crypvault | 05bbe75c2e13f4e9267f6217a0d91acab003fc7f1eb1a92d81b10bd3cf448f9e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-07-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1268348828883dbc98a1a584dec8ded8_JaffaCakes118.js
Size

283KB
MD5

1268348828883dbc98a1a584dec8ded8
SHA1

7fd4ed93d6a549baf7402f7fd5e736faf2ae40f4
SHA256

05bbe75c2e13f4e9267f6217a0d91acab003fc7f1eb1a92d81b10bd3cf448f9e
SHA512

8d7df58ab9cb6ca13c1e3317cf51ec7ae67e7389e0464794dab8edaabd1b6454d73b8c27796335693f2aa6453a4dfed1261685f10d180a793781ae35adde2dcb
SSDEEP

6144:AFM0/rWK/2tG3ZL1hsI5y7XFeLAPlRpQEWpbTMp4Jc3L:AX/d/2QtT5y7XnlRpQHFTMaJGL

Score

10^/10

crypvault pony collection credential_access defense_evasion discovery evasion execution impact ransomware rat spyware stealer upx

Malware Config

Extracted

Family

pony

http://dinom.spb.ru/api/index.php

Signatures

CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
ransomware crypvault
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1128	cmd.exe	37

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exe

pid	Process
2008	bcdedit.exe
3036	bcdedit.exe

Drops startup file 2 IoCs

Processes:

2e4cd28716d.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	2e4cd28716d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	2e4cd28716d.exe

Executes dropped EXE 2 IoCs

Processes:

2e4cd28716d.exe2e4cd28716d.exe

pid	Process
2488	2e4cd28716d.exe
2924	2e4cd28716d.exe

Loads dropped DLL 1 IoCs

Processes:

2e4cd28716d.exe

pid	Process
2488	2e4cd28716d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2924-24-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-27-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-31-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-33-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-36-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-28-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-37-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-38-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-35-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-130-0x0000000000400000-0x0000000000E28000-memory.dmp	upx
behavioral1/memory/2924-182-0x0000000000400000-0x0000000000E28000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

2e4cd28716d.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	2e4cd28716d.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

2e4cd28716d.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2e4cd28716d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

2e4cd28716d.exe

description	pid	Process	procid_target
PID 2488 set thread context of 2924	2488	2e4cd28716d.exe	33

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2e4cd28716d.exe2e4cd28716d.exemshta.exeWMIC.exeWINWORD.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e4cd28716d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e4cd28716d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exe

pid	Process
1712	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid	Process
2464	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2e4cd28716d.exe2e4cd28716d.exe

pid	Process
2488	2e4cd28716d.exe
2924	2e4cd28716d.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

2e4cd28716d.exeWMIC.exevssvc.exe

description	pid	Process
Token: SeImpersonatePrivilege	2924	2e4cd28716d.exe
Token: SeTcbPrivilege	2924	2e4cd28716d.exe
Token: SeChangeNotifyPrivilege	2924	2e4cd28716d.exe
Token: SeCreateTokenPrivilege	2924	2e4cd28716d.exe
Token: SeBackupPrivilege	2924	2e4cd28716d.exe
Token: SeRestorePrivilege	2924	2e4cd28716d.exe
Token: SeIncreaseQuotaPrivilege	2924	2e4cd28716d.exe
Token: SeAssignPrimaryTokenPrivilege	2924	2e4cd28716d.exe
Token: SeIncreaseQuotaPrivilege	3068	WMIC.exe
Token: SeSecurityPrivilege	3068	WMIC.exe
Token: SeTakeOwnershipPrivilege	3068	WMIC.exe
Token: SeLoadDriverPrivilege	3068	WMIC.exe
Token: SeSystemProfilePrivilege	3068	WMIC.exe
Token: SeSystemtimePrivilege	3068	WMIC.exe
Token: SeProfSingleProcessPrivilege	3068	WMIC.exe
Token: SeIncBasePriorityPrivilege	3068	WMIC.exe
Token: SeCreatePagefilePrivilege	3068	WMIC.exe
Token: SeBackupPrivilege	3068	WMIC.exe
Token: SeRestorePrivilege	3068	WMIC.exe
Token: SeShutdownPrivilege	3068	WMIC.exe
Token: SeDebugPrivilege	3068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3068	WMIC.exe
Token: SeRemoteShutdownPrivilege	3068	WMIC.exe
Token: SeUndockPrivilege	3068	WMIC.exe
Token: SeManageVolumePrivilege	3068	WMIC.exe
Token: 33	3068	WMIC.exe
Token: 34	3068	WMIC.exe
Token: 35	3068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3068	WMIC.exe
Token: SeSecurityPrivilege	3068	WMIC.exe
Token: SeTakeOwnershipPrivilege	3068	WMIC.exe
Token: SeLoadDriverPrivilege	3068	WMIC.exe
Token: SeSystemProfilePrivilege	3068	WMIC.exe
Token: SeSystemtimePrivilege	3068	WMIC.exe
Token: SeProfSingleProcessPrivilege	3068	WMIC.exe
Token: SeIncBasePriorityPrivilege	3068	WMIC.exe
Token: SeCreatePagefilePrivilege	3068	WMIC.exe
Token: SeBackupPrivilege	3068	WMIC.exe
Token: SeRestorePrivilege	3068	WMIC.exe
Token: SeShutdownPrivilege	3068	WMIC.exe
Token: SeDebugPrivilege	3068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3068	WMIC.exe
Token: SeRemoteShutdownPrivilege	3068	WMIC.exe
Token: SeUndockPrivilege	3068	WMIC.exe
Token: SeManageVolumePrivilege	3068	WMIC.exe
Token: 33	3068	WMIC.exe
Token: 34	3068	WMIC.exe
Token: 35	3068	WMIC.exe
Token: SeBackupPrivilege	1552	vssvc.exe
Token: SeRestorePrivilege	1552	vssvc.exe
Token: SeAuditPrivilege	1552	vssvc.exe
Token: SeImpersonatePrivilege	2924	2e4cd28716d.exe
Token: SeTcbPrivilege	2924	2e4cd28716d.exe
Token: SeChangeNotifyPrivilege	2924	2e4cd28716d.exe
Token: SeCreateTokenPrivilege	2924	2e4cd28716d.exe
Token: SeBackupPrivilege	2924	2e4cd28716d.exe
Token: SeRestorePrivilege	2924	2e4cd28716d.exe
Token: SeIncreaseQuotaPrivilege	2924	2e4cd28716d.exe
Token: SeAssignPrimaryTokenPrivilege	2924	2e4cd28716d.exe
Token: SeImpersonatePrivilege	2924	2e4cd28716d.exe
Token: SeTcbPrivilege	2924	2e4cd28716d.exe
Token: SeChangeNotifyPrivilege	2924	2e4cd28716d.exe
Token: SeCreateTokenPrivilege	2924	2e4cd28716d.exe
Token: SeBackupPrivilege	2924	2e4cd28716d.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

2e4cd28716d.exeWINWORD.EXE

pid	Process
2488	2e4cd28716d.exe
2464	WINWORD.EXE
2464	WINWORD.EXE

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

wscript.exe2e4cd28716d.exe2e4cd28716d.execmd.exeWINWORD.EXE

description	pid	Process	procid_target
PID 2588 wrote to memory of 2464	2588	wscript.exe	30
PID 2588 wrote to memory of 2464	2588	wscript.exe	30
PID 2588 wrote to memory of 2464	2588	wscript.exe	30
PID 2588 wrote to memory of 2464	2588	wscript.exe	30
PID 2588 wrote to memory of 2488	2588	wscript.exe	31
PID 2588 wrote to memory of 2488	2588	wscript.exe	31
PID 2588 wrote to memory of 2488	2588	wscript.exe	31
PID 2588 wrote to memory of 2488	2588	wscript.exe	31
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2488 wrote to memory of 2924	2488	2e4cd28716d.exe	33
PID 2924 wrote to memory of 1064	2924	2e4cd28716d.exe	34
PID 2924 wrote to memory of 1064	2924	2e4cd28716d.exe	34
PID 2924 wrote to memory of 1064	2924	2e4cd28716d.exe	34
PID 2924 wrote to memory of 1064	2924	2e4cd28716d.exe	34
PID 2924 wrote to memory of 3068	2924	2e4cd28716d.exe	35
PID 2924 wrote to memory of 3068	2924	2e4cd28716d.exe	35
PID 2924 wrote to memory of 3068	2924	2e4cd28716d.exe	35
PID 2924 wrote to memory of 3068	2924	2e4cd28716d.exe	35
PID 1984 wrote to memory of 1712	1984	cmd.exe	40
PID 1984 wrote to memory of 1712	1984	cmd.exe	40
PID 1984 wrote to memory of 1712	1984	cmd.exe	40
PID 1984 wrote to memory of 2008	1984	cmd.exe	43
PID 1984 wrote to memory of 2008	1984	cmd.exe	43
PID 1984 wrote to memory of 2008	1984	cmd.exe	43
PID 1984 wrote to memory of 3036	1984	cmd.exe	44
PID 1984 wrote to memory of 3036	1984	cmd.exe	44
PID 1984 wrote to memory of 3036	1984	cmd.exe	44
PID 2464 wrote to memory of 2304	2464	WINWORD.EXE	45
PID 2464 wrote to memory of 2304	2464	WINWORD.EXE	45
PID 2464 wrote to memory of 2304	2464	WINWORD.EXE	45
PID 2464 wrote to memory of 2304	2464	WINWORD.EXE	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_win_path 1 IoCs

Processes:

2e4cd28716d.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2e4cd28716d.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\1268348828883dbc98a1a584dec8ded8_JaffaCakes118.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc_ed11ce.docx"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2304
- C:\Users\Admin\AppData\Local\Temp\2e4cd28716d.exe
  "C:\Users\Admin\AppData\Local\Temp\2e4cd28716d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\2e4cd28716d.exe
    C:\Users\Admin\AppData\Local\Temp\2e4cd28716d.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_win_path
    PID:2924
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:1064
  - - C:\Windows\SysWOW64\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068

C:\Windows\system32\cmd.exe
cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1712
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2008
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\Admin\AppData\Local\Temp\~$c_ed11ce.docx

Filesize
162B

MD5
943297dc7e4e167335e7d7e706bd4ad9

SHA1
cb3c55a6c4901001c2a2893cc059bf53091b23e8

SHA256
19d9f4d720ef5d52383f29ee5edd686f4538757bdb6f8b6aa4c2fa1df32d4763

SHA512
66a247f6006117bd01da6d48a2037630ec84da487e2230750e95cb26b241a5c6978553c51dce03ebe8fbc5efef53dd5a354fdb7853e17c05ca3138831509bf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e4cd28716d.exe

Filesize
152KB

MD5
347684b6130a16aace57a364658c8435

SHA1
9f6a1ceb820319d56f047b0c1213f7359dc6b7da

SHA256
4bc47e12fdaadd5d9da37ee13c5c173bf61a013823f5c49065cd5d43f2ddef94

SHA512
0596c6f6b80bba6bf4a1874019faf3198a3d9d0dcf1c79bcaa76a5324adf3ee8ce03bc627d77bbe6b565f86caab8ba9df826d894704d13243bfef32005d4f9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\doc_ed11ce.docx

Filesize
22KB

MD5
24a09f3f72fe19cc920e86645626f197

SHA1
e9cee70b03d0938b8590b01ea89325f65ec90971

SHA256
37073e6c5503ebe0b3101f42f98c56892e1db686e5592255faf443ee6066dce6

SHA512
c59049f19d5eb81283c1848c8145f7a22c1386a40af9d31f3641fecb6d762f75660492f58797514d1053ea87e53635307cdd75366f87ba18f019523967cf27e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
2aed0ef9b7ca9d7fc3d096320b416b4a

SHA1
eb8383ed2cc3c064efbbc0a935255bbe52346d1b

SHA256
b4a8904d7187bbae04dc592f8f6a197aa3633f1a98e6fcff9ab9f993a94e0635

SHA512
f3c1a0164b1c5209b673ca6f071dfe589251dc7ccf9f335b64db02bf950c389decba817e934c20ab4c6e821c79ea07ff9205298b9da15c5f253f40cd9477e887

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta

Filesize
4KB

MD5
b71751d104ed8f256ae64a7d02821be0

SHA1
bc3e6ac19bf1431a5872597684b2982b8ba07d87

SHA256
6a37244fbabb6238f178c7b769b3d0f15c93d70fece941b416c8e71140538004

SHA512
b3bee8dd51f874f5677dbb37989077776d0169d97760395d38ab52ac422ce3a9db78df3970a6c1ac6e18538d8e014fc72f3481964976a5f26b2c7e63efe0ffdf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VAULT.KEY

Filesize
1KB

MD5
8b3c3ed194728acce8a04e8e2bfe62a6

SHA1
144a6800357571cc291df1d558a63e88ca236eb5

SHA256
87f71a3acf63721b7a0af38e222c755ef18516321adefffdfec570c4bd6b6a96

SHA512
77ce72c31eb96ec71f690d5092650e5a2364643b0a9c4cf00ad3ef9df7dd5a52027d6e047f9b020fc4cc6f9d47226c5e87db6ca6474c7066c101da1b04b53a8e

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
f179b38efb131fe9ad676f4b03a18369

SHA1
9478bd8fee79cbbb42d935747290d6434a18f221

SHA256
72687ac960a85942e32020e051b56a41af1eee24b7a17756b5b0779f8a1d52c3

SHA512
9bc73f0688594e74842fc95918a665a0540fd43b3be0d82c8535063282f3bb19e4821cd6d066eaa5d290f9e7ab2cafd42e5f4dd35444d3363ac047d5c61b4a2f

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
755013bef6c797721834f0f336509456

SHA1
400180d8f04d8e0bed626603fdc81f4a7c42a11a

SHA256
7e6770c80322aec1304b0cfe5e81d169a917135d53d365aeeb58c3e0d33df42f

SHA512
0c80f6def90f22b8994e4d61bdeda365dd6ae0dc070ac26c78f801448949dca032bb9922238c5f886c8728114e8cfc31ec82f5527e9bc5032481d6f9fd32b4d6

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
5c27ee062378bf4a4f1b963fdc867a3d

SHA1
e8f30952a8a5722f535f657012ff121e1e9730b4

SHA256
2dd3a3c1c16ad589270000c7db708e28a7c26279ea847517d91468b7d5911644

SHA512
cee96add18d9b5137f4d39dfc8c26a1dd6f34780ab8bd63cea510e54878c3f70fc00cd8eb71418634a63fa8e8807e7b1d8d96fd3ac8b4ca3a1d71b1802876ed0

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
0333f2624bc9830a339c53bfa28845cf

SHA1
b34a59d0c46db3301ebd059e5270f8ec312f0765

SHA256
713d5cff0701505aa5affa2c7187cf3bba37c15634ec8fc8238749ff00a853dd

SHA512
3bb9af97d2840a3d2d34d47bf75645524fd71ba8ba05b42c87bbb4fa9aad00f161794c65ffa5be85489657869b89d18d884d7bcc0f1d9b68427caca4eaf8ef45

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
60d178fed5bfafb342936331a5f836c2

SHA1
9b12cb93a5788ba35c2868ce75891e19f7c206ae

SHA256
1d7c811b33be472b61335979eb1a5137a218e91503b4eb526aadcc0b314b926f

SHA512
ff167015ab2012a37b3672a621a1e031435266210099a6e6018038c9def1fb91d66d16e982c4f502c0609255f9b6d3c1b44f8d9a6343e76908d18eb92520a20b

Download Submit
memory/2464-3-0x000000002F301000-0x000000002F302000-memory.dmp

Filesize
4KB

Download
memory/2464-9-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2464-185-0x0000000070CAD000-0x0000000070CB8000-memory.dmp

Filesize
44KB

Download
memory/2464-202-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2464-10-0x0000000070CAD000-0x0000000070CB8000-memory.dmp

Filesize
44KB

Download
memory/2924-27-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-39-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/2924-35-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-38-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-37-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-28-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-36-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2924-130-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-33-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-31-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-182-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-24-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-22-0x0000000000400000-0x0000000000E28000-memory.dmp

Filesize
10.2MB

Download
memory/2924-20-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download