Overview
overview
9Static
static
3brk.bat
windows7-x64
9brk.bat
windows10-2004-x64
9gpg.exe
windows7-x64
1gpg.exe
windows10-2004-x64
1gpgconf.exe
windows7-x64
1gpgconf.exe
windows10-2004-x64
1libassuan-0.dll
windows7-x64
1libassuan-0.dll
windows10-2004-x64
3libgcrypt-20.dll
windows7-x64
1libgcrypt-20.dll
windows10-2004-x64
3libgpg-error-0.dll
windows7-x64
1libgpg-error-0.dll
windows10-2004-x64
1libnpth-0.dll
windows7-x64
1libnpth-0.dll
windows10-2004-x64
1libsqlite3-0.dll
windows7-x64
3libsqlite3-0.dll
windows10-2004-x64
3sh.vbs
windows7-x64
9sh.vbs
windows10-2004-x64
9zlib1.dll
windows7-x64
3zlib1.dll
windows10-2004-x64
3Analysis
- max time kernel
120s - max time network
121s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
17/06/2024, 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
brk.bat
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
brk.bat
Resource
win10v2004-20240611-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
gpg.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
gpg.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
gpgconf.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
gpgconf.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
libassuan-0.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
libassuan-0.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
libgcrypt-20.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
libgcrypt-20.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
libgpg-error-0.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
libgpg-error-0.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
libnpth-0.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
libnpth-0.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
libsqlite3-0.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
libsqlite3-0.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
sh.vbs
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
sh.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
zlib1.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
zlib1.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target brk.bat
- Size 3KB
- Sample240617-acn68avcqa
- SHA256 4d177a08245a8c582abbdae3a83fcf95a8fd464ebd040a1f69c10e30f72704f5
- MD5 e75cc1d88adf14771dd087dc0dc29102
- SHA1 41ec0539846180cc7d9a8f7258606665e8923817
- SHA512 29ea8d36b7f433527901f83efb95e112d02eb43345c58a99e7867cc01737f494a3b0a1e6c8f844adb2d919cdacde1f1dc0bdda345e94c8b88ef1d6f3d65fd8a9
- MD5 SHA1 SHA512
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{353435C1-2C3D-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dab2094ac0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424744577" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a92b41e24f1e31484701f08b7c604396eccd228c2816221fd206d29af9390d68000000000e80000000020000200000003b80533374331f6e8f073b1370227d4b7dcf6650e8a4bd908063e1780496705d2000000068eace7a6b268f466a860b967bd0142bcdfdf9446891b47763f460ba5824abb7400000001284618e0e9db021352602da6c4e15821268d2ecc1abb98b7db4f0aa23c279617dac09357846f1e6be1b86c525dcd8fb0f0e7591387086f1686a02a72a8e0c31 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000572aac0ce8c2aa7c6ecbdac17ddc372311b5821f892125679b92394a85b7d33f000000000e8000000002000020000000f93f3fa321756cc05d7a375c6dbf7447db767631daa7998067cdaccc0ccb6e57900000003737f53ef662b19df189f67689eaa474e05bb0471b4bd22834c3a5835fcfbd94ed2d8fc71f5cd5d9264af8c5056ac7ca8cfe7b7b45974520d441499331e46f5e6e53da1062454fc7c2862dd16085a921b1f1ca7f374a8b0ef8b57501834f0e7a05e27892b065aacd9d04130ea6500f313e71b19b0ef442c08b198fbad638dad1a00d75215001d87cbe44b6a275734d0b40000000b43b3e4140f97786d49d222114fbd6b2c0221f2df8b7c6f2e9cb765490ff5baf819d71ddcbad03070497e4ee52dbd98fe607a558a20284a7b104e097b2144449 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\C:\Users\Admin\AppData\Local\Temp\rost.doc cmd.exe - Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 2968 gpg.exe 2992 gpg.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2992 gpg.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2596 WMIC.exe Token: SeSecurityPrivilege 2596 WMIC.exe Token: SeTakeOwnershipPrivilege 2596 WMIC.exe Token: SeLoadDriverPrivilege 2596 WMIC.exe Token: SeSystemProfilePrivilege 2596 WMIC.exe Token: SeSystemtimePrivilege 2596 WMIC.exe Token: SeProfSingleProcessPrivilege 2596 WMIC.exe Token: SeIncBasePriorityPrivilege 2596 WMIC.exe Token: SeCreatePagefilePrivilege 2596 WMIC.exe Token: SeBackupPrivilege 2596 WMIC.exe Token: SeRestorePrivilege 2596 WMIC.exe Token: SeShutdownPrivilege 2596 WMIC.exe Token: SeDebugPrivilege 2596 WMIC.exe Token: SeSystemEnvironmentPrivilege 2596 WMIC.exe Token: SeRemoteShutdownPrivilege 2596 WMIC.exe Token: SeUndockPrivilege 2596 WMIC.exe Token: SeManageVolumePrivilege 2596 WMIC.exe Token: 33 2596 WMIC.exe Token: 34 2596 WMIC.exe Token: 35 2596 WMIC.exe Token: SeIncreaseQuotaPrivilege 2596 WMIC.exe Token: SeSecurityPrivilege 2596 WMIC.exe Token: SeTakeOwnershipPrivilege 2596 WMIC.exe Token: SeLoadDriverPrivilege 2596 WMIC.exe Token: SeSystemProfilePrivilege 2596 WMIC.exe Token: SeSystemtimePrivilege 2596 WMIC.exe Token: SeProfSingleProcessPrivilege 2596 WMIC.exe Token: SeIncBasePriorityPrivilege 2596 WMIC.exe Token: SeCreatePagefilePrivilege 2596 WMIC.exe Token: SeBackupPrivilege 2596 WMIC.exe Token: SeRestorePrivilege 2596 WMIC.exe Token: SeShutdownPrivilege 2596 WMIC.exe Token: SeDebugPrivilege 2596 WMIC.exe Token: SeSystemEnvironmentPrivilege 2596 WMIC.exe Token: SeRemoteShutdownPrivilege 2596 WMIC.exe Token: SeUndockPrivilege 2596 WMIC.exe Token: SeManageVolumePrivilege 2596 WMIC.exe Token: 33 2596 WMIC.exe Token: 34 2596 WMIC.exe Token: 35 2596 WMIC.exe Token: SeBackupPrivilege 2500 vssvc.exe Token: SeRestorePrivilege 2500 vssvc.exe Token: SeAuditPrivilege 2500 vssvc.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2676 iexplore.exe 2676 iexplore.exe 624 IEXPLORE.EXE 624 IEXPLORE.EXE 624 IEXPLORE.EXE 624 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2140 wrote to memory of 1960 2140 cmd.exe 30 PID 2140 wrote to memory of 1960 2140 cmd.exe 30 PID 2140 wrote to memory of 1960 2140 cmd.exe 30 PID 2140 wrote to memory of 2968 2140 cmd.exe 31 PID 2140 wrote to memory of 2968 2140 cmd.exe 31 PID 2140 wrote to memory of 2968 2140 cmd.exe 31 PID 2140 wrote to memory of 2968 2140 cmd.exe 31 PID 2140 wrote to memory of 2992 2140 cmd.exe 32 PID 2140 wrote to memory of 2992 2140 cmd.exe 32 PID 2140 wrote to memory of 2992 2140 cmd.exe 32 PID 2140 wrote to memory of 2992 2140 cmd.exe 32 PID 2140 wrote to memory of 2176 2140 cmd.exe 33 PID 2140 wrote to memory of 2176 2140 cmd.exe 33 PID 2140 wrote to memory of 2176 2140 cmd.exe 33 PID 2140 wrote to memory of 2948 2140 cmd.exe 34 PID 2140 wrote to memory of 2948 2140 cmd.exe 34 PID 2140 wrote to memory of 2948 2140 cmd.exe 34 PID 2140 wrote to memory of 2676 2140 cmd.exe 35 PID 2140 wrote to memory of 2676 2140 cmd.exe 35 PID 2140 wrote to memory of 2676 2140 cmd.exe 35 PID 2948 wrote to memory of 2596 2948 WScript.exe 36 PID 2948 wrote to memory of 2596 2948 WScript.exe 36 PID 2948 wrote to memory of 2596 2948 WScript.exe 36 PID 2676 wrote to memory of 624 2676 iexplore.exe 40 PID 2676 wrote to memory of 624 2676 iexplore.exe 40 PID 2676 wrote to memory of 624 2676 iexplore.exe 40 PID 2676 wrote to memory of 624 2676 iexplore.exe 40 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\brk.bat"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\chcp.comchcp 8662⤵PID:1960
-
-
C:\Users\Admin\AppData\Local\Temp\gpg.exeC:\Users\Admin\AppData\Local\Temp\gpg.exe --import C:\Users\Admin\AppData\Local\Temp\brg.brg2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\gpg.exeC:\Users\Admin\AppData\Local\Temp\gpg.exe -r y1688 --yes -q --no-verbose --trust-model always -o C:\Users\Admin\AppData\Local\Temp\zarlock.KEY -e C:\Users\Admin\AppData\Local\Temp\rost.doc2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
PID:2992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c type C:\Users\Admin\AppData\Local\Temp\Flag.txt2⤵PID:2176
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sh.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\zarlock_Help_decrypt.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:624
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Flag.txt
- Size 268KB
- SHA256 a085c7f909ee17e6552062ac2838603ca57c282cefc73d6000c8ed3003762a25
- MD5 da45c43f0e7a9eee306d41f4cfefea63
- SHA1 cbb2a10b67d367860597274c9d220a3159ff20c8
- SHA512 888374972587452861268ec3926b1400e04d1b7614d5aa56d71e9405fc55575026187d721abb50593fe6af5a925e3cff2cdd242bfb4402fc5bdf5a101c718e81
- SSDEEP 3072:oT+GN9e9eclFWefXquGULutlFuoKbJUZteQYoo:2+GfclFWefXquGULutlFuZbJUaQYoo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flag.txt
- Size 4KB
- SHA256 0fa0ed58e9fe97e2a66bb3488115e11c7da20eaa399c03fb65434f36fdea44f0
- MD5 991a556a343d4c0d16426bece876cf89
- SHA1 78b9f997c8c63b4fd1fa9451ed09f112a2291c83
- SHA512 87b90845e7ecaa78480c7f8ac2198fae890fd0c4b8968d8372f37c17136f8d03d997d7b10703f1917f0d9ebfdb7d58be9ae92da2f9d4adbf85b1d1b939d94829
- SSDEEP 96:ofnF/bI793N0mT1eJNpy/YiyMdXpU2jkHWQ3webxeN5P:ocyMFpU2N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\rost.doc
- Size 39B
- SHA256 8049ecb1f7a5242302ad378e9b485622f1287e57f5ec90c1aef6bca5cacf1880
- MD5 d2e25d1cbdad4511ebcae522ee8b0a04
- SHA1 e1901352093b3c8a99d499b6d3694838b57f5dcd
- SHA512 6bf03b749e4f0046e1a3d6b412cbb071b2d23148f7fa390bc59027fff19ec38098aeb3ac6388279a7206448a8a72d7a94bb63935019f78d5bad84c24c035f0f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\zarlock_Help_decrypt.html
- Size 683B
- SHA256 ec07910016d5d1cba9299bcb60079c37e1b3b9e63aebcffd5612365849232f09
- MD5 5c2f6ab71e32c4d54a0974b6f79f2a9a
- SHA1 2387fc2c9133d9436e90dd913fe0d2bab865aaf4
- SHA512 41e7780ebacfb3f2026d9160064ccbb644822a1a0f52810aebed8cd82517f33624ea1c59c4df215dcf2b4d5d55be05389e94825a7aac6d68c918a3715380333b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gnupg\pubring.kbx
- Size 1KB
- SHA256 65f0bd2afdeb0fedfe298734c42a5f49d4c7d6a0dc7be53851f6e09630452176
- MD5 6e6f10a2f13df4d29962eaa2a03f198f
- SHA1 204f19bb55aeb0d31de56b089efe02efc7ce92ac
- SHA512 b7c0c4df410d3fb6dd170a4759241c13d6e7aebd2a4bfd0c46b90572f701320ad850b08602e7f0c3409da1ae90780104c7d6db193563cb36dfec595f6251ec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gnupg\trustdb.gpg
- Size 1KB
- SHA256 622d221beeeef268f7df45530a1c186df1d519d4001a0c72daa1baee3812be31
- MD5 438333f26240508fd5b0e13eba3976de
- SHA1 d97e55f144d82598cd0561ce3cd3abf01c576eb3
- SHA512 d92b293692493290e51f569a82969aa296472ae4cc57c00a065a91271bd670fd0f610ccbeaf545126fe29fa50dc3e0387a00d8e4ea7618cc6e500eaa115e3c2e
- MD5 SHA1 SHA512