Analysis

  • max time kernel
    260s
  • max time network
    256s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    17-12-2024 15:19

General

  • Target

    https://lootdest.org/s?ce9e37b3

Score
7/10

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • A potential corporate email address has been identified in the URL: [email protected]
  • A potential corporate email address has been identified in the URL: detect-gpu@latest
  • A potential corporate email address has been identified in the URL: [email protected]
  • A potential corporate email address has been identified in the URL: lottie-player@latest
  • Executes dropped EXE 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://lootdest.org/s?ce9e37b3
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffe26c446f8,0x7ffe26c44708,0x7ffe26c44718
      2⤵
        PID:4100
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        2⤵
          PID:3992
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4176
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
          2⤵
            PID:5416
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
            2⤵
              PID:5236
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
              2⤵
                PID:5244
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
                2⤵
                  PID:5932
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
                  2⤵
                    PID:4672
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
                    2⤵
                      PID:3344
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6356 /prefetch:8
                      2⤵
                        PID:1148
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=900 /prefetch:1
                        2⤵
                          PID:2760
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
                          2⤵
                            PID:5452
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6624 /prefetch:8
                            2⤵
                              PID:4516
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
                              2⤵
                                PID:4136
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                2⤵
                                • Drops file in Program Files directory
                                PID:5944
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff73a095460,0x7ff73a095470,0x7ff73a095480
                                  3⤵
                                    PID:3236
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4852
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
                                  2⤵
                                    PID:4744
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
                                    2⤵
                                      PID:5864
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
                                      2⤵
                                        PID:3524
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
                                        2⤵
                                          PID:5292
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3916
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15553971799493246798,17404088570757401944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6164 /prefetch:2
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:768
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:5276
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:5384
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:516
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x460 0x4e8
                                              1⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5724
                                            • C:\Windows\System32\rundll32.exe
                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                              1⤵
                                                PID:5828
                                              • C:\Program Files\7-Zip\7zG.exe
                                                "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Zorara\" -spe -an -ai#7zMap29684:74:7zEvent30385
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                PID:924
                                              • C:\Users\Admin\Downloads\Zorara\Zorara.exe
                                                "C:\Users\Admin\Downloads\Zorara\Zorara.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:4328
                                              • C:\Users\Admin\Downloads\Zorara\Zorara.exe
                                                "C:\Users\Admin\Downloads\Zorara\Zorara.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:4188
                                              • C:\Users\Admin\Downloads\Zorara\Zorara.exe
                                                "C:\Users\Admin\Downloads\Zorara\Zorara.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:3500
                                              • C:\Windows\system32\taskmgr.exe
                                                "C:\Windows\system32\taskmgr.exe" /4
                                                1⤵
                                                • Checks SCSI registry key(s)
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:2200
                                              • C:\Users\Admin\Downloads\Zorara\Zorara.exe
                                                "C:\Users\Admin\Downloads\Zorara\Zorara.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:5628
                                              • C:\Windows\system32\OpenWith.exe
                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2240
                                              • C:\Windows\system32\OpenWith.exe
                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2880
                                              • C:\Windows\system32\OpenWith.exe
                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                1⤵
                                                  PID:2296
                                                • C:\Users\Admin\Downloads\Zorara\Zorara.exe
                                                  "C:\Users\Admin\Downloads\Zorara\Zorara.exe"
                                                  1⤵
                                                    PID:3824

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Zorara.exe.log

                                                    Filesize

                                                    226B

                                                    MD5

                                                    b92bd19c1a9416298a873dfa43b439b7

                                                    SHA1

                                                    7b96a8874aff3a502363f4168332613ebc53d64e

                                                    SHA256

                                                    1ac8854abd01c202cf82e4ccdf80bf50319c59bc7a02dce2b19cecfedf7dd4ba

                                                    SHA512

                                                    5910691ebdd78a2740117b14f146629874682d196f518f479b8bcb754ed2501a009fc465cb9e3685f7aed8ced7b435690de2b8b8439117abb5f61dc4996387a6

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    6547c6e6bdac94ad11ab8e5311c7e265

                                                    SHA1

                                                    cc3401985b79ed678f8b94b0500766691044ee7f

                                                    SHA256

                                                    685aee2efe60adca559de33807715ef5306c5ccb8857070155eae3d7ab397e3a

                                                    SHA512

                                                    d685ddcb513af37ea57e0255d9f5387266f882015b9cfca8f100931dc1629e54d1150679e4562717180447887ef7094539df668707dfbdbd3ef9b4920de7dcb6

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    0526f2b37744871ef85ad98e2a03cd78

                                                    SHA1

                                                    7e8475de7f5614e30b67793a41d35ff492aff7cc

                                                    SHA256

                                                    68ce145d21b89f38464ed7486c74dd55a7e28e5ba25bb640cf4059b1bafdafd9

                                                    SHA512

                                                    12ae36f493802621601887cdc25e3d7191bfa94f0e784f11f18bff4bdf407efee195aceca19fe151718e9e7498a4faf0ff885e38cbc8e1e7a5d5d81f400b1ef0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                                    Filesize

                                                    49KB

                                                    MD5

                                                    b1c446910fa238b9b83c80192998fff6

                                                    SHA1

                                                    07b03f9c2dd1333b17c1193b6220b4e6b77115f9

                                                    SHA256

                                                    d55229e346c22979df1e6e2b8914706914b2febc529c153194a7589d2f0f5e71

                                                    SHA512

                                                    29a024aa14e14fdcb2e219bc7b3168f9c0336e521f9b19a96b2a1f8f405bfd0612823da5a5907994ab05ea258a84f91cd095514ad640040f3d40c2c652b098f2

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    624B

                                                    MD5

                                                    52d025170495fd805bbeade73dcfde29

                                                    SHA1

                                                    182440aa2c59219f83edfbcbe0d0b45a9bba75ef

                                                    SHA256

                                                    758f5d6bf47bfc4cfee0e24152b14fcd11e318f1034d7abfad4b684a762c713b

                                                    SHA512

                                                    3f0e8abc52bbef8a70a96991ecce2d8fd3f2d131b8e40d12d3926b63bf5ec7ba834253b65f55c75f6e7d2014d6d90e914e15a00731d9d95825913066d6e162ac

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RF43fd4.TMP

                                                    Filesize

                                                    48B

                                                    MD5

                                                    cf311e236f24c1ef2830d1dd208e712d

                                                    SHA1

                                                    dc8fe90cde5c830e551ff77d08118da587f8998c

                                                    SHA256

                                                    d5ca3707743637dad72a5c47f703ecc661a58edc6fc33de71bfa4f25b628f95c

                                                    SHA512

                                                    d97a1aa0d67ae32810e4c37085e74db94d40a8302d331fb9b08e7954b58a963e613616a2373a44e33b7cbfe385c29be8cfb5c925c7d7280a63ebe70ba1f09f4f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                    Filesize

                                                    70KB

                                                    MD5

                                                    e5e3377341056643b0494b6842c0b544

                                                    SHA1

                                                    d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                    SHA256

                                                    e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                    SHA512

                                                    83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

                                                    Filesize

                                                    41B

                                                    MD5

                                                    5af87dfd673ba2115e2fcf5cfdb727ab

                                                    SHA1

                                                    d5b5bbf396dc291274584ef71f444f420b6056f1

                                                    SHA256

                                                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                    SHA512

                                                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    4KB

                                                    MD5

                                                    1941a6826828195b05cceff685fc70f4

                                                    SHA1

                                                    50c43a72a9c56b895c6446a760fd32d4629f74fe

                                                    SHA256

                                                    2cfff641c3e4638490bea185afc32966b736195c825909ad76caf8e27110334d

                                                    SHA512

                                                    1e1a166224b36bae00a0c6c920577db45334ed77884d1e22fb77e3c447f7d87f3cb890f3b294e04707164337acb67d8f2808686d1038552133c28f8b83ff1cfd

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    4KB

                                                    MD5

                                                    0a66685f89b2ae3558ddf576eec2c0ad

                                                    SHA1

                                                    8b641f03372c976794f6e4b1ebef47ca3d0b94c2

                                                    SHA256

                                                    dbf3a242233620705a19534692204ceb493680d8fd62f525145cb8bfd0685613

                                                    SHA512

                                                    7ffdf8d298fd23710b8bf756d3595660277fa46638542e3fb07ff6366f3ad0eab9404bacbb2092423f1559ec11ed8095076d924bda6fe0bb335765be6375de2c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RF4d8d8.TMP

                                                    Filesize

                                                    59B

                                                    MD5

                                                    2800881c775077e1c4b6e06bf4676de4

                                                    SHA1

                                                    2873631068c8b3b9495638c865915be822442c8b

                                                    SHA256

                                                    226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                    SHA512

                                                    e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    4024ed3cf203b8a2ab4c9ef5aa5985c1

                                                    SHA1

                                                    a4a906fe9932729e093d61eee0490fbd82b00c31

                                                    SHA256

                                                    6f62c9973bcda911034ef64bf5f442f77911b9212f587aa28163593d54db9a3a

                                                    SHA512

                                                    5c81d028eb4cd83de21e187fee68c83d7d9c008014e6fd2942148f7c1eef142369dc36f19a6d386e442fa61b37cba9f6a7ecf423de06853d9dfcaa8632ec69cf

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    7e2b51637b45e274d9fd59535e564d4c

                                                    SHA1

                                                    2ecd48390ee589e1d7161c1a5ac3fa3c3d6bc3a6

                                                    SHA256

                                                    83913f73f00d96b047713d6969c5833dcf2c15eefb0a61b978061183de10a30b

                                                    SHA512

                                                    fd14e468a03f939ba5677a9e7a391bb75e0c7d79c801dc1603b5a55b2439d51c801e0a303f2f92b9e4724c0937bb593393889ad5961e6c5a3683d84531430a15

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    769830238cb4597dc058f526d02f8950

                                                    SHA1

                                                    cb209c6ef844b2f77e8a4cd63abad1c18b230ea4

                                                    SHA256

                                                    4ef061e03897aea1813476204c688b2c1a64c30f597987be5f880c19e8a4ac19

                                                    SHA512

                                                    f8043032666503dbc77214a8525d689699f3dfbac711884c9a6de142b4e09b0dae714c7e46d90891351cf11961e19405d356765935f0861d135c78839753b38e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    ca68ff2fcc5acd3b5dfa112808fb9973

                                                    SHA1

                                                    b15ba137a4dda2dc5917e33e01130831fe9ef803

                                                    SHA256

                                                    fa67a6804e337466e0e877d2adf0ac4f61a2af6abeed8b31261c58e043ade915

                                                    SHA512

                                                    be851093b687305e8cd7f07a2118d17c4cc7d2e046169cdc37a1f2a12a1076aee4162c334162a262c5e37269e500a0573c618b786a19d37fd8e489b85bc98d87

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                    Filesize

                                                    24KB

                                                    MD5

                                                    54d8d5d412f3513b3c0f5d4f86a4874c

                                                    SHA1

                                                    bd77a00fb917760fc161fe3a4d87d67182225c77

                                                    SHA256

                                                    ed80fc26e71dc195ccf0e92873cd3f2d559c83a0acf763829e39d0b2921028a0

                                                    SHA512

                                                    8bff2beee1faaa562c6b332a0cbbd633ac52c6d60fda2e6ea81a888d3c6a85cb7e6f8ca5a111e61a6abbe20e5673ced2eb0295166bbc222b7cc29458515dbeff

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                    Filesize

                                                    24KB

                                                    MD5

                                                    53aa92384f8dd229643647a024db8d61

                                                    SHA1

                                                    4c1434d5ad4cb0ae4b8bad2ee31f82ba67581992

                                                    SHA256

                                                    88831be300e64e2d65654f5667385f50a7c05925655a06ccb8252a161455e28f

                                                    SHA512

                                                    cf23d5eeade7ea6d240cb1b8e30adc2b4f0e1cf0359c802715caecc9855251b2a8affcc7cd0c7d57339164fd8af5dde4447f244a4be3c14d5d4f95990bf879fc

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                    Filesize

                                                    146B

                                                    MD5

                                                    25e1136dd2c7d228f283563b674d64ad

                                                    SHA1

                                                    e2a8bdf31ce3762d853266f6cc614001f2ee0fa9

                                                    SHA256

                                                    c52c2ce4f29b3da58005d3d44e8f2bddec9659e0a1084b484020c63dbc7572c9

                                                    SHA512

                                                    55a0589bbec1e804fe6fa0283b3d1f730c6756735cbf021cfd50aa53a67ec5f486cd379e4d704be07a1c1c3e76cecb19f2f9108abb3b6df34358f82db99eae8f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                    Filesize

                                                    82B

                                                    MD5

                                                    d48ee60141979384b3ce0113fcbd6a77

                                                    SHA1

                                                    78d2ffea2e5d0513bbb60c4089f474b15eaf559c

                                                    SHA256

                                                    89fff7d3fd7e049666d03572131485f7f7827e26b43aa91f6ec6b8d7d76d7b96

                                                    SHA512

                                                    4161208813410b681790918e1ff85b1d0aa6aea4fcdb401b81ad2ae28bf6b3f9d751d8482cc958c7cfa1dc203a1b91e263f977207888a8ad6fd9dbdab41395c0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RF3e4f2.TMP

                                                    Filesize

                                                    89B

                                                    MD5

                                                    fbf20ed944f6d233ddcda4e12020ec9f

                                                    SHA1

                                                    f127e118e177d4507f7fcb36c31dd7b676d7a516

                                                    SHA256

                                                    c66b94115ba92840f90fefbf1663b6111bc6636c62cf7f8b43498177c4b2bf16

                                                    SHA512

                                                    15771617099cc9c8d374587e17c7c56d992dd6eac5c96cd567f38884409ee18da8fa5733e45a124f91faf65c80cea384fef0e008f8726ce0102c44104ac782a0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                    Filesize

                                                    72B

                                                    MD5

                                                    f8c1786a74ee93316fcae027306536bb

                                                    SHA1

                                                    c5d43ffb5cd6ac022e490a9bdce4c8066df4803c

                                                    SHA256

                                                    237aa07276eb6ce303525eacdde21a4fb3d8ed30354a7f1d0ed39765bde0336e

                                                    SHA512

                                                    823e33acb1f339fa519d266bc4679f70076ce4c3a6ba4aa3acf1b0985274990825aa99649425db954bf896d40ff98c6de960b4a44a5cf7be25be561b205c801f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                    Filesize

                                                    48B

                                                    MD5

                                                    58a9912b3049d11458dca8295c7808fd

                                                    SHA1

                                                    a0bea6eea162eed577567dc763a31e1b8145f68f

                                                    SHA256

                                                    50578cc8a170816a82579566b36c5ff193726fb001ab82f25ced191c26cefe67

                                                    SHA512

                                                    fadcada033f41fb33d98f27755e384b52792ebaa0e65bd4190ba162a45e19a35ec7e45b9c654aacbff69654030f4cdacef179334878721103f7af9ddde0f9b67

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF435c2.TMP

                                                    Filesize

                                                    48B

                                                    MD5

                                                    d863ac0b8452b7c570485aeb6a34139b

                                                    SHA1

                                                    7a3a0cae0dc05ecd5ff8f3c0ca65a8f42bf5442f

                                                    SHA256

                                                    3a13361a925b95e047fa9d09b965e4339d078c4596161762efd85bf9df7ac929

                                                    SHA512

                                                    10f1795fd0b3363a9a9f2aa1e2434804bd230ec242cec946b7f53cc13ea7de8340cd5e093dcd37e62b166a4f5c9334bbc794cd876905534f2933b95236cd783d

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    46295cac801e5d4857d09837238a6394

                                                    SHA1

                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                    SHA256

                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                    SHA512

                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    c3093b0f6155cd57d676bdfd4ee4c2ca

                                                    SHA1

                                                    e822ffa4e8fec6d19ec664047c273f070d25e394

                                                    SHA256

                                                    6143cc481965293b96d2188111c6e73b5219e1dfba1464825c97e87db42982c4

                                                    SHA512

                                                    c5b86f9bc2370d8f2cb77ee7ec420c3b151816b56cc6928282c165592c1032cbd7131d6618fe12366029092c1e71ecff5740551c9b199677e333fd7da9fa5a37

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RF4d955.TMP

                                                    Filesize

                                                    873B

                                                    MD5

                                                    d19a9a14790e9ae2c6d17d2baa119bb4

                                                    SHA1

                                                    5a5a642cd629e6c4867f6d6150f616d3d2c177c5

                                                    SHA256

                                                    220c4ca7e247472532287e9caced9b387a44241af255a321c5a2c2b2a0acc948

                                                    SHA512

                                                    ff6a955f105640c5725f07ec4c8b61fb49d519f5361a29222a59602c518d2db53c60a088789ceb2f53093170f0002bfa01886a65b4bb2bfcb6329252c135e572

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    206702161f94c5cd39fadd03f4014d98

                                                    SHA1

                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                    SHA256

                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                    SHA512

                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    a0da0b6cbf49f65a8d72014a90c861e7

                                                    SHA1

                                                    c28fcec7d5d2dc39ac53d26549fe6405c9464150

                                                    SHA256

                                                    ea33bb6a88800f7b457bc563ddd0700f14c49011ed7e89bff791ea53265915fe

                                                    SHA512

                                                    ed230d6ff7e96eed6cdea31cf3ee0aae00c930ee8e49d593133e8720a69b41699d2b03a956ef6cef42c433bf526167b2a4ab22c0e02bf18bbe6aa6bfb434d884

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    7efac0783a9cea3531eb2cae08a57c0b

                                                    SHA1

                                                    3c1411b938d6b1b2c9e69af099f6588e6afcf842

                                                    SHA256

                                                    751d8e3b881c9f213d683726f408eb99711a48452c5cd627f82823582d5fd92a

                                                    SHA512

                                                    d00bd72b49d035ffc717ac24606bd2b4230b9bce157ea7e59d2c3c9de5028b96902edd5ada1648ef0aabc594dac57082b6d806b39c011b27dc2681e69b8000be

                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    9c260adeafa1e6a84ecf7b27d8c1ebe8

                                                    SHA1

                                                    07a06db00d88e849a0337577103bcb42e16d82f1

                                                    SHA256

                                                    9f6dde76b25197bc56e7e41d772d3fb753b67f17f7ce0cbc2a79b7dc3e9f255a

                                                    SHA512

                                                    f57a8fa4b88da8efd7cb339a7b6d48506c64086ef0c667148170d6321824ea212b864e8a4457e21bb66793e0966f554b1abffab745cb9745232f9519a045b3f3

                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    bffee317ee9019adf42411806b7629ec

                                                    SHA1

                                                    ccacec3d98ca81dab009a2c854a33bff801b7bc7

                                                    SHA256

                                                    50c923018058979eaedd5f7b22bd38725c2311ed4482a5da1c071ccf2c9f10b1

                                                    SHA512

                                                    055d936c86927741a51668aeafa3335597e78cc538976acdd97f0928ee9710b3f820ed7b0d18c8476fcfd291e08dcc2abc485b75f8b635513759b3af45c2d4c4

                                                  • C:\Users\Admin\Downloads\Zorara.zip

                                                    Filesize

                                                    45.9MB

                                                    MD5

                                                    d94e3fe4ca60e05cd7c52685c272a2ce

                                                    SHA1

                                                    3f650c2e654613333b324fd4d64556146260a60c

                                                    SHA256

                                                    d9ce374a60b26554a1439f1b60ef26e3aa1216dd4381c70f13086afc7c2efe64

                                                    SHA512

                                                    e05df68b6b90039cddd2a261fe01d71d731de559fc77269977408c0c7952bf29969322cc8ecb37849fd14e209c24be5fc890100bada1e72066b34c171d045313

                                                  • C:\Users\Admin\Downloads\Zorara\Zorara.exe

                                                    Filesize

                                                    801KB

                                                    MD5

                                                    d3306964c621963a6ff097ab3ddd853b

                                                    SHA1

                                                    f6e0dd43057ce3088eb998f627f38c202ca0e235

                                                    SHA256

                                                    43dc8536fcf8bfafed65cf02106c4adaedf6fdfd52daf845c4f20108008acc44

                                                    SHA512

                                                    563fcc505ee88e0dc8f070a5131dfc99e514abd383338e1892a8d3b6371015cc5de2214173ce300e0643f01d906008fef378786785d7a2de830fd59df3a4da7b

                                                  • C:\Users\Admin\Downloads\Zorara\workspace\.tests\isfile.txt

                                                    Filesize

                                                    7B

                                                    MD5

                                                    260ca9dd8a4577fc00b7bd5810298076

                                                    SHA1

                                                    53a5687cb26dc41f2ab4033e97e13adefd3740d6

                                                    SHA256

                                                    aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

                                                    SHA512

                                                    51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

                                                  • memory/2200-717-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-716-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-718-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-728-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-727-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-726-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-725-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-724-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-723-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2200-722-0x00000176FEC50000-0x00000176FEC51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/4328-689-0x00000208B7D10000-0x00000208B7D11000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/4328-688-0x00000208B7830000-0x00000208B797E000-memory.dmp

                                                    Filesize

                                                    1.3MB