Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing

      <i>&quot;Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\</i></p> <p>

      <i>&quot;Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\</i></p>
  </td> <td width="289"><p></p> <p>Stealing data from an email
    client</p> <p></p> <p></p> </td> </tr>
<tr>
  <td width="312"><p>
      <i>\Google\Chrome\User Data\Default\Login Data</i></p> <p>
      <i>\Chromium\User Data\Default\Login Data</i></p> <p>
      <i>\Comodo\Dragon\User Data\Default\Login Data</i></p> <p>
      <i>\Yandex\YandexBrowser\User Data\Default\Login
    Data</i></p> <p>
      <i>\Opera Software\Opera Stable\Login Data</i></p> <p>
      <i>Software\Microsoft\Internet
    Explorer\IntelliForms\Storage2</i></p> <p>
      <i>vaultcli.dll:</i>
    <i>VaultOpenVault,VaultCloseVault,VaultEnumerateItem,VaultGetItem,VaultFree</i></p> <p>
      <i>select * from moz_login</i></p> </td> <td width="289"><p></p> <p>Stealing login details from browsers</p>
    <p></p> </td> </tr></tbody></table>