84e5cd7db331c2b5d09dc164b583636375a52032b03591badf9a479bc4f22e29ca0f811f56f4799eb6476e0
TLSH
T13F5195337C24BB3389A2CA44BA5B7B27DA3961A6A6516F509AEC471801D724D2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

bc7260e2-8742-4bdd-80c2-36c7188083e9.tmp

Path C:\Users\Admin\AppData\Local\VynxLauncher\EBWebView\bc7260e2-8742-4bdd-80c2-36c7188083e9.tmp
Size 15KB
SHA256 73c4ca4dab870aceab9a961fb24e19479479f8226087b71b609c90b3f227dd78
MD5 7d93321abd2771ce5360f2ea80f9c5d0
SHA1 38fe5a2456639c8cae10b73fcd3c384e28804b93
SHA512 ea337292de7a6093d26d97f0d4c8c78159615c0786288c8137a26ff8b36fc2b7175e0e9a9a90f2e1e68011075adc6da4c867187af688d5f08a5d914ae5125f1a
SSDEEP 384:5+OBqImmJvGBLx3NaFMJFNNBSgVBg2qKyS/Xmr6g6rg:UcvGtlNz+rcc
TLSH
T17D72AE3A2C766A232CA7C60AFE8E6757CB6561A7C0D17BE5CCEC8F0E516B0841352816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59eb23.msi

Path C:\Windows\Installer\e59eb23.msi
Size 8.9MB
SHA256 eda89d5e35a5cf92b20278ad71894a21cf2a446d74d9ad1f3ef9a7edc1e0d921
MD5 a4d714115d6ba02624dbb3bc70c81e1c
SHA1 02b5aa099c0d0d69745047f98564703aa6968197
SHA512 c4be443148d9a6caed68661be9b27743bbfb1c21030098650467e09a3c1bdbe0634dc20f4df063849109d3dab7c1978095ed2aa6a18671308bacbad20d58f22a
SSDEEP 196608:UGdJ8U4qEPsEaKugBSaIJ1sgia5yXV/J025+aH/yRt5b88:UqJd4nn9BuJ1Rt5ylJn5Ru5A
TLSH
T1AF96331B7E90C932C4B70E3245B6E7604E39FC604BA0A4872791371DDDF42E19B79AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b2dea63335b3dc139d4b0c5340fde274121fbb5657f197522d484014d16b2226
MD5 17c21e30ac897d5804874060758b8432
SHA1 e1257f83b9f9bd1e03dce614555731d80dd02440
SHA512 a8a1e355c62aba73f54f06d026eb7d90a1d6a0ad89bcb24383ae6615c3ff45766189ca0cfdf3d3e5977a2a1b39599e82a916cd84cd9b769c6ab16f15f4077148
SSDEEP 24576:aFo3DMPsdoO/vvTL/SQPvCFg/L+F07osEiJdNiBH5KBq5YOfc4h2PW1+ruv:jHI
TLSH
T12757A12436F92200E7B79E3DA8F06A634D3A7D5B9C15DE8D45411B8E0822F71E872F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{460809b4-6be9-4add-8e0e-0e89eabfe69b}_OnDiskSnapshotProp

Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{460809b4-6be9-4add-8e0e-0e89eabfe69b}_OnDiskSnapshotProp
Size 6KB
SHA256 33db5d774871cec26d2f8ee46dff8c68fbe6f66e30d7ed34213d799c5d8d4b77
MD5 ee4dc6d3a314f7fee37f6b58cbb80c22
SHA1 2fffb8aa06a182f8ccb4f7dee3ae303f4d5d5268
SHA512 c7c496cda20784889e3d91d2c1fd0b9e0e4398293b704f0e2de25d382b856294c981f579e454a50ea5898cbaa92abdaaf9803ff881f311a28467dcea38886289
SSDEEP 96:FVQnO1Daqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:AnIb++uVmN
TLSH
T10FD176085AF54711E2B3AB3228F18557A877B911EF33CB8E0198638E6671910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-72-0x00007FFEE7060000-0x00007FFEE7061000-memory.dmp

Download

memory/1136-320-0x0000029350FE0000-0x00000293510BE000-memory.dmp

Download

memory/2332-81-0x00007FFEE7060000-0x00007FFEE7061000-memory.dmp

Download