19d3ca02ad8df7cffa65517ce95d52badeffed18dc35cc8db3351f583f1f3711

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
brk.bat
Size 3KB
Sample240617-acn68avcqa
SHA256 4d177a08245a8c582abbdae3a83fcf95a8fd464ebd040a1f69c10e30f72704f5
MD5 e75cc1d88adf14771dd087dc0dc29102
SHA1 41ec0539846180cc7d9a8f7258606665e8923817
SHA512 29ea8d36b7f433527901f83efb95e112d02eb43345c58a99e7867cc01737f494a3b0a1e6c8f844adb2d919cdacde1f1dc0bdda345e94c8b88ef1d6f3d65fd8a9
MD5 SHA1 SHA512

Score

9^/10

defense_evasion execution impact ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\C:\Users\Admin\AppData\Local\Temp\rost.doc	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1932	gpg.exe
2468	msedge.exe
2468	msedge.exe
4088	msedge.exe
4088	msedge.exe
748	identity_helper.exe
748	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2144	WMIC.exe
Token: SeSecurityPrivilege	2144	WMIC.exe
Token: SeTakeOwnershipPrivilege	2144	WMIC.exe
Token: SeLoadDriverPrivilege	2144	WMIC.exe
Token: SeSystemProfilePrivilege	2144	WMIC.exe
Token: SeSystemtimePrivilege	2144	WMIC.exe
Token: SeProfSingleProcessPrivilege	2144	WMIC.exe
Token: SeIncBasePriorityPrivilege	2144	WMIC.exe
Token: SeCreatePagefilePrivilege	2144	WMIC.exe
Token: SeBackupPrivilege	2144	WMIC.exe
Token: SeRestorePrivilege	2144	WMIC.exe
Token: SeShutdownPrivilege	2144	WMIC.exe
Token: SeDebugPrivilege	2144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2144	WMIC.exe
Token: SeRemoteShutdownPrivilege	2144	WMIC.exe
Token: SeUndockPrivilege	2144	WMIC.exe
Token: SeManageVolumePrivilege	2144	WMIC.exe
Token: 33	2144	WMIC.exe
Token: 34	2144	WMIC.exe
Token: 35	2144	WMIC.exe
Token: 36	2144	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2144	WMIC.exe
Token: SeSecurityPrivilege	2144	WMIC.exe
Token: SeTakeOwnershipPrivilege	2144	WMIC.exe
Token: SeLoadDriverPrivilege	2144	WMIC.exe
Token: SeSystemProfilePrivilege	2144	WMIC.exe
Token: SeSystemtimePrivilege	2144	WMIC.exe
Token: SeProfSingleProcessPrivilege	2144	WMIC.exe
Token: SeIncBasePriorityPrivilege	2144	WMIC.exe
Token: SeCreatePagefilePrivilege	2144	WMIC.exe
Token: SeBackupPrivilege	2144	WMIC.exe
Token: SeRestorePrivilege	2144	WMIC.exe
Token: SeShutdownPrivilege	2144	WMIC.exe
Token: SeDebugPrivilege	2144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2144	WMIC.exe
Token: SeRemoteShutdownPrivilege	2144	WMIC.exe
Token: SeUndockPrivilege	2144	WMIC.exe
Token: SeManageVolumePrivilege	2144	WMIC.exe
Token: 33	2144	WMIC.exe
Token: 34	2144	WMIC.exe
Token: 35	2144	WMIC.exe
Token: 36	2144	WMIC.exe
Token: SeBackupPrivilege	948	vssvc.exe
Token: SeRestorePrivilege	948	vssvc.exe
Token: SeAuditPrivilege	948	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4912	4492	cmd.exe	83
PID 4492 wrote to memory of 4912	4492	cmd.exe	83
PID 4492 wrote to memory of 3240	4492	cmd.exe	85
PID 4492 wrote to memory of 3240	4492	cmd.exe	85
PID 4492 wrote to memory of 3240	4492	cmd.exe	85
PID 4492 wrote to memory of 1932	4492	cmd.exe	87
PID 4492 wrote to memory of 1932	4492	cmd.exe	87
PID 4492 wrote to memory of 1932	4492	cmd.exe	87
PID 4492 wrote to memory of 4932	4492	cmd.exe	92
PID 4492 wrote to memory of 4932	4492	cmd.exe	92
PID 4492 wrote to memory of 3296	4492	cmd.exe	93
PID 4492 wrote to memory of 3296	4492	cmd.exe	93
PID 4492 wrote to memory of 4088	4492	cmd.exe	94
PID 4492 wrote to memory of 4088	4492	cmd.exe	94
PID 3296 wrote to memory of 2144	3296	WScript.exe	96
PID 3296 wrote to memory of 2144	3296	WScript.exe	96
PID 4088 wrote to memory of 1960	4088	msedge.exe	98
PID 4088 wrote to memory of 1960	4088	msedge.exe	98
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 3708	4088	msedge.exe	101
PID 4088 wrote to memory of 2468	4088	msedge.exe	102
PID 4088 wrote to memory of 2468	4088	msedge.exe	102
PID 4088 wrote to memory of 1944	4088	msedge.exe	103
PID 4088 wrote to memory of 1944	4088	msedge.exe	103
PID 4088 wrote to memory of 1944	4088	msedge.exe	103
PID 4088 wrote to memory of 1944	4088	msedge.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\brk.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\system32\chcp.com
  chcp 866
  2⤵
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\gpg.exe
  C:\Users\Admin\AppData\Local\Temp\gpg.exe --import C:\Users\Admin\AppData\Local\Temp\brg.brg
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\gpg.exe
  C:\Users\Admin\AppData\Local\Temp\gpg.exe -r y1688 --yes -q --no-verbose --trust-model always -o C:\Users\Admin\AppData\Local\Temp\zarlock.KEY -e C:\Users\Admin\AppData\Local\Temp\rost.doc
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type C:\Users\Admin\AppData\Local\Temp\Flag.txt
  2⤵
  PID:4932
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sh.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\zarlock_Help_decrypt.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8556346f8,0x7ff855634708,0x7ff855634718
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2420 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7438465714865931355,2620418677547551081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:4408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ee1deaac577aba019762f69c6b2f00bd22174a0a67b3fe477fdd129df349713f
MD5 41a7de169ff8f209f0af5a41c5636749
SHA1 b097d211a6709ae885aa4388661c93fb35d22cc8
SHA512 d76d521bc9890d879b6a74fed0300063462598a1949fb4cf98eed8a2331268ba40ef7adc005e0344066f31ae2b4149da3b6f8760ad6454f9e347b321c99c2fad
SSDEEP 96:n/k/oxm/Dnmq361OpS/wpvWMoiVmdeHgisHUWQyV+VD7AiEwb:n/kB6ZYcGWMXsHrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9b072215868a29078ee98c5f0b5a569c6b6dcbcf0ed0d4d4409f710e80881c70
MD5 05a4b04542dd885212e0df17e4630081
SHA1 7c1b6ad1c5e80d3bc45458ced9ad31f866ed6f31
SHA512 d9b5565e3e6e018e470e41d227234a2af717f63376ca1a8fa38d3a4f2579b9c0cc5ea71cdf5b80fe1294e0bca1304d2a8a526f7063fcf53e000125e124900a09
SSDEEP 96:n/k/oxm/DQYmq361OpK/wpvWMoiVmdeHgisHUWQyV+VDCziEwb:n/kBIZYEGWMXsHro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0ef2128576721352ecef92d2929cb744b7ae0275723e8791472a1ecb5614158c
MD5 9026cdd2408d37e1e054826d11fd34db
SHA1 9792faf932f4dc190cf82a6deacfeab0a75b46de
SHA512 98652ef8fa3597a4412701b512d68e005e27ce7ef91e57fd8f14f2cbdcf0434510484be1c0ce3b4894fed4924fca953cc7c3adbb4c88d7505d7ff09f01504593
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupt4e2RUQ2kT3z2OMDCRHql/:A9iIxuERzA83h09RZxYt2/TaOMWRHql/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flag.txt

Path C:\Users\Admin\AppData\Local\Temp\Flag.txt
Size 260KB
SHA256 3159fb34506614ec54345d3df57f0753159876126787db4d9f622eb112407108
MD5 691b5b25ed9ed16d20fc575496d12ae7
SHA1 969ce71db6eddd7b34aa748f2a8d92bf5708347b
SHA512 bfdec08c912ee7c9a015e54804141ec3acdbb8b7af636bbf436ce5603aa8282aaf59e50f70c3da89f666a0400c97ee6fc83ea34c089d100fd737d4d77b9ba3f9
SSDEEP 6144:jJ+AaXcXFXefXI5wUYwiydtJUhZDY4vQM4kybTYNMWJakkAxNlOLEoGNjIi38jK/:jJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flag.txt

Path C:\Users\Admin\AppData\Local\Temp\Flag.txt
Size 4KB
SHA256 d6128edffcad72c01f6c353166388135826f7a6eee5cef84e97b26c57e4bb536
MD5 04817fec8680ddf6a2f1a048e2cf2705
SHA1 31f02028b8fcac86c02bb8b1e4519c1fba4fbdbe
SHA512 9c4d8feb4dd661abd549b130133ef780ed87d2894e0a686e560b2879089a774cdf779692656651901d5a8de1d18e050802c61e1cfcd246caa93e7635b37e1d8a
SSDEEP 96:o5xrncwjVwOmGXFKGK/KPKRKIKSKOK4KimKiPK/KBKtKkKLKxK8KCKsKeKbK0K9N:o5d3+7Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

rost.doc

Path C:\Users\Admin\AppData\Local\Temp\rost.doc
Size 39B
SHA256 22e3d0bca8f63b753e930bbe2c33d55f5f4099663f91e8f008c27cfee9046fca
MD5 d31b7e91934943d0dde9e1d4a91e211d
SHA1 ac1a52b31f41cab070c0247771465d1ab1816428
SHA512 c1c7ebc236a300f3d6970d9e7fa1cf58f689a9cc157331001e3539ea8db931f927a0b3842cd5f60279fe67ea507476d175a9bc21bab01f0a5e750bb099a0f30f
MD5 SHA1 SHA512

Submit Download

zarlock_Help_decrypt.html

Path C:\Users\Admin\AppData\Local\Temp\zarlock_Help_decrypt.html
Size 683B
SHA256 ec07910016d5d1cba9299bcb60079c37e1b3b9e63aebcffd5612365849232f09
MD5 5c2f6ab71e32c4d54a0974b6f79f2a9a
SHA1 2387fc2c9133d9436e90dd913fe0d2bab865aaf4
SHA512 41e7780ebacfb3f2026d9160064ccbb644822a1a0f52810aebed8cd82517f33624ea1c59c4df215dcf2b4d5d55be05389e94825a7aac6d68c918a3715380333b
MD5 SHA1 SHA512

Submit Download

pubring.kbx

Path C:\Users\Admin\AppData\Roaming\gnupg\pubring.kbx
Size 1KB
SHA256 b5658d044d7f9aa47bd8d7bb9f70edb035cfc46a862bf77fea4656ad85647de6
MD5 887b800d34090354a873840fa41a79e2
SHA1 2f0cfcbc3020b2464bea7ea6fbf87e98b8c05cb6
SHA512 7877988825568d12c41750820291f7ac8d6a92d9c06c61933f0e67066a3f1a40ac4b4f7d56614f2175d9c1c729adc21da576c42be42f72f522c255f06c2df4f0
MD5 SHA1 SHA512

Submit Download

trustdb.gpg

Path C:\Users\Admin\AppData\Roaming\gnupg\trustdb.gpg
Size 1KB
SHA256 fa9fcb12723c86038747b0a7ac629a0706350951a62aa73d8f241f1154788fe4
MD5 8272b01a61d48ea5a7bee14631f5c47e
SHA1 b0f275bc877849571208446a916b19b9efb4f23e
SHA512 31853b8c5ee021dd5ea0b9dc401625bc164f198a504df0c0d507222c39d5b3410e93e6eea018f67064b431af0a51d152e7b9b6c16733806aed033ee7d974247b
MD5 SHA1 SHA512

Submit Download

memory/1932-22-0x00000000655C0000-0x00000000656BA000-memory.dmp

Download

memory/1932-20-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/1932-23-0x000000006B480000-0x000000006B4AF000-memory.dmp

Download

memory/1932-24-0x0000000066580000-0x000000006664C000-memory.dmp

Download

memory/1932-25-0x0000000063080000-0x00000000630A0000-memory.dmp

Download

memory/1932-21-0x0000000065A80000-0x0000000065A99000-memory.dmp

Download

memory/3240-12-0x000000006B480000-0x000000006B4AF000-memory.dmp

Download

memory/3240-9-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/3240-10-0x0000000065A80000-0x0000000065A99000-memory.dmp

Download

memory/3240-11-0x00000000655C0000-0x00000000656BA000-memory.dmp

Download

memory/3240-14-0x0000000066580000-0x000000006664C000-memory.dmp

Download

memory/3240-13-0x0000000063080000-0x00000000630A0000-memory.dmp

Download