hxxps://lootdest[.]org/s?ce9e37b3

Analysis

max time kernel
260s
max time network
256s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
17/12/2024, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lootdest.org/s?ce9e37b3
Sample241217-sp6adaslav

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: detect-gpu@latest
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: lottie-player@latest
phishing

Executes dropped EXE 4 IoCs

pid	Process
4328	Zorara.exe
4188	Zorara.exe
3500	Zorara.exe
5628	Zorara.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4328	Zorara.exe
4188	Zorara.exe
3500	Zorara.exe
5628	Zorara.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e5411170-f45e-49e0-8252-c7d079e99e09.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241217152020.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
1760	msedge.exe
1760	msedge.exe
4852	identity_helper.exe
4852	identity_helper.exe
3916	msedge.exe
3916	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: 33	5724	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5724	AUDIODG.EXE
Token: SeRestorePrivilege	924	7zG.exe
Token: 35	924	7zG.exe
Token: SeSecurityPrivilege	924	7zG.exe
Token: SeSecurityPrivilege	924	7zG.exe
Token: SeDebugPrivilege	2200	taskmgr.exe
Token: SeSystemProfilePrivilege	2200	taskmgr.exe
Token: SeCreateGlobalPrivilege	2200	taskmgr.exe
Token: 33	2200	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2200	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
924	7zG.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	OpenWith.exe
2880	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4100	1760	msedge.exe	82
PID 1760 wrote to memory of 4100	1760	msedge.exe	82
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 3992	1760	msedge.exe	83
PID 1760 wrote to memory of 4176	1760	msedge.exe	84
PID 1760 wrote to memory of 4176	1760	msedge.exe	84
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85
PID 1760 wrote to memory of 5416	1760	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://lootdest.org/s?ce9e37b3
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffe26c446f8,0x7ffe26c44708,0x7ffe26c44718
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=900 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff73a095460,0x7ff73a095470,0x7ff73a095480
    3⤵
    PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5828

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Zorara\" -spe -an -ai#7zMap29684:74:7zEvent30385
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:924

C:\Users\Admin\Downloads\Zorara\Zorara.exe
"C:\Users\Admin\Downloads\Zorara\Zorara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4328

C:\Users\Admin\Downloads\Zorara\Zorara.exe
"C:\Users\Admin\Downloads\Zorara\Zorara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4188

C:\Users\Admin\Downloads\Zorara\Zorara.exe
"C:\Users\Admin\Downloads\Zorara\Zorara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3500

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2200

C:\Users\Admin\Downloads\Zorara\Zorara.exe
"C:\Users\Admin\Downloads\Zorara\Zorara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2296

C:\Users\Admin\Downloads\Zorara\Zorara.exe
"C:\Users\Admin\Downloads\Zorara\Zorara.exe"
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Zorara.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Zorara.exe.log
Size 226B
SHA256 1ac8854abd01c202cf82e4ccdf80bf50319c59bc7a02dce2b19cecfedf7dd4ba
MD5 b92bd19c1a9416298a873dfa43b439b7
SHA1 7b96a8874aff3a502363f4168332613ebc53d64e
SHA512 5910691ebdd78a2740117b14f146629874682d196f518f479b8bcb754ed2501a009fc465cb9e3685f7aed8ced7b435690de2b8b8439117abb5f61dc4996387a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 685aee2efe60adca559de33807715ef5306c5ccb8857070155eae3d7ab397e3a
MD5 6547c6e6bdac94ad11ab8e5311c7e265
SHA1 cc3401985b79ed678f8b94b0500766691044ee7f
SHA512 d685ddcb513af37ea57e0255d9f5387266f882015b9cfca8f100931dc1629e54d1150679e4562717180447887ef7094539df668707dfbdbd3ef9b4920de7dcb6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 68ce145d21b89f38464ed7486c74dd55a7e28e5ba25bb640cf4059b1bafdafd9
MD5 0526f2b37744871ef85ad98e2a03cd78
SHA1 7e8475de7f5614e30b67793a41d35ff492aff7cc
SHA512 12ae36f493802621601887cdc25e3d7191bfa94f0e784f11f18bff4bdf407efee195aceca19fe151718e9e7498a4faf0ff885e38cbc8e1e7a5d5d81f400b1ef0
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 49KB
SHA256 d55229e346c22979df1e6e2b8914706914b2febc529c153194a7589d2f0f5e71
MD5 b1c446910fa238b9b83c80192998fff6
SHA1 07b03f9c2dd1333b17c1193b6220b4e6b77115f9
SHA512 29a024aa14e14fdcb2e219bc7b3168f9c0336e521f9b19a96b2a1f8f405bfd0612823da5a5907994ab05ea258a84f91cd095514ad640040f3d40c2c652b098f2
SSDEEP 1536:GefFlXoeE2z1FkEJqsUcagaQugEt6tDyG:VseJ1CEUEag1uVsDyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 758f5d6bf47bfc4cfee0e24152b14fcd11e318f1034d7abfad4b684a762c713b
MD5 52d025170495fd805bbeade73dcfde29
SHA1 182440aa2c59219f83edfbcbe0d0b45a9bba75ef
SHA512 3f0e8abc52bbef8a70a96991ecce2d8fd3f2d131b8e40d12d3926b63bf5ec7ba834253b65f55c75f6e7d2014d6d90e914e15a00731d9d95825913066d6e162ac
MD5 SHA1 SHA512

Submit Download

the-real-index~RF43fd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RF43fd4.TMP
Size 48B
SHA256 d5ca3707743637dad72a5c47f703ecc661a58edc6fc33de71bfa4f25b628f95c
MD5 cf311e236f24c1ef2830d1dd208e712d
SHA1 dc8fe90cde5c830e551ff77d08118da587f8998c
SHA512 d97a1aa0d67ae32810e4c37085e74db94d40a8302d331fb9b08e7954b58a963e613616a2373a44e33b7cbfe385c29be8cfb5c925c7d7280a63ebe70ba1f09f4f
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 2cfff641c3e4638490bea185afc32966b736195c825909ad76caf8e27110334d
MD5 1941a6826828195b05cceff685fc70f4
SHA1 50c43a72a9c56b895c6446a760fd32d4629f74fe
SHA512 1e1a166224b36bae00a0c6c920577db45334ed77884d1e22fb77e3c447f7d87f3cb890f3b294e04707164337acb67d8f2808686d1038552133c28f8b83ff1cfd
SSDEEP 96:y6iR4I1N3nNabkOH8B6rT+GXGULEDGGxG8GFGAGHGCG6GdTGdMiGmMML:y6iR4I1tnNekOH8B6rT+ErQSG9WJ6H/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 dbf3a242233620705a19534692204ceb493680d8fd62f525145cb8bfd0685613
MD5 0a66685f89b2ae3558ddf576eec2c0ad
SHA1 8b641f03372c976794f6e4b1ebef47ca3d0b94c2
SHA512 7ffdf8d298fd23710b8bf756d3595660277fa46638542e3fb07ff6366f3ad0eab9404bacbb2092423f1559ec11ed8095076d924bda6fe0bb335765be6375de2c
SSDEEP 96:y6iR4I1N3nNabkOH8B6rT+GXGULEDGGxG8GFGAGHGCGnGmMH63GdRGhGG7L:y6iR4I1tnNekOH8B6rT+ErQSG9WJ6HS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State~RF4d8d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RF4d8d8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6f62c9973bcda911034ef64bf5f442f77911b9212f587aa28163593d54db9a3a
MD5 4024ed3cf203b8a2ab4c9ef5aa5985c1
SHA1 a4a906fe9932729e093d61eee0490fbd82b00c31
SHA512 5c81d028eb4cd83de21e187fee68c83d7d9c008014e6fd2942148f7c1eef142369dc36f19a6d386e442fa61b37cba9f6a7ecf423de06853d9dfcaa8632ec69cf
SSDEEP 96:netYgm/jQYmqJM1s+wpvWMoiVmdeHGnUWQyV+VDCAia:neSogM6+GWMXYre
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 83913f73f00d96b047713d6969c5833dcf2c15eefb0a61b978061183de10a30b
MD5 7e2b51637b45e274d9fd59535e564d4c
SHA1 2ecd48390ee589e1d7161c1a5ac3fa3c3d6bc3a6
SHA512 fd14e468a03f939ba5677a9e7a391bb75e0c7d79c801dc1603b5a55b2439d51c801e0a303f2f92b9e4724c0937bb593393889ad5961e6c5a3683d84531430a15
SSDEEP 96:n4DsQSYgm/jTmqJM1s+wpvWMoiCIR5mdeLNwiSjfvExIErBQESR02GVUWQyV+VDp:n4J2gM6+GWMXVNwFDMxIErBQEu02Yrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4ef061e03897aea1813476204c688b2c1a64c30f597987be5f880c19e8a4ac19
MD5 769830238cb4597dc058f526d02f8950
SHA1 cb209c6ef844b2f77e8a4cd63abad1c18b230ea4
SHA512 f8043032666503dbc77214a8525d689699f3dfbac711884c9a6de142b4e09b0dae714c7e46d90891351cf11961e19405d356765935f0861d135c78839753b38e
SSDEEP 96:n4tYgm/jTmqJM1s+wpvWMoiCIR5mdeLFuG11vExIErBQESR02GnUWQyV+VDCAiEc:n4S2gM6+GWMXVFuGLMxIErBQEu02irV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fa67a6804e337466e0e877d2adf0ac4f61a2af6abeed8b31261c58e043ade915
MD5 ca68ff2fcc5acd3b5dfa112808fb9973
SHA1 b15ba137a4dda2dc5917e33e01130831fe9ef803
SHA512 be851093b687305e8cd7f07a2118d17c4cc7d2e046169cdc37a1f2a12a1076aee4162c334162a262c5e37269e500a0573c618b786a19d37fd8e489b85bc98d87
SSDEEP 96:n4tYgm/j9mqJM1s+wpvWMoiVmdeLFuG11vExErBQESR02GnUWQyV+VDCAiEwb:n4SMgM6+GWMbFuGLMxErBQEu02irV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 ed80fc26e71dc195ccf0e92873cd3f2d559c83a0acf763829e39d0b2921028a0
MD5 54d8d5d412f3513b3c0f5d4f86a4874c
SHA1 bd77a00fb917760fc161fe3a4d87d67182225c77
SHA512 8bff2beee1faaa562c6b332a0cbbd633ac52c6d60fda2e6ea81a888d3c6a85cb7e6f8ca5a111e61a6abbe20e5673ced2eb0295166bbc222b7cc29458515dbeff
SSDEEP 768:XoW5t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLl54rUqy1L:XoW5tu1jauLrqC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 88831be300e64e2d65654f5667385f50a7c05925655a06ccb8252a161455e28f
MD5 53aa92384f8dd229643647a024db8d61
SHA1 4c1434d5ad4cb0ae4b8bad2ee31f82ba67581992
SHA512 cf23d5eeade7ea6d240cb1b8e30adc2b4f0e1cf0359c802715caecc9855251b2a8affcc7cd0c7d57339164fd8af5dde4447f244a4be3c14d5d4f95990bf879fc
SSDEEP 768:n/oW5t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLl54rUi0yh:n/oW5tu1jauLrHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 c52c2ce4f29b3da58005d3d44e8f2bddec9659e0a1084b484020c63dbc7572c9
MD5 25e1136dd2c7d228f283563b674d64ad
SHA1 e2a8bdf31ce3762d853266f6cc614001f2ee0fa9
SHA512 55a0589bbec1e804fe6fa0283b3d1f730c6756735cbf021cfd50aa53a67ec5f486cd379e4d704be07a1c1c3e76cecb19f2f9108abb3b6df34358f82db99eae8f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 89fff7d3fd7e049666d03572131485f7f7827e26b43aa91f6ec6b8d7d76d7b96
MD5 d48ee60141979384b3ce0113fcbd6a77
SHA1 78d2ffea2e5d0513bbb60c4089f474b15eaf559c
SHA512 4161208813410b681790918e1ff85b1d0aa6aea4fcdb401b81ad2ae28bf6b3f9d751d8482cc958c7cfa1dc203a1b91e263f977207888a8ad6fd9dbdab41395c0
MD5 SHA1 SHA512

Submit Download

index.txt~RF3e4f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RF3e4f2.TMP
Size 89B
SHA256 c66b94115ba92840f90fefbf1663b6111bc6636c62cf7f8b43498177c4b2bf16
MD5 fbf20ed944f6d233ddcda4e12020ec9f
SHA1 f127e118e177d4507f7fcb36c31dd7b676d7a516
SHA512 15771617099cc9c8d374587e17c7c56d992dd6eac5c96cd567f38884409ee18da8fa5733e45a124f91faf65c80cea384fef0e008f8726ce0102c44104ac782a0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 237aa07276eb6ce303525eacdde21a4fb3d8ed30354a7f1d0ed39765bde0336e
MD5 f8c1786a74ee93316fcae027306536bb
SHA1 c5d43ffb5cd6ac022e490a9bdce4c8066df4803c
SHA512 823e33acb1f339fa519d266bc4679f70076ce4c3a6ba4aa3acf1b0985274990825aa99649425db954bf896d40ff98c6de960b4a44a5cf7be25be561b205c801f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 50578cc8a170816a82579566b36c5ff193726fb001ab82f25ced191c26cefe67
MD5 58a9912b3049d11458dca8295c7808fd
SHA1 a0bea6eea162eed577567dc763a31e1b8145f68f
SHA512 fadcada033f41fb33d98f27755e384b52792ebaa0e65bd4190ba162a45e19a35ec7e45b9c654aacbff69654030f4cdacef179334878721103f7af9ddde0f9b67
MD5 SHA1 SHA512

Submit Download

the-real-index~RF435c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF435c2.TMP
Size 48B
SHA256 3a13361a925b95e047fa9d09b965e4339d078c4596161762efd85bf9df7ac929
MD5 d863ac0b8452b7c570485aeb6a34139b
SHA1 7a3a0cae0dc05ecd5ff8f3c0ca65a8f42bf5442f
SHA512 10f1795fd0b3363a9a9f2aa1e2434804bd230ec242cec946b7f53cc13ea7de8340cd5e093dcd37e62b166a4f5c9334bbc794cd876905534f2933b95236cd783d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6143cc481965293b96d2188111c6e73b5219e1dfba1464825c97e87db42982c4
MD5 c3093b0f6155cd57d676bdfd4ee4c2ca
SHA1 e822ffa4e8fec6d19ec664047c273f070d25e394
SHA512 c5b86f9bc2370d8f2cb77ee7ec420c3b151816b56cc6928282c165592c1032cbd7131d6618fe12366029092c1e71ecff5740551c9b199677e333fd7da9fa5a37
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RF4d955.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RF4d955.TMP
Size 873B
SHA256 220c4ca7e247472532287e9caced9b387a44241af255a321c5a2c2b2a0acc948
MD5 d19a9a14790e9ae2c6d17d2baa119bb4
SHA1 5a5a642cd629e6c4867f6d6150f616d3d2c177c5
SHA512 ff6a955f105640c5725f07ec4c8b61fb49d519f5361a29222a59602c518d2db53c60a088789ceb2f53093170f0002bfa01886a65b4bb2bfcb6329252c135e572
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea33bb6a88800f7b457bc563ddd0700f14c49011ed7e89bff791ea53265915fe
MD5 a0da0b6cbf49f65a8d72014a90c861e7
SHA1 c28fcec7d5d2dc39ac53d26549fe6405c9464150
SHA512 ed230d6ff7e96eed6cdea31cf3ee0aae00c930ee8e49d593133e8720a69b41699d2b03a956ef6cef42c433bf526167b2a4ab22c0e02bf18bbe6aa6bfb434d884
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSrFnZe2RUyjSXPfPb:N9iIxuERzA83h09RZxYS7Bifz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 751d8e3b881c9f213d683726f408eb99711a48452c5cd627f82823582d5fd92a
MD5 7efac0783a9cea3531eb2cae08a57c0b
SHA1 3c1411b938d6b1b2c9e69af099f6588e6afcf842
SHA512 d00bd72b49d035ffc717ac24606bd2b4230b9bce157ea7e59d2c3c9de5028b96902edd5ada1648ef0aabc594dac57082b6d806b39c011b27dc2681e69b8000be
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSn5eZe2RUyjSVp4PfKYdFC:F9iIxuERzA83h09RZxYSWBGKfKYi0Yr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 9f6dde76b25197bc56e7e41d772d3fb753b67f17f7ce0cbc2a79b7dc3e9f255a
MD5 9c260adeafa1e6a84ecf7b27d8c1ebe8
SHA1 07a06db00d88e849a0337577103bcb42e16d82f1
SHA512 f57a8fa4b88da8efd7cb339a7b6d48506c64086ef0c667148170d6321824ea212b864e8a4457e21bb66793e0966f554b1abffab745cb9745232f9519a045b3f3
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 50c923018058979eaedd5f7b22bd38725c2311ed4482a5da1c071ccf2c9f10b1
MD5 bffee317ee9019adf42411806b7629ec
SHA1 ccacec3d98ca81dab009a2c854a33bff801b7bc7
SHA512 055d936c86927741a51668aeafa3335597e78cc538976acdd97f0928ee9710b3f820ed7b0d18c8476fcfd291e08dcc2abc485b75f8b635513759b3af45c2d4c4
MD5 SHA1 SHA512

Submit Download

Zorara.zip

Path C:\Users\Admin\Downloads\Zorara.zip
Size 45.9MB
SHA256 d9ce374a60b26554a1439f1b60ef26e3aa1216dd4381c70f13086afc7c2efe64
MD5 d94e3fe4ca60e05cd7c52685c272a2ce
SHA1 3f650c2e654613333b324fd4d64556146260a60c
SHA512 e05df68b6b90039cddd2a261fe01d71d731de559fc77269977408c0c7952bf29969322cc8ecb37849fd14e209c24be5fc890100bada1e72066b34c171d045313
SSDEEP 786432:3wSP5aexnmjM4yyQEL1Z0R2wSv5a3/UmUTYLyapteRjNCpPFOt8bP7JM7yFlb9j:3ww5Zt2wo5kU2yapARQNFw8xWyFzj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zorara.exe

Path C:\Users\Admin\Downloads\Zorara\Zorara.exe
Size 801KB
SHA256 43dc8536fcf8bfafed65cf02106c4adaedf6fdfd52daf845c4f20108008acc44
MD5 d3306964c621963a6ff097ab3ddd853b
SHA1 f6e0dd43057ce3088eb998f627f38c202ca0e235
SHA512 563fcc505ee88e0dc8f070a5131dfc99e514abd383338e1892a8d3b6371015cc5de2214173ce300e0643f01d906008fef378786785d7a2de830fd59df3a4da7b
SSDEEP 12288:aNOj6vOxCjlMT/TeTKOmwYxf0SRrB+WsF5HTK8TgXGCfUq5S1Sa:tiOMjOeTKOKf0qt+5LYLf
MD5 SHA1 SHA512 SSDEEP

Submit Download

isfile.txt

Path C:\Users\Admin\Downloads\Zorara\workspace\.tests\isfile.txt
Size 7B
SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
MD5 260ca9dd8a4577fc00b7bd5810298076
SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
MD5 SHA1 SHA512

Submit Download

memory/2200-717-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-716-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-718-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-728-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-727-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-726-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-725-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-724-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-723-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/2200-722-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

Download

memory/4328-689-0x00000208B7D10000-0x00000208B7D11000-memory.dmp

Download

memory/4328-688-0x00000208B7830000-0x00000208B797E000-memory.dmp

Download