dcrat | hxxps://cdn[.]discordapp[.]com/attachments/1269226715406929953/1315030237461086398/Zorara1_1[.]rar?ex=6755ecd8&is=67549b58&hm=342942b3325c6d4cc071d538bee1cf51aaf560283814f73fd35c534defd6c7fc&

Analysis

max time kernel
195s
max time network
197s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-12-2024 19:06

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1269226715406929953/1315030237461086398/Zorara1_1.rar?ex=6755ecd8&is=67549b58&hm=342942b3325c6d4cc071d538bee1cf51aaf560283814f73fd35c534defd6c7fc&

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	Zoraraclear.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	portreviewCommon.exe

Executes dropped EXE 5 IoCs

pid	Process
5716	Zoraraclear.exe
5872	DCRatBuild.exe
5964	Zorara.exe
2088	portreviewCommon.exe
5512	portreviewCommon.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5964	Zorara.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Idle.exe	portreviewCommon.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\6ccacd8608530f	portreviewCommon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d2ead28e-f981-41b3-89d6-3b66767cdf09.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241207190633.pma	setup.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Registry.exe	portreviewCommon.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\ee2ad38f3d4382	portreviewCommon.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\System.exe	portreviewCommon.exe
File created	C:\Windows\SystemTemp\27d1bcfc3c54e0	portreviewCommon.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zoraraclear.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5488	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = d7605683db48db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "C:\\Users\\Admin\\Desktop\\InvokeGet.xhtml"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://login.live.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148251"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.bing.com/search?q=sebhsdhjvdjshfjshighfdhoighwirohgierernewjf+hijshjgh+kjdfh++gkjhdfk+hgjkdf+hgkjdfhjk+ghdfkj+gfh+dfjk+hgjkherig+gijkg+jgdskj+gjkdg+jfehjkg+hwjkrgkjwhrgk+hjrkgh+sjkf+gjkfshj+ghdfkj++ghjskd&src=IE-SearchBox&FORM=IESR4A"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://login.aliexpress.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7F622025-B4CE-11EF-A404-5A1F5D89E901} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d116693311903842b59702321b81f4c700000000020000000000106600000001000020000000c8b071f3b5457ccaf9d96f82c0a684db911ed06939907be5b3336d673d11dd79000000000e8000000002000020000000773638fc8127a9ce0b5ff51ce0c1965363169c1b1b227bf8e8683485ca5d69df20000000d2af0b2c51c53d85a0d4c3f731dc9d3230bf4ed56ba38d64362ba1757a8f4b5640000000e0fb7a056795a3b8299be13051a1d69971492d862513e14d1cabce58b12ac656dfb7fbd0dcfac4d7e2c4bbdcbc655cb5c28c7c10e4d16a842323a988406b6c88	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148251"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b74654db48db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e27e83db48db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = 09257a83db48db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c88a83db48db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31148251"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\IESettingSync	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url7 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440363421"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1405016682"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1405016682"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "http://www.bing.com/search?q=sebhsdhjvdjshfjshighfdhoighwirohgierernewjf+hijshjgh+kjdfh++gkjhdfk+hgjkdf+hgkjdfhjk+ghdfkj+gfh+dfjk+hgjkherig+gijkg+jgdskj+gjkdg+jfehjkg+hwjkrgkjwhrgk+hjrkgh+sjkf+gjkfshj+ghdfkj++ghjskd&src=IE-SearchBox&FORM=IESR4A"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0464454db48db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1407829199"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = a5396e83db48db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d116693311903842b59702321b81f4c700000000020000000000106600000001000020000000f4e71f6df645242e491c3f97bea43000c6c989006813d3017d9391f8ace587b7000000000e800000000200002000000086b678eed4cbfcdd28f08cdb7e0cc7be56578e4bee521c298e525534475b693a20000000ecf735f367f80e047d05c1e4ef9651be4288ea21b649f5d641a477b30a4ff1bf40000000f23d432f1646e0cd11c757062f11a71a8b057a98f020e541c427557e53fcdf301658e285a7f2822c73c99b27e08006814dfd03bbe9637f5d63933ba160bff46e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "47"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	portreviewCommon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5488	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2788	msedge.exe
2788	msedge.exe
4032	identity_helper.exe
4032	identity_helper.exe
2080	msedge.exe
2080	msedge.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe
2088	portreviewCommon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5512	portreviewCommon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3528	7zG.exe
Token: 35	3528	7zG.exe
Token: SeSecurityPrivilege	3528	7zG.exe
Token: SeSecurityPrivilege	3528	7zG.exe
Token: SeDebugPrivilege	2088	portreviewCommon.exe
Token: SeDebugPrivilege	5512	portreviewCommon.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
3528	7zG.exe
2788	msedge.exe
5540	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5540	iexplore.exe
5540	iexplore.exe
5788	IEXPLORE.EXE
5788	IEXPLORE.EXE
5788	IEXPLORE.EXE
5788	IEXPLORE.EXE
5540	iexplore.exe
5540	iexplore.exe
4264	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4904	2788	msedge.exe	81
PID 2788 wrote to memory of 4904	2788	msedge.exe	81
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 1036	2788	msedge.exe	82
PID 2788 wrote to memory of 2224	2788	msedge.exe	83
PID 2788 wrote to memory of 2224	2788	msedge.exe	83
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84
PID 2788 wrote to memory of 1560	2788	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1269226715406929953/1315030237461086398/Zorara1_1.rar?ex=6755ecd8&is=67549b58&hm=342942b3325c6d4cc071d538bee1cf51aaf560283814f73fd35c534defd6c7fc&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8b8bc46f8,0x7ff8b8bc4708,0x7ff8b8bc4718
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6b19d5460,0x7ff6b19d5470,0x7ff6b19d5480
    3⤵
    PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2220,12725030999939545503,15159760084589119934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3500

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Zorara1 (1)\" -spe -an -ai#7zMap26400:84:7zEvent8466
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3528

C:\Users\Admin\Downloads\Zorara1 (1)\Zorara\Zoraraclear.exe
"C:\Users\Admin\Downloads\Zorara1 (1)\Zorara\Zoraraclear.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5716
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5872
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\HyperreviewWincommon\0APkIItdJuTMwiSED3qMQuncpJddgwxYvhrJ.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\HyperreviewWincommon\G389UpYDqsyTn8FeSKOfwJ022GejG1.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2704
    - - C:\HyperreviewWincommon\portreviewCommon.exe
        
        "C:\HyperreviewWincommon/portreviewCommon.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HMVflaFJT2.bat"
        6⤵
        
        PID:5424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5488
        
        C:\HyperreviewWincommon\portreviewCommon.exe
        
        "C:\HyperreviewWincommon\portreviewCommon.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:5512
- C:\Users\Admin\AppData\Local\Temp\Zorara.exe
  "C:\Users\Admin\AppData\Local\Temp\Zorara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\InvokeGet.xhtml
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5540 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5788

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a35055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HyperreviewWincommon\0APkIItdJuTMwiSED3qMQuncpJddgwxYvhrJ.vbe

Filesize
229B

MD5
7c1d3d422cc4568c9a4325d2409a748b

SHA1
a8079bf0f981b9f9936a2547a8807bdb27f9c9fe

SHA256
1cc02cd69855ad9f85fbf3c7b47d33687c0565ba65b845653bb449693a179b8e

SHA512
82adf7ecb692bc6a5a58eac8b0233a637b819c7623eebb1654336304b3f90cf28ab667b70e9d21b54663a521e2cd5fc4dd2d93234df40fe19bd3356d4be8d553

Download Submit
C:\HyperreviewWincommon\G389UpYDqsyTn8FeSKOfwJ022GejG1.bat

Filesize
109B

MD5
e7cad9e2e20d4e5ecf20c2001a0efa17

SHA1
b334bb6e63edfaf0641a13c4af036ee3da98306d

SHA256
cb179ab0ce771d571669600c2007065f4ee6921467294c02a213a9177efc4c44

SHA512
83329d1641230cb2fd2f056dc721b226869ab9c4ac305efb5dd3ff2e462b9be1a85d855593478405e7da36d141b312f4ebd35e2f741e2eb4e6bbb9e07932e88d

Download Submit
C:\HyperreviewWincommon\portreviewCommon.exe

Filesize
1.9MB

MD5
e28077697ca723b6f179b20f3827d0b8

SHA1
9d4aa3c95498559b9f56eacdf75312e9c1202c9f

SHA256
f266a8f40e42999a2c3d502b27af5d2872e672258e36d97da643730667794d55

SHA512
b085d8c27c11f89213b4b9b337705c2d2020e2885f3d466bcc666fb3ebd24e8d34c9bd323c398178423eecea3a9f7de2cc030b0b79989a8660d7b2a0e5b3ee44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
e8e03ab177251f036762d507a19a44ee

SHA1
1f2a890144f576890ba6dbc891b47ea614924bea

SHA256
f0b88452e3f73544733cc6c75a7d217d34b0c125dee52569e339a3512ab1c982

SHA512
b03484fdd2cfee8fb9f782f9caee3893a54dec0f02ee79da74756d5f8d73dba5b536db8261a2b85a26d68af9b59f2351915c960e0d9cc583bab8f3a982d28993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
a9cb660b182e6ee9901b7a58179d9b9e

SHA1
206d3abcd45b16ac5ad1d1707dbdc6ce19e5b312

SHA256
5372649b2bf32139bbcf800aca97cb69b32c269daef7effe3cf1f3b0562115f6

SHA512
4b1288622602d92a524146fa3a2f19c5aa9964e3f767296e170ee72d5d1475fb70842f3ceae8b8019e6c31ed22212adf243e0d01870329e978d854fade7c4bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\portreviewCommon.exe.log

Filesize
1KB

MD5
8296a5cc2da6c4d12a8d8aaec177d68e

SHA1
d9c1338f8f9d56740445c24b2a1e60450db350e9

SHA256
6aa26f1d2c0c1171fd6462926987591b8f4ee0542346acf35a7964d876414eed

SHA512
d1df9133b653c02707df5c6680426cfaafb48d9c1330e10d4991500b0c14e5cf695a24c590f4bb732f1a7acf013b218375bdb0de5b86de773c1e9786708313f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92d3c27c-9eba-44ff-8e6a-9ab99bf76552.tmp

Filesize
5KB

MD5
72b63909b2c1dbebf9c369408b0d05b2

SHA1
9748e62b388f05138a2c544ed22f8edb7cd99abc

SHA256
53f39ca244e09e0a64266cccfcebbb847b7c3e45accadb4c7e2f17d040f1e132

SHA512
161c60848e13b3296f6e9f5422ab6ff6121b9cd3a3634c3ffaabb6337921284bb561659f0f9ca40a51a40c9f37461920d8764b680d42b2afa056617943743d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe57fd5b.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f55f7698e89219668e722846bef1f9e8

SHA1
f27e48ba00f00ea20b7750d5d4fe4e900e792b78

SHA256
0461e8f9e7845682ef860a007b86df620ed485c419d2e297449d2970b523b9ef

SHA512
3a987425df6c74f1995f9789666d3bd53f74ff6201e2f6b7a5f11a46d5347d955187f78857c421524d59be8dfdc122b67b5862298e5e870665c0136008d4008d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f49aef5ae8955892ab7928b120653e9

SHA1
69e69b80a8b9a69611adfd3ccaee10c79cc98bd1

SHA256
eb95fe184004b04ba5e7508482591ac1b620c3e1444d25ac5962118f05de337e

SHA512
1e61c0e9c4296b842b3d53c88a6832250990d540854cc29b020ce03a3cee8a507483d1970e6f28de3138e359eb95bc449b52b330efe9400465a08a7017294dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fbb10aaf848c9848777f3dde1c955746

SHA1
db1529f926fc42310630d808aa26d4427b0f4f23

SHA256
6ea7e5dc4d37818af0e7a8d94b570038996de7b1f7fbfd23ad308fee1cc50e92

SHA512
308755c00c4fa27c9932a10f18c810ceaa392ff75ca11584180e3f5ff69d96991569c51c9853b93d7e8b0fab22eace6fd646c5724417d76b8ed298b3e5adde80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8326df3303e274311aba74f34058badb

SHA1
a9c5ad5057140200723eb6e118de83ba873280da

SHA256
336663f0da3cc8baac6147c4e05c3a09777bdc5ae80a83c137cb24dfb137ffeb

SHA512
7856a38a18e1e671be0a2ba4b88e98b354f975c84e533c693f9cf651785bc915e6916aa715ef128668fb5b48ce40a1c1214e2d845baa25be588eadf7effd2a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml0Q8SGKU3.xml

Filesize
248B

MD5
d232027f1b3be21172261e6e99fb9029

SHA1
2184ed7ecc966b5cc16254f7bad457553e06ce80

SHA256
906a8656c2350da0818c6d47de69cc1906aa6d71df24878876802c0fcabb6148

SHA512
bc15987caea042a0496fb37c76d10cf8d7be628f1be1565e65ef4588347ce78292e4393a89c7d63bf136a83986fcbfcaf0399fbf7e86bf28d8a9ae052fb971db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml3QZFL148.xml

Filesize
227B

MD5
adbf49e8ec99785eecb5cc1dd6706ac8

SHA1
db4d058e663bb74995a7a0cc75c97c11db383e73

SHA256
ca2a7f8ae3dd89c73ed1f833b30f9fcce09837a198fff2ac087be5735500f78f

SHA512
267fe66da4006af8d1c225c4b231d25897a82d2249867f4b8cfcaf9fa9f08a54f21320a859923f8b1ea1dbc3a44fee4cfb2d2f2166e273c45aae34ff4962cffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml90ZRDZ5V.xml

Filesize
243B

MD5
db3381af93cfd47957384165501a7c43

SHA1
9c6ade10577ee74459e6b8300c64473f11995501

SHA256
d4310dc71be051761e4c51d60a1f42ac0d5a4374fe06a8873626322aeb5e6eb6

SHA512
f6f8fd65ff2b3fa365b56fdd06d72b91eaa7ac264c1c2a827693e832ebe5e529c4e24bcf02f0672459ce32db1e0545e394554d60c948a80b710ea0a4de2f5b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml98ZH0R1C.xml

Filesize
272B

MD5
64dd3592033bc4bc181b88bdb846e871

SHA1
b53f1fb5bfb51ba9fcefbd8f40fc6e46c91f57b8

SHA256
954dce9bc3a8420dccd909f0b5c2409e6346b8fe14c04445663d4ae9bd7d9463

SHA512
2ec3690e1eff57990be29e8791fcfcef0bfa9bb737bb86c8a7fdf50fb9f4da7da5e76dace9902f26295d8d07bd9495c147d09bedf220656bfb2281c6b8f7d313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsmlD19EQ8KK.xml

Filesize
493B

MD5
15c213751f85a1c677958fcef20ba40e

SHA1
4d0ec613407a3f6e30649b1ab4b3bd389561d561

SHA256
71139c5afbbbb62456693975cab0d574e731ba1c6353538bcda665ba4b0177d8

SHA512
7f12723cc70068ac0b1b9378b1fb24f7773c9a5a1509803c8cbacde9874e4d1f6cc7f6eee9ef16525b9faaf8b108b19d72df5aa93eca0091da9395d5da6efcc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsmlZROIVGND.xml

Filesize
230B

MD5
3761996e1da40cfc4a8cf8dfcdab1e73

SHA1
b36241c159f3251d2e29476e75527d9f0a29d18c

SHA256
7f2be691101c2888c725c97e0766ec97b1ae316103e723ace1af63b524395e0f

SHA512
a882df722545d00e5570efb711bcb40eec572c0031e33945d158d1e3b711ba61765a40e687c4926806fee4493b5492f2fd8db2b02e1d3a0a44c1c6be14ef2059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[1].htm

Filesize
293B

MD5
20a7412fc74d0ec03a5f8570a3dfd091

SHA1
7b76fd8591a25b4c8eac3e7fe4ebf5ff7f9a1e03

SHA256
9e3186c61a0349b0123e44afb47995b7d36164fd24c114b725ca67732316c0fa

SHA512
2ed71aee810a5200a1a17d1e91a2c8a63891e37f5d4dd7d1176ba6147b48a98b46ba33c32e6946252d066b8a75d9ff93f1a0c346009c809857f8783df4d3657c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[1].xml

Filesize
623B

MD5
db5d347be73ae68b70af16268b32626b

SHA1
bb1cef4735050b4284a029f2bf462a6dd252e756

SHA256
f12be94e7bcf331dc4503ec212eb4278c7895add18c304e85b4f8e7520597f64

SHA512
75d91fb36a70f86f702bcf56c3de1169c5687230181839c7eda3554be6143307550e7c9d1ef92261789b324081a2884010228f47640d39c5915aeec39576f128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[2].xml

Filesize
618B

MD5
1e9176ad8b4c9b7455a9023bf91526f1

SHA1
5d0dd2ab13228009ef228abb3cd8543389f5873e

SHA256
565ce7d336f4e0e36ce94fb928b3edc7c9b503813a25402cd7494769291b5e04

SHA512
6fb17669c5895aee8081d1c1f82362e81db5f3d624b79a3a7f9c35983145775d106ec5087d432637fbbdd46cf392790af73020612962bf733c674d5f6e3d69c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[3].xml

Filesize
417B

MD5
9aa2112c34c73a7135c3f99fa289e550

SHA1
62a9c62b66f30ff9a941ef64579d6d9eb3bd044b

SHA256
38099cf8346368ce4102557151c3eb3fba00824293098bbad708a83b2a4090c2

SHA512
a2d0c6e9ad1bf669f10f05c3c898f93503a69dbc5ff048102f8e3a78c522a25ae3819379775de97e5249781e87b3cb02e6d355925115aa08842269313225d7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[5].xml

Filesize
216B

MD5
0f51a2acb6bcf8354e704c811dec18f3

SHA1
f0f14a9028041eebe9f15bd73b41326ac93f10c2

SHA256
76bf201b49b017e9356ebf533a19179650bd77c89500df99f909707f35595e59

SHA512
19534e37fffe33d5dc4a4b5e6fd3beb993ee1ca332b4ceaa8ea055b893ec3fc55f1847aba9a4273567170e56184ebaf22b8bf347151ec249656eb83b3fc35fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[6].xml

Filesize
359B

MD5
8154c0db0ff3e6afd316a9867ecafc5c

SHA1
c2a6a860cdf465c40d57de70b905c79fb98a4ae3

SHA256
d7dd9dd337cdd57aaa5697e11d80504db806ed73db0c416955cbb5687c32cf53

SHA512
6fac97497be4207dda7b35a942a19adb9d796b6ea2af449ecd24ba611b6556855f6652b3a8aa227571bb2e4dd3f2b8683002ab3e5ada52fe89d2bcb4dcd0aa67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[7].xml

Filesize
315B

MD5
d9d32db384d57c8fbe95a892de5eb09f

SHA1
58ab33488d17953900c9ba077f78c9a3bcdd5d34

SHA256
24859398135d5a0c340b24545e84da6d8ccee2853256407150b272a7699e790f

SHA512
e8155d8207be9f0b0ad38ba4cb75cf24d64f2332d32b3f0450ec6f60a32de6ab01b6e93b2c65d42e3f943669a7f3818a5af2822814d3973599ca2c0eedde3545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[8].xml

Filesize
252B

MD5
51ebc2ea75531c7f0dfbffc896e251b5

SHA1
0ff39e299e459beec0743afeec89c581a64dceb6

SHA256
2e9153edeb984cce5eb36bf9ded1a360aacaef513eed38a3e0725767b42987c6

SHA512
09c496a76e6f386c01c8b2b9238506bbbf012a17b50c49f68186965b14ffbc6bac6fcf554b6d672ec621931509aacbf8a9daee8e8945b2944da07f1d8cd1f7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0WE3L9MQ\qsml[9].xml

Filesize
260B

MD5
950858beabe058a9981c44cc13776e80

SHA1
0c08987a75aae7da946a59e071979efaf648dbdd

SHA256
e53f378876c49cbc81cdbf35f8d5a3f011d2851e6343bb9866684d8762588805

SHA512
44f72360c8a8132d1c5e8867aac2d49ee68a37beb88dd656d27d79757da0fc576f09e52d37b541feda0cda4cc5839bb1a539a938e31b042682466e9293129472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[10].xml

Filesize
293B

MD5
ffd5cb0efcc7b739a5c15a932e9c5b79

SHA1
54124165249e80ef018c51aa3fe0d8610ffe31cf

SHA256
1750c29308a1c898032ae5b2560084aadc1704136a9d194b30cbc92cf0e58557

SHA512
b1aae810ed5865abdb42a2e86e444a30db5dcb56b74b42436a2b71edb715d5e8ce97a659cc586febefa995ba53bb93a85955f834f1a392bed1c35d84717a6799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[1].xml

Filesize
462B

MD5
2a1323eb88e8b1245215bf8d5776b258

SHA1
ba3c2d4be054c494ff009f8b074268ebce07d8b8

SHA256
313470a4a4a02850b55541fae4dc4bd8dbc9187bc283da3aff110644ccb16fb3

SHA512
c6d3152d754070d49fdddb2670573d9437eef27536dc4e1c054925e4995295fbe370b0e4880b08355569feee0e8be255cc00b17d21dc8344f359bbcb89d6176d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[2].xml

Filesize
415B

MD5
f773282e1da395f21a419932f89bdecf

SHA1
2e8ffd6bc44991cfc5b55c82291504a05193f1f9

SHA256
32356f8bb8a8894627a3cbd25daf0620d98116c28849cb703d6caea2de9056d6

SHA512
b3b68f86aa68c0b29ac639762e8857f7b7f1db4a04be73dc97999755f17e187c2409a82f2ae0b816e237c2b609352c4ff232ec2beca1c8b6a03d417bd3df7151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[3].xml

Filesize
609B

MD5
e79e17923851f3a58194980ccbe8d1ee

SHA1
fe981c151d6b2f09f8f553e66463a10c8291d02e

SHA256
00eba88b40055ded016d0205abe227e3cfbd1da2de127dd78d1463b000a17bcf

SHA512
0eb155e23d6232461e15d18b9d30af5f5bb86c56b9363bbc713177cbfddd1de8b8f3330b4d78fcc12ed5e79e28aac475c1701b06ffb305883c6dc4c3a65757c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[4].xml

Filesize
644B

MD5
f1abba2ab1a240cf9a4254aea113bb0e

SHA1
3a0151f548322ed071812e7836b2740f5da3a2c0

SHA256
d868422accda07a9ef8cc9b1de99204a2753f2401f85e87bd923be3b927cd028

SHA512
d84f5823c8104756670739199e71396c319ba9a966ca043de0dfbe5926eda292873f2ac7a6a867753518f09549e10ebb129026d6c07e4f2c33e57a8d3bea1754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[5].xml

Filesize
242B

MD5
022ffad8328bac73b9b6fa7d0400f594

SHA1
923570c4e3bf411cbaa0f2c55c3bc7498dce3963

SHA256
8e7fdfabc934e05d1795ed7445464cfbc9348784ede3c9eb92a79ba06ea036b4

SHA512
75ccc68252e1f04ed26aa0a5b4f0608018d7d8bf04836f8e3db1fe95e0f5ccd32878b4a30f1951c40b751797e53e8f4a25fa50ed8bcf0c05b47d37807d5d2bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[6].xml

Filesize
246B

MD5
2ea9cb1f081aec0e188bb2b033988f9f

SHA1
99515607b4f345668c72f0622d18dee7284749db

SHA256
d5d0dc2305331b6b9c2fa90690d61e756158e8ea4dd1b66103143a001b810c7d

SHA512
63aaaab2606ed17377d1e881d8f96265ec776c24c89935ccde1b53187c4658e98dbf187a62fa8496e69f63d2afd0edd4cb3df18c8ee66e3692294fcd06fc00a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[7].xml

Filesize
271B

MD5
198c65e6ee23a2338ba4a34bab40d4f6

SHA1
4f1b725a3a9abdbea2b220eb271338d40d9cf7ae

SHA256
796f178702c4b05c8ebc97aa4d35d72bc4b2b602be417b3d28bf46458e5e6c6b

SHA512
1d9768947900b3812ff800e10e002adccfa8bcf9800ffe10683d5da5ebe9155dd37d27ed3032eb0fd36592dbb437bd15d34268d0bd4977f3d1c381806d1bee77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[8].xml

Filesize
484B

MD5
e2c3a65ff9d3c499af5f25569245b026

SHA1
c5dbf65b94468b01a59cfd72efdaab5db384e5c7

SHA256
a815cc279c9c5e836d0fc64a5970befe67d56147eaca63a9c750eab7e0ff12ea

SHA512
9f0a3e672f770c39e01db59738360c986531945d9da6aada63dc5549a5e9dffdae04e8c8b06cedabfd60dc24acf3b71e0c52603c280ef950183506d6f37e3de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BZTAHXJM\qsml[9].xml

Filesize
225B

MD5
8c333aec8293f2e6e6cbbca579d1639f

SHA1
d188504a3ae99217c1d78f0e9439338a7594bf5c

SHA256
fc5942f929e56e0aacca15320a3f53b081d9e411535363e7e29abb25767a5ff7

SHA512
7ac3fe8ed479e0bb53a39e5c58ac8a9494b8e892b502b27c4eed4bc37fd8505fd8ca2fd82035a6075293dea94d1e310bad7ad26ffd7e1156420f95c33efb8ba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml21XCZ6IF.xml

Filesize
229B

MD5
5a22c05393f311027b6af728134c8107

SHA1
b07c55f67f30a7d251518ae900e7a7a2644eb94d

SHA256
c420739161fa2f39d136fe18d0d31d35b6eb2d1862ab8823c305e7b3e66a5775

SHA512
55213bf9293ea90219b08b6697bcd2500bbb8641b179e8b42ca451757a13f2741e3830fbc1dbe476588225140bd9dc14bb74d4cf068fd6bd4b31fef74f4edd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml44Q76450.xml

Filesize
208B

MD5
ce439e89e9986066fd06b8b3ecc8812a

SHA1
c1a74bde7b47378054cfaf7586b09cfb39badb2b

SHA256
37f5e9f2e8299a769ab36be06c65680993f757cbecb1a54026ab91b686342dbf

SHA512
b3b7d57fc0714c9e4308826ff9068eb493a5ef7da7804748654217cb9c3dccb4d5acf2c5637a12aec8c5d85c0ed0a22f9ed7039f3699dda6dd086350f5670677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsmlQ82Q990Z.xml

Filesize
220B

MD5
babdd5a45a719f6d535a6054fef0f87b

SHA1
75242ead842bedd46635494553ababf03514d0fb

SHA256
7a1e85dd1a463c7864bee282e6629497828448f283186f737393ae8b9eddab18

SHA512
e5377f1345e8a70a7bde7d8d4fa502249c9b9c78e18ea457ff1e1a4d0f25fac1e057b14bc788a5a2f6b970281fbd35e8d0c9d3ef6bd25bb8dc1ab90bdf25471f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsmlRH018MRG.xml

Filesize
212B

MD5
3b32e85c9f64f17e1073b2fabb01ff6f

SHA1
b4771634ca6332384bdadc3ad5b1dd5a9252e2c7

SHA256
76fb55a44fa81dfca8bba446efafe47daaddd3227e2dddf658ea17bb215176c1

SHA512
8f36d39847a465ad2334b28a6ab23d425d9d032ac4f93ec66034b15c624ff727c72d15b0c3864ca3f060be53780dd982375b2c4a6a4db6121981b5f954d6934c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[1].xml

Filesize
624B

MD5
6f03b148e2e387c9be6d4a9a67100ccf

SHA1
dcfb5b5abd7677fe9477d2bee713a5ce9d77e97b

SHA256
685c1d3afa469ff1800773ca2833897e4bbf2c6368c0f53b3942b52f5a526619

SHA512
1f52d663c49a292c17e68c73f53a6c0fefe11d01fa3d242ab015497ff95ee40985c965f07fca5ac9e9ccf257b91a16d1ca2a65412b4c0a0d6d6e75a133d928d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[2].xml

Filesize
621B

MD5
4820cef3e97c533373db0fd0379fd9a2

SHA1
11efe39e64a15a8811242034615e98cb8b60a829

SHA256
e01da5df57d4fb725071e8d1f78fa4b265bda6a232498eafdab57b44d688b873

SHA512
11ceeed575cc46cbc8bbf1b1fcd0ed1362abe932d6f1d9781fa293cb80e5296e359d26879044496bcca0e0de0017643344ac91d8ac82d81207dc87753079fae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[3].xml

Filesize
666B

MD5
f793e29a51735e779e875ce8df294b30

SHA1
2ddd338d34fdacb86190a19156525314f00beb4b

SHA256
2666351c1ec04ad89bcce2c55ebe829c48d934fd0e7fc777321e71d21152703f

SHA512
c6d4df893e39f8d7ae3a4e5161ae4d1a3f74c3af67fd0a849a54d419ced87f9acb6bf066a045e4b323ca4523a6fcab3db7279bd69124f15a157db58122a09497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[4].xml

Filesize
606B

MD5
b1a1632d6776523c76991294b49c7e5c

SHA1
eaec53a9a374eb6a79bc3c23b241f3287b7df6a4

SHA256
15b051f2011c3ee0fccc16c5390409407d61385604e4629f009b352f63d9b688

SHA512
17223365e4f584b77e6c2b42b4cb161140f3b36505c596c7a20b57e2b0a02389fb6a50205495a84d19963e3324fa8dcd80ba953e84757e0cce46a373eabd0178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[5].xml

Filesize
326B

MD5
5a1d18f8da945af7d7732ef3a9121164

SHA1
c218de57fb891041334cbf6cab92fb43a423ece5

SHA256
94d2a64ff33ed28d8b4712909a5470ce363a1a2556c14f5207789cb24278367b

SHA512
870209685a979712af2f7cd058224661c6a835be19d4a9f7c9c9d018d59dc12f00fc8ef43cb157008d45d7849d79d03ab05746ea157ea7ef634c4a218af0d9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[6].xml

Filesize
257B

MD5
da99a754819580077a1605e9093bbeb2

SHA1
5f16e5b671cd2ecc21cb4e332da06e9e46a49485

SHA256
026f1384de63debd130548520d14e2571f9e9e888c1346f0aee151d701160fe5

SHA512
b945bddec059576c65fd19c7879a4e4ea9d3635fcbf35cfe0d50e10d35cf411fe14388fa148425f902619d19572f03eb76400d26897b04ae3865cd0daa2f13b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[7].xml

Filesize
275B

MD5
8bfcba4b5c82ded374d5a5f953459357

SHA1
b00d7695045dbb750c33f65bce56f683b69a14fc

SHA256
65f03b46b07bf4e04f1ae285d3bb2fdc1e3fabb66153de507ac25501368cb729

SHA512
3c117e8711c6bea7d63939ff32e9e623df7eba7d7095cf2f4e0eee98425ec0c2b7cd1e952621a08aaf01010bbae93fc298379a1f28b0663354e0e161cd207a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\qsml[8].xml

Filesize
284B

MD5
eeec3da900e511edc7b3357af75dcb39

SHA1
6c890d1d103e4920b22bac49c3a0441341a67abd

SHA256
f761ccd4b9fc33f7dc71312c4a0d8bf68ae31ac772bc0e76317d46ff45d4772e

SHA512
3ed288e1a758ab7b040364feca6389ac3bde3a958f0849fd2cff2087b2a691a681562ec09ad411fdfa5391fccb0c6fb7cd1ffcaf48dcff551c9dc61edb515527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DTHACEYH\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml1C52USIT.xml

Filesize
242B

MD5
4f9ebc46556a11550eae0cb0bdc0db63

SHA1
1b50118ae80aa561396eac85f51312ab47b053f2

SHA256
c90f3069662012123dda728f9d250f053f3e5cf41518fe69c8a64587790140b8

SHA512
3fdc954d1a06c539891de9b6de21c47bda7df59fd97c1779151041c200ba5764d8d3a5d39a269b8be99c2980ee01c88c60e0cb44da1dcc77aadd9481de940876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml519TM9QF.xml

Filesize
210B

MD5
ee41295155b1e3842841f7ad3a771150

SHA1
68bee80aecbde748d243e6382b66314f8b5e955b

SHA256
87ceec827b54647252fdddcc51a13025f8f991ff21a0094bad9fc38af76a86f0

SHA512
65ecc0326cefc7e6d295f7a0716f19e21d3eabe492d8ea43638f2fcd29161590a29325456a6e85138dedaff399aab6c2fbe82aaa4eefa613d9dd019768161db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsmlFSPLMNIR.xml

Filesize
222B

MD5
26e2cf852473bd1d28523658ce18fdf8

SHA1
11ffd2cc29e43e6ce539b3daea9503b3fcdef5ae

SHA256
2a9795fbe8d173c6326b84752592d7681fdc08760b6de8993d403d04193f6e3c

SHA512
b44be600221639852eb259a54eb7a8070a859c2536d44b17bf28b93031cb40a20cae19a3e555eebe648b197d83d57d37f17f0527351d4a657267cb4ff524e245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsmlFXU24W8N.xml

Filesize
251B

MD5
98c18ed6b32738dfd6ac9e3ce676b7d3

SHA1
c461313a24432b22a53c9efd0d38455b23d96fd4

SHA256
0c6767bb51325b4fceb7a9f27a50a3c9285ddad1ffb12f69d92291e65994c525

SHA512
1edcd190e0365f64d5446bee2912c27501992fff31eee44640d419ff9c5cf803cdc97041fb1a181b7e6be516365a18b76e9c838ffa6a03148ced4855b7ba167f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsmlIB90F14W.xml

Filesize
280B

MD5
3b92ebf22540819905e6876656334e02

SHA1
1684db873bd709663de2e5ccea09e08cb9f4fb10

SHA256
2a578e726bba70f78e09c6cfa099d5e1d19620db5391af9b9014263271cc9315

SHA512
44fd362195bc6dfdb47e4bdfa48b5fa6fa69c0b9b1c7c8828a80e5c705d3fc5b2be47f5d583850c5409b02366f6212430201d9cf74e2dd675e813850b08fcbfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsmlJ8WKTWFJ.xml

Filesize
257B

MD5
bd5061f800989826e830538c18060292

SHA1
5977811b5cc6a8389cdd7eaa103d99bad834fb85

SHA256
f7dfebb4ec5b769092c92fc9bac50ffe339486dcc40c61682018b45066197946

SHA512
923ca3174b1b1991da2457b0a1e33fef00343343e919d1041654e5b5e53c5883597dc03938f77ceb6e84155b287b2e22702892499bebcce77b5b5c0a97c8fbd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsmlJV6RM788.xml

Filesize
218B

MD5
a9fd1b1831feacd3052e0543213919eb

SHA1
08f32bfd8fbada627fbd00f611386bda71ec9c30

SHA256
cf56c903233f56300a0ef658cb32fd1ac4b4f7e4d4c1317efb55d7bc4bf322c8

SHA512
d7a278748e6836adddc845ca096f5e254fc9b07f1c16bc8dc5df7282f319886cb2f850610d47d5c0600144b4541765c0227c553584c82c6d18c4a0574f6b9fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsmlKPLVLT4X.xml

Filesize
230B

MD5
a7a03fa8fe1a929f9b2b377581e2fae9

SHA1
6bcc225b06342c1df15317ef87add81c0f606eec

SHA256
57669b0ebdac672f7bc3918990f6d7bdade032cea6445be132b0167ba9bedc80

SHA512
de6091f9b9fe4ac1064d2463092b5dcfbfb56fba37ae9256bef198db02bc62b0f4b61bc75a52f873a3b5a7821d52da1a9dd86b0e795525da76943ff8b0784e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsmlKXPOE68J.xml

Filesize
238B

MD5
853f852a71239fd4f3c1bcbf3937e371

SHA1
e77b0014a71d894600fcf8d60c22fc9f7a551c70

SHA256
4e3c26c06edeae9153dd2ea307bc0256ee55c729f8ba837be707eef642dc2986

SHA512
08a4a1e7bd55f9aae093aacc0a7f6c1eef80885334945e02e9a4ffac67c1df971cc73bf864bbccb77b61a9cd4a4427d01095b8ddeaca6d8a4317c3b21162b47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml[10].xml

Filesize
272B

MD5
db6de1e9359e441544b5aba1ea30b306

SHA1
86bdc59411f1e2394a231e349117611aab63265f

SHA256
8d9d5e8b8f4f03b8ca7f6eee61a8b93bbb098a2018f1186f601578f174e60e35

SHA512
fe5052fce6190464c041349a527927e31494600d3d922004c510184313ca59914c4c1d5b351157c7cfcb63879297667b317b6c9cf97b91f0a1b72f80280c11b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml[1].xml

Filesize
605B

MD5
1109d0585a5e43a26ce9515558fe0665

SHA1
d91b779710c95cf98fb912822e5ac2b323305c53

SHA256
eaeeeb61571bbfd3437cc2adfbad6a76ce66c179789b8c1a10b2b0e16fcc87ae

SHA512
9ac75fbcbe371c0ff3a8099376d13c3b35c569d2bbb69814d10c8921132366e0ee8d6833e6cac771c0cac7d3aeef573b3493accc2a82f181ef7424b9f286f462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml[2].xml

Filesize
416B

MD5
18a9bba9ad9afcc9a0e427308350a314

SHA1
42dae5a791d5d3bbf8ab80c00a74968208aa7d7e

SHA256
b25f6ef3aad47e202038f879a29e57bed80b2e656fdd0160b8e9306ddb582a30

SHA512
0914fd3518f377a054c4804c95e2a51fe8e36af6cdc530b1727b9a2da7fe4da599d695f2742d5b61b1af83b3e20ad20301573ccac5568e92b3db9affe2b69c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml[4].xml

Filesize
621B

MD5
e0fd8bc14e58c6e48effbb72fa0891cc

SHA1
ea5d1055521b296257fff11e3bc27f71aa874135

SHA256
8aa9e91fe6e0503e76ec615b9e85fc96de66c45b44dee1a202099b25e55e8d23

SHA512
c5bdbb897afa44921bb8b8d333638b9f8681dcddac4b2b73408ab2a4a409691a834587362ee4a0a5a68af111af196653ce510b0ad48ffceed8928dfff481c080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml[6].xml

Filesize
314B

MD5
c9229f568b296e2819246da640f95573

SHA1
a9ea7305df28753d6b0a4eeae601f29846b32445

SHA256
c3c96f89180ebdd51cdf89964312fc4d8b86ff320d9fa55a3d2d8a877716497a

SHA512
57c37f8983c38dce7443b2e3700fa8af51ea3a1d6f976d2678997d8c0173a19d8edbd3a4ac205f2fcdc3e320f97e06b63ba89f70137f8b0dadcf89e1927b2213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml[8].xml

Filesize
243B

MD5
7817d1441fab2dd5ade086462944ff8d

SHA1
08a059c5d3e26f3df0b3a0468a1752d3e9615935

SHA256
8441de548de0081cc58c728ebafde437876943ffe63b6c9bade46d85e7334949

SHA512
3ebd717f34a1d3d7479688a59be92a5fc6d0494b9a4cd3e75cc6cd712dae456cbfb3b8d31cec85e47d18072b0b81a6a8105e24f4fcc3501bcbb93514ae6a2c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OH5K9YH7\qsml[9].xml

Filesize
255B

MD5
25d91cf293e788e4d12a706589b650fc

SHA1
cddc0c5ee8f5c57c57ee3e923e5732433c54bb36

SHA256
a613a89724936367e04b6d9e1858e791f251d0d47b20762cbca682daee152b28

SHA512
da691b2bb20ccee7ab1a77e382b4f6925b0fbba7e362a625c421d3f3315dca0fce9d5a22e0ea9659a13e9e2dc32aae862b16f3dd2a9b9e1818968498af385036

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
2.2MB

MD5
42bebbc9ea503be1c3c78ac680e660bd

SHA1
ba7e6e6bdd1ff3fdbd66a6c25a180eaca08cb774

SHA256
d3a100c67a0ab27b0628df13e53b36999059981ffec20422b61a2801fc1f020a

SHA512
acf711b01b8fa27e487d6009644a7640197b44ff5efe6161670b4109b03c629c466c9411e56a51280b100494fd228123738320199cfe9763737dd98fadd13a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HMVflaFJT2.bat

Filesize
172B

MD5
d9f475871917c64f1c76acfd86b62125

SHA1
d2f65b48bc9dab6bae36284bf4432767190e84c8

SHA256
03070ebce3bea38b7eea9692d5ec127074b436427046b7ffcc364516cbb1c815

SHA512
12f15e1c6b8b36ac2c059ac81ab0f81083a29150991d5d606853496a24f98e8ec2ff9115aebed482cc385609008ac3a779796c1927e209e561b6576ad1e83b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zorara.exe

Filesize
803KB

MD5
e63395b9021c27266554fff6b4ed8fab

SHA1
340e1bf4ebabcfda652882fa3789c5d4ab197bc9

SHA256
ff6ca0a62dd38a42391334d1e813b3c5ae223ca580c212d95ba6b80f30a0fac7

SHA512
aaa1f2b379644c619bb4619071e3102ddc23f6b5d810f922c5d159dae5da447785d9e178077b5cd79f9d8823bd49843587e0a8848d2149bb594b276e825784df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
459d42e6cfc1dd9e4f600f5d5ad1eb3e

SHA1
e21dbf5e50330a54fd6698d0261ad29466e244fc

SHA256
f5561356fac09878a2d64e975bc13d78cd1324a33296487ba3f94ab6620825e2

SHA512
43498b6d112bc8a54fa2dbb8d764c32577cc207fb90b19a10a65c07916f10be0886300884892f5e2851e14dbf0646d46b910a257830702204efc4a6c5a2c955b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a460ff50f4e825d7ef87d6aa964b5df2

SHA1
268bc04e17a75bb89a48bcda0b3518248f374e3b

SHA256
10ec923167d36176badf856fc1e955f6bfd0c50935f26cd56539e2dc11287c68

SHA512
816b5e50db0290341d0e5d8f2936efae6d486115d140703f78f433d11ef407039c127e275818d83c5ceb0991169a0fbb7927dd0ce1292161d3ffd7d4a043ce5c

Download Submit
C:\Users\Admin\Downloads\Zorara1 (1).rar

Filesize
41.3MB

MD5
af89a85f132307e4ddd7bd8eaa6fb87c

SHA1
8b3281a638815b2c44d0a18d7be3fe00cabfb8f0

SHA256
f6492f9d1ebc3ba11f458bf33c71f8c288e357abaeb0d4898c4359b2b152facb

SHA512
9437f25d5d47f5f7b9eb13a47d71029f5acc24c4140d0eaf1aa150e915467b42f41f16a6ec157b9f594b5529eb5dfd8beb668acb924c4de64a99c10bdb5a68f3

Download Submit
C:\Users\Admin\Downloads\Zorara1 (1)\Zorara\Zoraraclear.exe

Filesize
3.0MB

MD5
2bbcb2eb310ae73cd05c024afee324fb

SHA1
4d477371119a135e2c9e65ada34547afe65347a5

SHA256
628e668b234ae912b337b5ed8a9edb0baf44c6f2f0a297c1e6fc354262a37bad

SHA512
704a49e72fe03db76ec71e68b8309d3ad2c1c5e4b2042c68dbb383dc5502ebc5e96eb12b83c79cdcfbf1a8ebb04ffb11670628a1cb0bb49ebc617044ca5679be

Download Submit
C:\Users\Admin\Downloads\Zorara1 (1)\Zorara\workspace\.tests\isfile.txt

Filesize
7B

MD5
260ca9dd8a4577fc00b7bd5810298076

SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6

SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

Download Submit
memory/2088-604-0x0000000002BE0000-0x0000000002BEC000-memory.dmp

Filesize
48KB

Download
memory/2088-593-0x00000000008E0000-0x0000000000AD0000-memory.dmp

Filesize
1.9MB

Download
memory/2088-595-0x0000000002B90000-0x0000000002B9E000-memory.dmp

Filesize
56KB

Download
memory/2088-597-0x000000001B6E0000-0x000000001B6FC000-memory.dmp

Filesize
112KB

Download
memory/2088-598-0x000000001BAD0000-0x000000001BB20000-memory.dmp

Filesize
320KB

Download
memory/2088-600-0x000000001B700000-0x000000001B718000-memory.dmp

Filesize
96KB

Download
memory/2088-602-0x000000001B730000-0x000000001B748000-memory.dmp

Filesize
96KB

Download
memory/5512-838-0x000000001C980000-0x000000001C98E000-memory.dmp

Filesize
56KB

Download
memory/5512-627-0x000000001CAD0000-0x000000001CBE4000-memory.dmp

Filesize
1.1MB

Download
memory/5512-630-0x000000001CF50000-0x000000001CFAA000-memory.dmp

Filesize
360KB

Download
memory/5716-574-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/5964-575-0x0000025DA18A0000-0x0000025DA19F2000-memory.dmp

Filesize
1.3MB

Download
memory/5964-586-0x0000025DA1D80000-0x0000025DA1D81000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads