3b0056c395e6da3f80e245e43f37fc9fc97e333570580585ea0285a10f7bc219

Analysis

user interaction
yes
max time kernel
900s
max time network
893s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zen.installer.exe
Size 90.2MB
Sample260705-2kq5bsf161
SHA256 3b0056c395e6da3f80e245e43f37fc9fc97e333570580585ea0285a10f7bc219
MD5 91eeb9f717ce158d48a24d2c4aff0da9
SHA1 59cf104f4d952f2cec3cc945afd2f9560f32cd09
SHA512 c34fdfa375b8aaa6d71e79472d44565ac9441182c33d58050203953c449f46aa31e1e8c8bb5a24c41b386ef6f3e4f18a33f417edc0d327a14abc730ec486471d
SSDEEP 1572864:chNwKe3cXxC62QsvR04kUBq7OBcyEp5Qx5VuxXzsK3AxtI7AtYJ/V4v:AN9i0x92QsvRiUw1l+5UegAw6YV4v
TLSH
T1C12833DC1D6FCD29E80D7F35B919ED636B3E2E365D24264E04FAB212958109BF538A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mozilla-Zen-F0DC299D809B9700 = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -os-autostart"	zen.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1456-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/1456-384-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Zen Browser\mozinference.dll	setup.exe
File created	C:\Program Files\Zen Browser\precomplete	setup.exe
File created	C:\Program Files\Zen Browser\install.log	setup.exe
File created	C:\Program Files\Zen Browser\msvcp140_atomic_wait.dll	setup.exe
File created	C:\Program Files\Zen Browser\platform.ini	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_70.png	setup.exe
File created	C:\Program Files\Zen Browser\dependentlibs.list	setup.exe
File created	C:\Program Files\Zen Browser\msvcp140.dll	setup.exe
File created	C:\Program Files\Zen Browser\update-settings.ini	setup.exe
File created	C:\Program Files\Zen Browser\updater.ini	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.InputStateManager.dll	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\uninstall.log	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Composition.OSSupport.dll	setup.exe
File created	C:\Program Files\Zen Browser\plugin-container.exe	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\updater.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Zen Browser\AccessibleMarshal.dll	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\CoreMessagingXP.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\omni.ja	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\installation_telemetry.json	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice.exe	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsvD28F.tmp\	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsvD290.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\AccessibleMarshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Input.dll	setup.exe
File created	C:\Program Files\Zen Browser\notificationserver.dll	setup.exe
File created	C:\Program Files\Zen Browser\xul.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavutil.dll	setup.exe
File created	C:\Program Files\Zen Browser\nmhproxy.exe	setup.exe
File created	C:\Program Files\Zen Browser\pingsender.exe	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsvD291.tmp	setup.exe
File created	C:\Program Files\Zen Browser\freebl3.dll	setup.exe
File created	C:\Program Files\Zen Browser\gkcodecs.dll	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice_installer.exe	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.Internal.FrameworkUdk.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavcodec.dll	setup.exe
File created	C:\Program Files\Zen Browser\omni.ja	setup.exe
File opened for modification	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\lgpllibs.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozglue.dll	setup.exe
File created	C:\Program Files\Zen Browser\nss3.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	maintenanceservice_tmp.exe
File opened for modification	C:\Program Files\Zen Browser\nsvD290.tmp	setup.exe
File created	C:\Program Files\Zen Browser\libEGL.dll	setup.exe
File created	C:\Program Files\Zen Browser\installation_dir_layout\versioned\InstallationDirLayout.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Zen Browser\removed-files	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png	setup.exe
File created	C:\Program Files\Zen Browser\default-browser-agent.exe	setup.exe
File created	C:\Program Files\Zen Browser\firefox.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\marshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\onnxruntime.dll	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\clearkey.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	maintenanceservice_tmp.exe
File created	C:\Program Files\Zen Browser\application.ini	setup.exe

Executes dropped EXE 25 IoCs

pid	Process
4424	setup.exe
1644	maintenanceservice_installer.exe
668	maintenanceservice_tmp.exe
1672	default-browser-agent.exe
2356	zen.exe
3032	zen.exe
4260	zen.exe
3952	zen.exe
4012	zen.exe
2956	zen.exe
3168	zen.exe
3988	zen.exe
4428	zen.exe
1504	zen.exe
2320	zen.exe
4808	zen.exe
3396	zen.exe
3212	zen.exe
3920	zen.exe
4772	zen.exe
7020	zen.exe
7072	zen.exe
3140	zen.exe
3200	zen.exe
4780	zen.exe

Loads dropped DLL 64 IoCs

pid	Process
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
2536	regsvr32.exe
2536	regsvr32.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
1644	maintenanceservice_installer.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
4424	setup.exe
1672	default-browser-agent.exe
1672	default-browser-agent.exe
1672	default-browser-agent.exe
2356	zen.exe
2356	zen.exe
2356	zen.exe
2356	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
3032	zen.exe
4260	zen.exe
4260	zen.exe
4260	zen.exe
4260	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe
3952	zen.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zen.installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe

Checks processor information in registry 2 TTPs 35 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zen.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Colors	zen.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	zen.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.m4a	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\SupportedTypes	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.svg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xml	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CF20D35A-79E6-4AD7-B504-001D945498C2}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\FriendlyTypeName = "Firefox HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\ = "Firefox URL"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.png	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CF20D35A-79E6-4AD7-B504-001D945498C2}\DllSurrogate	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.bmp	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.ogg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\CustomActivator = "{CF20D35A-79E6-4AD7-B504-001D945498C2}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\DisplayName = "Zen Browser"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\ = "Firefox PDF Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.jpg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.shtml	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "ISimpleDOMNode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\ = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.jpeg	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{CF20D35A-79E6-4AD7-B504-001D945498C2}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.gif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.mp3	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.apng	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.htm	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.html	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.rdf	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
668	maintenanceservice_tmp.exe
668	maintenanceservice_tmp.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe
Token: SeDebugPrivilege	2956	zen.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4424	setup.exe
2956	zen.exe
2956	zen.exe
2956	zen.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2956	zen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4424	1456	zen.installer.exe	80
PID 4424 wrote to memory of 2536	4424	setup.exe	81
PID 4424 wrote to memory of 1644	4424	setup.exe	82
PID 1644 wrote to memory of 668	1644	maintenanceservice_installer.exe	83
PID 4424 wrote to memory of 1672	4424	setup.exe	84
PID 1672 wrote to memory of 2356	1672	default-browser-agent.exe	85
PID 2356 wrote to memory of 3032	2356	zen.exe	86
PID 2356 wrote to memory of 3032	2356	zen.exe	86
PID 4424 wrote to memory of 4260	4424	setup.exe	88
PID 4260 wrote to memory of 3952	4260	zen.exe	89
PID 4260 wrote to memory of 3952	4260	zen.exe	89
PID 4424 wrote to memory of 4012	4424	setup.exe	90
PID 4012 wrote to memory of 2956	4012	zen.exe	91
PID 4012 wrote to memory of 2956	4012	zen.exe	91
PID 2956 wrote to memory of 3168	2956	zen.exe	92
PID 2956 wrote to memory of 3168	2956	zen.exe	92
PID 2956 wrote to memory of 3168	2956	zen.exe	92
PID 2956 wrote to memory of 3988	2956	zen.exe	93
PID 2956 wrote to memory of 3988	2956	zen.exe	93
PID 2956 wrote to memory of 3988	2956	zen.exe	93
PID 2956 wrote to memory of 3988	2956	zen.exe	93
PID 2956 wrote to memory of 4428	2956	zen.exe	94
PID 2956 wrote to memory of 4428	2956	zen.exe	94
PID 2956 wrote to memory of 4428	2956	zen.exe	94
PID 2956 wrote to memory of 4428	2956	zen.exe	94
PID 2956 wrote to memory of 1504	2956	zen.exe	95
PID 2956 wrote to memory of 1504	2956	zen.exe	95
PID 2956 wrote to memory of 1504	2956	zen.exe	95
PID 2956 wrote to memory of 2320	2956	zen.exe	96
PID 2956 wrote to memory of 2320	2956	zen.exe	96
PID 2956 wrote to memory of 2320	2956	zen.exe	96
PID 2956 wrote to memory of 2320	2956	zen.exe	96
PID 2956 wrote to memory of 4808	2956	zen.exe	97
PID 2956 wrote to memory of 4808	2956	zen.exe	97
PID 2956 wrote to memory of 4808	2956	zen.exe	97
PID 2956 wrote to memory of 4808	2956	zen.exe	97
PID 2956 wrote to memory of 3396	2956	zen.exe	98
PID 2956 wrote to memory of 3396	2956	zen.exe	98
PID 2956 wrote to memory of 3396	2956	zen.exe	98
PID 2956 wrote to memory of 3396	2956	zen.exe	98
PID 2956 wrote to memory of 3212	2956	zen.exe	99
PID 2956 wrote to memory of 3212	2956	zen.exe	99
PID 2956 wrote to memory of 3212	2956	zen.exe	99
PID 2956 wrote to memory of 3212	2956	zen.exe	99
PID 2956 wrote to memory of 3920	2956	zen.exe	100
PID 2956 wrote to memory of 3920	2956	zen.exe	100
PID 2956 wrote to memory of 3920	2956	zen.exe	100
PID 2956 wrote to memory of 3920	2956	zen.exe	100
PID 2956 wrote to memory of 4772	2956	zen.exe	101
PID 2956 wrote to memory of 4772	2956	zen.exe	101
PID 2956 wrote to memory of 4772	2956	zen.exe	101
PID 2956 wrote to memory of 4772	2956	zen.exe	101
PID 7020 wrote to memory of 7072	7020	zen.exe	104
PID 7020 wrote to memory of 7072	7020	zen.exe	104
PID 2956 wrote to memory of 3140	2956	zen.exe	105
PID 2956 wrote to memory of 3140	2956	zen.exe	105
PID 2956 wrote to memory of 3140	2956	zen.exe	105
PID 2956 wrote to memory of 3140	2956	zen.exe	105
PID 2956 wrote to memory of 3200	2956	zen.exe	106
PID 2956 wrote to memory of 3200	2956	zen.exe	106
PID 2956 wrote to memory of 3200	2956	zen.exe	106
PID 2956 wrote to memory of 3200	2956	zen.exe	106
PID 2956 wrote to memory of 4780	2956	zen.exe	107
PID 2956 wrote to memory of 4780	2956	zen.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\zen.installer.exe
"C:\Users\Admin\AppData\Local\Temp\zen.installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\7zS0B534288\setup.exe
  .\setup.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Zen Browser\AccessibleMarshal.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2536
- - C:\Program Files\Zen Browser\maintenanceservice_installer.exe
    "C:\Program Files\Zen Browser\maintenanceservice_installer.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:668
- - C:\Program Files\Zen Browser\default-browser-agent.exe
    "C:\Program Files\Zen Browser\default-browser-agent.exe" register-task F0DC299D809B9700
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:3032
- - C:\Program Files\Zen Browser\zen.exe
    "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies Control Panel
      PID:3952
- - C:\Program Files\Zen Browser\zen.exe
    "C:\Program Files\Zen Browser\zen.exe" -first-startup
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" -first-startup
      4⤵
      Adds Run key to start application
      Checks system information in the registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies Control Panel
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260702090218 -prefsHandle 2264:26847 -prefMapHandle 2268:300403 -ipcHandle 2312 -initialChannelId {eb6b802d-f2e9-4d60-83a8-df848e79c3e9} -parentPid 2956 -appDir "C:\Program Files\Zen Browser\browser" - 1 gpu
        5⤵
        Executes dropped EXE
        
        PID:3168
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260702090218 -prefsHandle 2528:26847 -prefMapHandle 2532:300403 -ipcHandle 2540 -initialChannelId {8f08ec07-c878-4391-ae5c-215f88931e44} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 2 socket
        5⤵
        Executes dropped EXE
        
        PID:3988
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3356:26877 -prefMapHandle 3360:300403 -jsInitHandle 3364:156120 -parentBuildID 20260702090218 -ipcHandle 3368 -initialChannelId {ad79b64a-22ef-4014-8c67-d5f8976e4476} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 3 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4428
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260702090218 -prefsHandle 3588:27553 -prefMapHandle 3592:300403 -ipcHandle 3600 -initialChannelId {9124097f-bfd1-436e-ab96-d7ea9f03cf30} -parentPid 2956 -appDir "C:\Program Files\Zen Browser\browser" - 4 rdd
        5⤵
        Executes dropped EXE
        
        PID:1504
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3864:27664 -prefMapHandle 3868:300403 -jsInitHandle 3872:156120 -parentBuildID 20260702090218 -ipcHandle 3840 -initialChannelId {80680ec1-4363-4054-846a-eb5035b019b9} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 5 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2320
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3484:27861 -prefMapHandle 3468:300403 -jsInitHandle 3472:156120 -parentBuildID 20260702090218 -ipcHandle 3388 -initialChannelId {df5456da-5b0d-4a59-b0f8-aac89c3f638b} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 6 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4808
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4576:27861 -prefMapHandle 4580:300403 -jsInitHandle 4584:156120 -parentBuildID 20260702090218 -ipcHandle 3428 -initialChannelId {ceb759e9-6f81-4836-afbb-ee67d89b823f} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 7 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3396
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4508:27861 -prefMapHandle 4512:300403 -jsInitHandle 4584:156120 -parentBuildID 20260702090218 -ipcHandle 4576 -initialChannelId {dc9d0534-3a24-45df-8712-1725c60a0987} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 8 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3212
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5084:30961 -prefMapHandle 5088:300403 -jsInitHandle 5092:156120 -parentBuildID 20260702090218 -ipcHandle 5100 -initialChannelId {6deb2025-ae86-4096-b066-ac8b3c414db3} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 9 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3920
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260702090218 -sandboxingKind 0 -prefsHandle 6040:44337 -prefMapHandle 6044:300403 -ipcHandle 6052 -initialChannelId {805ebffe-66b3-4594-8d89-564badb327cd} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 10 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4772
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5424:42603 -prefMapHandle 5600:300403 -jsInitHandle 5416:156120 -parentBuildID 20260702090218 -ipcHandle 5228 -initialChannelId {e25be3fe-92fb-4ac2-8f97-76679e01eabb} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 11 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3140
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5384:42603 -prefMapHandle 5480:300403 -jsInitHandle 5412:156120 -parentBuildID 20260702090218 -ipcHandle 5236 -initialChannelId {6aefc72f-89f2-451f-b120-2596b5fa8938} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 12 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3200
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6444:42603 -prefMapHandle 6448:300403 -jsInitHandle 6452:156120 -parentBuildID 20260702090218 -ipcHandle 5512 -initialChannelId {98aa9adf-05db-4dd4-824a-4234717ef746} -parentPid 2956 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 13 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4780

C:\Program Files\Zen Browser\zen.exe
"C:\Program Files\Zen Browser\zen.exe" -os-autostart
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7020
- C:\Program Files\Zen Browser\zen.exe
  "C:\Program Files\Zen Browser\zen.exe" -os-autostart
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:7072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shortcuts_log.ini

Path C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini
Size 270B
SHA256 bc5d0f2cc21be7459dfd3e49a8715efdc27573522c43fa73fcbcb70fa5677ee9
MD5 e4f1d23e8751d9ebf88e3bea699b921a
SHA1 f79f76577ef4cadbebe97a8c0101462d1502f090
SHA512 0b7ba2c71482cda2b042c26d106d229274843d1c8f187f0ef554093f6c07fc5eb8b27ca2f66fd7d5cf75f2e3774ceb2a723d1e411ef4f39d5fbbe6e67735d659
TLSH
T11CD0673202E60329AE062F81EDE84179EBA6F999A09DCB0CF086061E1DE0840C8925F7
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 b74541f51c5f360d8d22c276f7a076f937472da97e11738c69ba2d436d14adda
MD5 ac17b5cb24f13107528ce6842f46833b
SHA1 e02b47e49fe35b2fb36f9369c39fade775371e40
SHA512 44254f93a1a34c2e636c0850a653b4f6287c29d561d5b1c97c682fa7d25bd5f7104074cad4448c16c3b90de1f5ee4ac064b223b5fbb20a79c36fddd415d054ac
TLSH
T1BF417F1057E65239F1B25E3286723E314277FC81E778826E434DC2890571020C5ACFBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 0940dcacd3a419748bcfcfc543d87e76f03d7169e4bc32f68754a5f077a5a7b4
MD5 b9d867557ce2690519e9a484b0bd1135
SHA1 a7fc7b37145e9060ccbc6994b3ee8d3dc2fafce2
SHA512 994ac260f9f72ef48a1ad75c218953a0b382ec803c1ba5344ddee169e307e879cb3545420a578f7a7aa4d4184548d09476f0a20e13eab0e1cf8328329601ea42
TLSH
T106316A1053E65238F2B35E3285727E304677FC82E779826E838D828A0571131C6ACFBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 922B
SHA256 e05858562dcf127f0afd71259c6ee68463dfe623325db0aa84e216c127e234bd
MD5 92485a4b68e10f967c1d4b996aa21137
SHA1 cb0150540129e7e4c91db363f9c422af24b62918
SHA512 4558c0e1a0965e96fe37ac5891dca10684d84aa0c4f5c7961f05f971e2813640ed44127a05b3917246472c38cb2a7c72070c262e441f7dd3296c6d3f57203cda
TLSH
T11C11850013E3572AF2768B3249B36E71967BBC42D7B8436E868902894CB1211D55CFBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 1020B
SHA256 9c1ca81d0090eeac1dc5f6fe8bc18b4222b1ccb705372137d615e833493a1fb4
MD5 69c0a0421cf0e9fad2ac247c339a3072
SHA1 0be8516d9ab7fa46807c5bd0e4532eed0f112ad6
SHA512 a615c3555489b00b3e15b39104cd80405b34ac20810d2f66a372e893121655a11c2da7b96ff5198208b9f0ecc45eee78681323b8c34763831d6656f3633929dc
TLSH
T14B11EF0017E7573AF2758B3249F32E32927BBC42E7B8036E828942490CB2110D45CFBB
MD5 SHA1 SHA512 TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\F0DC299D809B9700\update-config.json
Size 78B
SHA256 3f7b3252ef3b6217ad78adb7007738601ce1eebca69f55990b64bf254bd4fc63
MD5 fe74f5c38f433736ee7015868cfb159e
SHA1 f723b0032565fb3007407201963f7bb762bdd981
SHA512 19fe20baff40c195955a921ee2fe1927d00da14e0ed3eb683e5f6f026353bfcd5322a1d2399b8977bdf97bb23dfd6cc811c9a9494f019b6e404aff477316cafd
TLSH
T1EBA011800000A2A8B0E888CC00302A3E02888028008B2A02800A30A0383A0020A0A8BA
MD5 SHA1 SHA512 TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\AccessibleMarshal.dll
Size 30KB
SHA256 121d214ac9edab1b0a1576d3a5378b792a0e907ed249602999980e3b8f7524dd
MD5 26b2d15515d9d8a2ba7ed48dbd268de6
SHA1 78791f7fc3e51f233502fd318746b56ecd628f62
SHA512 7db67e02142c4eab79472b1ca001385a6b816950279577a44ab81e7acc03d10ba61dc332375bccb8a7b96f6494c40701496e4626e506bdd2387851427bae6e16
SSDEEP 384:w9MSlCaZ8nvlfLGeUMc25R42u46dWl2mNDsSofousJUKURFrt4ySE5v:UCaZ8v9Geq289VsheSoQuoaX4ylh
TLSH
T1E1D2E556FF0084A6E81D853088DF8AAA5E71FE419F9247C73254332E1E737C56F366A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\CoreMessagingXP.dll
Size 1018KB
SHA256 00d82aa7714f919ed2e5065f3ef6a69b15e1e1045c1efd06a129d712a46a4d4d
MD5 94884ff48a8b8e322cf929e360a3e776
SHA1 93008eaa60cbe40d82f0cef3216ae6177d8840d4
SHA512 dbb04345977ed19c025956d84a226a3a2bd864c2f1f43c511e020ac96ad4146fccdda7ffca90ed49df9a192bb52520318e52710f6f8bfe7e0a280ceda81a709a
SSDEEP 12288:3K/YDbkEM085HReWuoG+nQlb8ssXEBwDEHWqgN97TLA/i:3wYD4EW5OoG+tslbE1Lsi
TLSH
T1AC252B6B6FE88497D16AC27F85BB8A4AF2F1B8521B3147CF0451422D3F27BE45A79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\InstallationDirLayout.dll
Size 19KB
SHA256 2dfd02283bbf8516b1a04f9b6d6bfafa2f42a37d29f745c767ab0afcae2e9613
MD5 71ef960e1b848b4daf5ad6bb4330ac97
SHA1 7bc38248c99b88f4ad69a52951ca01149a043254
SHA512 448d333edfc4d5d20c6e5464fde39b81dab8efee034f8ff5c5e4639c0bd6712e3ea01509af7c85a5bf68b2347d5526da1c98954a709bb1c6ffbb5a462ea84cd4
SSDEEP 384:bpmCCN3LNn2d9EPu46dWl2mNDsSofousJUKURFyAlWeS8z:NjwtXGVsheSoQuoaue/
TLSH
T103926CABAF6054EAF957CA3085D98A2BAD72F7805B9041CB6219005D1F437F83F3932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\Microsoft.InputStateManager.dll
Size 438KB
SHA256 a08f280bab63b9c39ce453d7748aee8a430f5e321a1950d49b74661a713c606a
MD5 fa4c53092f27e132def9cedfbb39a586
SHA1 3861faab14afb017aef20e57c238838564afd9d2
SHA512 e72e937b574edaf80912b83ffdb23a1c1743f331290dbee95fa0424abac0b91954829d8ec5f0c67432372067ecee4c7082d9133d09103cfef8345e342653ea7f
SSDEEP 6144:/7ehrYmAQMd5vii7N+S5kExMnHqYnVHgXPcCiZm7kspEtknNRJ6SaoygS:yhrYc8i2kEanzHgkCiZm7xpEeNmuS
TLSH
T157944A3BEBA844E0D53AD13D85A78A47E2B1745907319ACB42A0522E1F3BFF46D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\Microsoft.Internal.FrameworkUdk.dll
Size 998KB
SHA256 b587ad20a4a74aead6aa2fedcea9ebd875be8de55dc8bf944d45da71664fd65a
MD5 130956e9b627245574bb1710d6ee400a
SHA1 bbd35748a99f63fd624a677f3ad1c7e584f3d333
SHA512 08afea111d9bf3d27701f2ab6da291e36a81f554256bcad1b79b74c3b94613ea2aefc7a9d27947e64ba88eb19e713585abdfaffb2bef8c2d03f942e82444337c
SSDEEP 12288:DtH9ImvHEvAGwCwxWtpi/9BtHwR/yZOCIgCyjx0O:BH9ImvkvAGwrFHHIzO
TLSH
T11D25971FAE7951E0C4B9C038A596662FF8F130E6873457C3D5919A0F6B32BE4A93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\Microsoft.UI.Composition.OSSupport.dll
Size 66KB
SHA256 139fff68254ecfab1143957b9abad102a8c4edcadd1325cb1296f1facda2a1e2
MD5 80af3ce5466269d5b84692c07158260e
SHA1 d08970b385098eb8e532d545cadfa99e15c8955b
SHA512 61e2e7ecbd6ea9dab3c2d763b018c60d82760147888304a1aaf12f900eeef03f38bf491bf7ab0d62b7efd3449713448136ca07ac5789ceec8644c623de330bd6
SSDEEP 1536:rDumBHbhIpkJau3shnIxWV4nkr06kL7oP3:rDuWhIpk9c2xXJ6kfo/
TLSH
T181636C55AA9830EAF536817DC0964F19D9B1F22153001AEF0364C2BD1F83BE97A3EBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\Microsoft.UI.Input.dll
Size 1.6MB
SHA256 4d3f81b9b14db075c77be4b37ea3659aff0869ee949f7c312018fad1ab7d817a
MD5 edab60f91a51b75ffc0575629c756dd4
SHA1 f365df652d9e66275cb44c576c6a3e68b30be812
SHA512 d6d31a6c2fd89b4f7816ae21bf33a9d388ce0c48ba18b69fac6ee13aabed07d52d63c09ca31b59bdf8efd7b21e293335b7dc71be3aa0360a42af9dc1fc75d268
SSDEEP 12288:GraZ6w2cxjd84cmRnINK8+3Dz85FGy0pm4YqNQh5tPTad4empehyek9i0C6jQG+h:CPcxU+3MmppmsKameH0CYQoqhIROR3kC
TLSH
T106853B2B5EA885A6D236A23DC0A78F4AF6B074111F7156EB0171412E6F3FBE49D39730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 230fa9253c78bc06fba0acb6c3dac1c12860fd6dcb2c339777b9d64ad8fec2ea
MD5 fc244740415b7c5a3575efa189084dc4
SHA1 7be26936039379a376ccf05351c9826203fa5aac
SHA512 65a75fabe41f6e6778a94fe457ccead9f859e455d0a010b5f135ec71c3d42b0ece525b4c8b1f3f8bf307c54c71e5a29fde8a10eaecd2ac0a862a15af291e427d
SSDEEP 6144:pYBt4KLmoxb3XxelxmrdoMvKnwxoD8onPJFA96RJitn96vs3iuM+6RgI:2ByKLdhsjIKnIoD8qA9yJib4s3iuyeI
TLSH
T1C9B44E6FA7E844A6E22A913D85978B09F6F174125732CBCB0121D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\Microsoft.UI.Windowing.dll
Size 538KB
SHA256 47442c240eec887fa80f1fc759db1c11633d44e11af18c8e32746cc7157a66c7
MD5 2b25ba15af10c8359b7f8bcadc994fd4
SHA1 60ffa22c73a6263c9ffcdf044903a614c87966d6
SHA512 a40cf7d5648612920a826adaa1282c90b40a6bc420b8d645a8e617e8ec2e0944ff677e3b9e50c62571a1828ccda987b028feeefc87dd12f41eae11d1fc1c5681
SSDEEP 12288:uG1XLiw0POe488HeqoDHEeKuOG6DFbncIfu:pXLiw0POE8He36DFbncIfu
TLSH
T18CC43A6EBBA44A96D12A813DC6A74F07F3F1B8115731DBCB0161823D9F27BE8597A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\application.ini
Size 636B
SHA256 ae6c007aeb744d9156dfbfddbae381f91ce8178b923dfeb04a3e6307dc1b759f
MD5 edc0ef831feeabaf6c44ba939f93ec10
SHA1 516db4e3f2c5e14448e0938cc33d5bcafdfdf08f
SHA512 519112203a853091747e04cd6239ea783bbba4f28572bb2343e57b7e239fc542824bb7bc0fffccce32a02ce458f35adbde6a469eca95431058977577334a7941
TLSH
T146F0DDE74344B4FD8EF33ABAA10046D0A273081C98EB342C50475008026931A2ADDBE9
MD5 SHA1 SHA512 TLSH

Submit Download

PrivateBrowsing_150.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\browser\VisualElements\PrivateBrowsing_150.png
Size 9KB
SHA256 2ee22aa49d12fa9146274dc5a03793fc45bb632bb341799542516fb17c142371
MD5 2b47f5fa099f97fb4b7d1a88aa494541
SHA1 eaaf09c44abcf6f7495224a3a3d8e651afe59403
SHA512 4e4e03b804c64085e701055f9b741f99b4715807682a7141eca184a6ad03fb7626c9ae6e9f74a6dd54d717330b154a68193e52cb97f66bd232f788c77ad01e9f
SSDEEP 192:379hCymCdj+pGzVoFkPc8Y1F266DMQdcv+mwI4NNR92uITz5s:r9sojPHQFVJ3wLH92uITz5s
TLSH
T19412BF20F215CF2E91743884A4CAC6C5D23B7217F7C02074482FA4FB1C2EF152AB5AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateBrowsing_70.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\browser\VisualElements\PrivateBrowsing_70.png
Size 4KB
SHA256 c348fb831e245763f6c1ca74e769599daf4b88d6b2487144a5a8a58c7172d9e5
MD5 f938a334dac97a3b99e020a4fd45e39c
SHA1 b476456542430be300a48bed22dd0b3c496b9920
SHA512 d2f490a4bae244ded37dd6270f01a24e461cc2df2852834133b7a38db7b3f46221fbccc8d66b33eb2237803174f7e68a7b65d28eaea759f990ead3a203674b67
SSDEEP 96:fqPxsxciKQQsIBEzEZXhaOec0AGHL5lYRTBXWAhh3+KW789+q5:fqJsxXQsIK+XhYc0AGHLSWArBSc+q5
TLSH
T1EB919EF983A10CEFBB40289FBB26A67DDC470D7590063234BEC155E32675A9E09E5251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VisualElements_70.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\browser\VisualElements\VisualElements_70.png
Size 102KB
SHA256 68e5025e6835c0142272276dba9a3f2ad8cbe6f6ad8c425882befd3146a9f7f7
MD5 a0ce9ccbf2dbdb3a3d2e044e0f74bc7a
SHA1 88cbe63c90dcbb5c9abdb48a983c4f153513f8b1
SHA512 6f7556d3622868599dd8f3dccbbef21fcd3c9a71349327f2474159a7131d563b176f940882a1c19d3cdbede983bcc436a7f61b50a7495a0a553c6d95e77ee10a
SSDEEP 1536:XqShEeITCdH1Xxi+BmgdUMhh3le4HQtOfRuWaGOaOK3Yf8QKaqaZAtyaiWNy:as5ITAVhXBHTaOVFOaOKjQrqaoyau
TLSH
T16FA3129A941BC481CC5E19B2486EE06865BF95C752264AB4D03C7CEAFCB917CC186D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\default-browser-agent.exe
Size 31KB
SHA256 39b2ab550b979b43fa93ea55a5de373dd2cef7138f1c87e62517a4cadc46637c
MD5 eb5a876a49be2cd545c8d7a7be3a7cb6
SHA1 ab537e56b7df4ffb081fc154703ea4590c32037c
SHA512 d4a67319f8adc8c4abd92c006c33404be37ca136c01d9b98738ed169cc2009332bb26cd96baf35a42900dc516e54c629bdd92169603c40cb9710fe302046e8ee
SSDEEP 768:6GfoJsEZp7DuPFHBWk0VsheSoQuoald6D:6GwJ5pmLWk06kL7oJ
TLSH
T1CFE27C63DE9040E5FD16D13542A48127EE72FB425F6252CBBB86026D2F31BE05F3A398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-prefs.js

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
TLSH
T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
MD5 SHA1 SHA512 TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
TLSH
T1C6900252006F40226145A5A1684D890C80186146DC9101901567260E16259C008D456D
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\dxcompiler.dll
Size 23.2MB
SHA256 1e807e2e482052409a96904b9fc8a600c487a74498849cc7f0e72877a3f8dd78
MD5 65bc3b65305ce21e1ac40c4c24127769
SHA1 621848443b6eee1c7fdd1868e37f6670d8f9a809
SHA512 82337eed0ed2d27e95d3225e37a6c97dfb101931849d4a870049c34f9d870b9d1f1dfb60b84e08a6823d9520317b513741241cc1cdf060391e09e242561e3a66
SSDEEP 98304:JjEvDZV7UaUdIFK9chWK6SWFMFmmqeMXgqZ7uAwkP32Z8KBu8HkUw7W6rNzaUjek:JjE9OvIF1GbXgAkkuuKRu5JaDVdPgtXZ
TLSH
T12A373B133686946DC05AC8B4C3574A278A6870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 dded8c3942e2d8eca65838e55379b1da5765c2dd6183dd5c3530c9976cb25a86
MD5 613815852a622ff9e54d697b9b3d2862
SHA1 a49149260f4e6d09412ce09d5847f15be65f527b
SHA512 64993969eccb8f75496b11cecab6f351a3ac659d8d6906cda2bfec8684b2d0d253f4c1bc23eefbec388939dc9ad0e898bec0a8f3e03c78d1b9c73d714fa5feb3
TLSH
T112F0C0DCB158130016CA6A556113528FB10F11FB46D501DEB0ED80381B8AB4C491EBCC
MD5 SHA1 SHA512 TLSH

Submit Download

TwemojiMozilla.ttf

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\fonts\TwemojiMozilla.ttf
Size 1.4MB
SHA256 6d90152ee0d29e82fe2a87793af5aa4b7ad13e6538360889e141e81ed299ee8e
MD5 aac75d901445bc0419d56e56dbc18891
SHA1 3ada434f3a727167ce6dce3b865fa6bfb70ed86f
SHA512 83fd92ff444ab6de18d48997247f49845abb8420a07b74ebc8a65bda8da69d28f87b6abe0f607b2fd7da398dc0f8cbe7fbf655af6d25785ad8b2f1a3afca136a
SSDEEP 24576:jUx1tOjzy675RUa0cHib00er/4TMXvBo2IvyCPKsUxJug7WwObnkBl0Z1koEXdwV:CeIa3iurjIExYrdz
TLSH
T1EF656C3FA704CBEEF4951AF6C9640A27B5D08D8522021287F74DF87F8C9D3985897A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\freebl3.dll
Size 1.2MB
SHA256 c9dd2697b0efb5de8bc0fd0080d5f192f42e147fe1d0d84b1803a8ed0694aea0
MD5 16f5208449679e32f2d54da49d6f31c1
SHA1 be4952a9a9b8d04f85daed5db496eb5650a9c0a6
SHA512 4a0ce3a9af2bb324f7ccf6d72eead7b6b6fb1ba23f7ec1043aa30d4159936027d94aadafcb50452c00ed68f4b714441ab7713744d711c614bdb4ecbcd2763674
SSDEEP 24576:swadqZH/H599XqnnnBnnJQ3KkhK8fUUxvflgrJ0qJfX65XP2tSV+hBkP:s9dqZH/H599XqnnnBnnJQ6khKegrJnPe
TLSH
T1A4455C0BE6B64794D0A7CC7C2356B623F9313C9D0A1576E35BC485213AA0FE4B329B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\gkcodecs.dll
Size 10.5MB
SHA256 599d1fcc553756183c67b8c5d623943b698d33448ccc40d67459a1fdb854f977
MD5 94fe5f826f84f981dd2278fdce94f208
SHA1 f93a00c0d86fe737808ea6deccfd6543c6c2691e
SHA512 eff397ba6a99fccf45aefd7bcb5e05c12fa7c5a10ed638d8ef92bbf5da7c06eaa223fc6c9fdecfb201f5e494131fb239a41532c7cf8b81b2e38f563c842cde5c
SSDEEP 196608:NvU8UiUCx7Ci9nWLhk+jrOH/8jJ0kyORIo:VU8UiUyCi9x+jrOH/8jRycIo
TLSH
T151B66C4EF1A351A4D51BCCB4927DEB12BD18385EC31856E737DA19243AA3BC0AB39F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clearkey.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\gmp-clearkey\0.1\clearkey.dll
Size 111KB
SHA256 c28f7683b2920ea009364d1c6f9f576085e1996c9e94ae29184c6e1a053b4193
MD5 7c02949a04fffc0dd1906024516891dc
SHA1 23a3c4b4d23283ecf119eb66623acc6b84263b6b
SHA512 6bf7867f660db915d5339835077dd0282dbccf6b5628f6d1ac70741f992a075e36cc927637f47ffc0a5e8cdaf314145920cf35129dc24cc9608a67e6c512d81b
SSDEEP 1536:AAX9K3NW/s1fyVBCKqh7onxQmyQ5ANNyYflRkGwtf6kL7oP:dX9UW/c7wXyQ5AfyYfHrwtf6kfoP
TLSH
T167B33A17FA9A90BFC189D97896474802DF62BCC6475276CF53614E9A1FA2BE46F3C300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\gmp-clearkey\0.1\manifest.json
Size 229B
SHA256 ef47e83036753b53f59d079fef62bfedc749abdbcdb0fe16f448d9920f11114c
MD5 cffdadfaeeaaf0a5a78e7f9a299aa7f1
SHA1 7a8f06d7c91877484301ce8474dfbb1bde08a040
SHA512 5a11e448389326ddbd3be792d9a10ae746c66e4a41f9c96f4979ec71fde385fc4deb205a40f1b4f24415abd9d41c453ca1285f4b813005b1d12a2701f214db85
TLSH
T100D09214C812DEF33CECA2295D554D5867A9129B19823C847B08174EDF599BF92AAB0C
MD5 SHA1 SHA512 TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\installation_dir_layout\versioned\InstallationDirLayout.dll
Size 19KB
SHA256 b38ec234a87508efb903ee7cc18052b9a2e04fd191906efb7b5e994ba7741c7b
MD5 3dbb9871e422935a43b74599085f007f
SHA1 d35c47f4291fba754ce700481e8f96b1dfaafbb9
SHA512 dc136271ea769b6fa8a0882c8101422980da7bc83b29523fc0574f702fd67526dc31125b3ccdd5fb1e5185cdf647d3d6728131c911443146004072901decc44f
SSDEEP 384:ipmCCN3LNn2d9Emu46dWl2mNDsSofousJUKURF5G7TSKzR:MjwtXtVsheSoQuoaC7TrzR
TLSH
T127927DAA9F6494E9F95B8A3085DD4A1BAE71F7804B9141CF6218008D1F937F83F3932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\lgpllibs.dll
Size 161KB
SHA256 ea783c3adfe9bb31b7f8272db407cd57eb989f9446597833da43dd66ff185223
MD5 939396ba6122c8e81d5efc87f79db9a9
SHA1 e6beaab7ceacfddf12c8525d944d632e87d16f64
SHA512 07e2f109be4da55f7e6c4d3cce87b33807977a31f6fc0b80eaa243d6510a418ff33e7d308eac91b615d2efa81a1a0dd2d342d74238670877a8d2279321e851e3
SSDEEP 3072:BBKaYdDVNsp0dBfLxzrJSz7vsFLucm5z0OLa9xDYYqnr3S6q93EduDoxWv83cJyY:BB1+DVip21zrQcqbLa9pYYqnr3S6q90C
TLSH
T1CCF37C25D948887AD43E8C748DA68B169B6E7D8007591ECF4BD01EA61F17BD06BFB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\libEGL.dll
Size 58KB
SHA256 7f4971b446d9487ee0254484cffd0ea28ae6e248252f53daf9efb1b8438b6279
MD5 bc1e86a1c8224e5d885096e176fbb797
SHA1 6c49620858aa17dc28067d55b9b855db075765c1
SHA512 d828c1e6a879fa307e2bffa8d0b7ae63498dd15f266a730d0f3f1c7fcf1801b5aca3e119990534cef3b441d672ec61a8bed006337b8e349ca3c9e27d61db2df4
SSDEEP 768:rW4xqn55sEI34ZMsHt83mxpUQbERHoxCh0VsheSoQuoayNX:K4xqHsEI3q82xpUQYRHoQh06kL7ol
TLSH
T176432A3BCD6AA137DA0D4DB0C9A30816EDA1BEC58FB274CF67240DE50D95AD8A778710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\libGLESv2.dll
Size 4.9MB
SHA256 4febbaded2eb8a3e61918c19704eb28e25f88f7287298cf5be087dc0ed263423
MD5 cb941c15e5886585589b5e3c4e93c2ef
SHA1 fb51008fb15ada408895377608ef5d6bc03bccd7
SHA512 ba73d5342374adde8607f50db186d703160d0d0ed3b06d425ccf7aa50e93ae07a907ab0b6c82cba4810de2f0c718c641bddd250bf6d24f7885179cb2f9c363a2
SSDEEP 49152:ZKw0LVLtnjLHQ8uzTOAIdzrPUKRWGaTFy4nsu1EznppGbaFhioQUSHvA/I+q8mTl:ZKvQTM5V3nNG3HYwOM
TLSH
T111367C07F6A140A9C409D275975BD633F636B889031572CF229887363FA7BE06BBD724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\maintenanceservice.exe
Size 267KB
SHA256 6f689ba4e1a831b6a7fc5052231d29695163e6b666a3ae0b2792558aff123459
MD5 41787f1786a3b2fc61f505a40014acf8
SHA1 0181262bd8c500e35f4b973b5a7e0fc851ad1b07
SHA512 99eca5fb3eb58469340c367a3324ca49b5e62048d7c37d5d7bcf3c817174255114f9d56ac6efcad4184f9b35cc45c6e895ffb0c81411190a0cf3903ea4193774
SSDEEP 6144:EG6HzNc9dZGcvLnNUYBHCBFBUxpzSJ/wjEPqgZB:76HzCbZGYLEBFBUHz6U23ZB
TLSH
T124448D29B7A44DF9ED67C23CCDB28516EA7278514360E7DB03A489261F233D05E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\maintenanceservice_installer.exe
Size 181KB
SHA256 ab03cd35cf73e250bf141f23cee3c8bd746962445df5e56c330657b481a84a4b
MD5 6beae828893bde753dcde609acc14d09
SHA1 1b2ec3f84afb49bfbf96fc04166e4f428433f980
SHA512 f16416ba3c8074bd33dcceb6077b669444fad39defec1ffbdad9ed7ba9979a6da8b37445e4e7a312289c83d3bf2d01b5751394f68f5278132bf8fb54af5d6648
SSDEEP 3072:eNRCywDw1DiJku6UNRD5bwidRjem7y6tuU/RDObU7y4jem7y6tj6kfo/:eT4DtOUjD5pdp9oU5DOY7y4j9xg/
TLSH
T161046C01BBE0D592F9B20A303CB79B365F31FC666E90874B6350B35CED72391A92535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\marshal.dll
Size 494KB
SHA256 b9cd8e3cc49dc51ad25f1610b418a26a02905995d9744b72467141f712078bb1
MD5 fe422664b8186cb5c6c007a0b3b64f96
SHA1 ab08b6b3e51a9abd4c4dbba55c536216fc637a17
SHA512 d59ae6b8a2ea011c1a73b3ccf600387be45aa2db5c29226f8e401cbd0df43556bea187b8d80074099925247ef0b96d5702daf9a5db5eb052faf850fbee96d285
SSDEEP 12288:BJrGVEF3fk5Q+fAZmXRZnFh1LBztdyNSb/OwYq:oc3fk5QMAZmXR7zLBzCw/OJq
TLSH
T1B0B4084FE96408A7C466807D8567870AD779BA9503D686CF037082AADFDFBD42C3B718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\mozavcodec.dll
Size 3.9MB
SHA256 1906a34be242e1b1bee22184db87c641df496da2dce7b79dcf6b99615f1c21f5
MD5 cab1184898216dce2c201a5917de938b
SHA1 149c20d7f64d7ce12ef26ab8f08d75d378a833a8
SHA512 02380e36604ffcbb8ad66ced0062cccce436d7a748dd539e5fe907a0249c4a80b1c9e24f3fd626300699d331f7f38220ba0932f6c20cb677c09ed3a5624fa4c5
SSDEEP 49152:QycVTPB+Pi0CCVlu/AGan38J+WkqacT1TO288jdlhPZZVz14gdmdKiSwMTqkQ:pfVlean38J+W1acT1388jlPFzOdWI
TLSH
T10816AE4EF0A341D5C50B88B493BBE726F924345D971475E717878624BEA2BC0AF3AF48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\mozavutil.dll
Size 590KB
SHA256 8c59f55115bd3f9b6cabad1cad0fbbc1f69b11f0a8173b996f3ca853b3471717
MD5 85e662e266e4f9a50eb142e431723978
SHA1 3300ff5ef8246c9c9f496f08f9d932bac9ccf38e
SHA512 ddb6e0a9d3ab22e143f6c2b78e84f0718ddf1c08e85f7775f87d7e997e5287a44f94c2580363ad245bcf2057c5a0cf1acc781f75e061485417b3f8d24d6129b2
SSDEEP 6144:w2zVnDgkrZah/JcK6H43AdOqHtFw7pIl23ESt+yEECgxnY4vhYGG23e6CQeQJ/5c:w0NaR4ZFwdu4ESC6nY4vhleQJxvMh
TLSH
T1E7D45C15E6C2042FC4068575879B6525F3763483CB95BAEF339209243F28BE17E7AE36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\mozglue.dll
Size 705KB
SHA256 af6112c9306ea647ec0b8aae320fd9996f7df42b96931b057d67b29a8e0e79cd
MD5 3772b93a20c62e2206369d0c3a0d4a69
SHA1 ef28a1b83a4e280497014bb53d578557fa3f1b9c
SHA512 0015954b2667c77585e06e13df5c12a4b04c1ebdde94a2e3ce043f86e62acf85788b519ae96c0b04dfbf9dc8b0485a1ef457172388975c049ad8ca25f7e78a18
SSDEEP 12288:+kFCWh36gTu6/YdoOg8zuwI/Cav28rUnwrIgd7URkYXq0FR3OKsGFKTFH+:+4/h3lS6/Ydo38KV/Ca+yUnw8U6kYXqC
TLSH
T145E49D03F78640B9D048D5759B9BD122F9B278850720B9DF23804B263EAAFD47B7E764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\mozinference.dll
Size 2.2MB
SHA256 975804de88246c8089ab4922d4604fc0b5ec63597fc9f29e8b0554fbf81739b9
MD5 cfc765407d6ae8ab8fc98b583b17c369
SHA1 31e55a7a5a59932be22117c01a479e53da9f1a00
SHA512 d4ad2e526fa536487f67788c47b13b413268c21d2b411760f9f17e6a4ae0d8c0e6b1be152cc393e1fbc27a2604dc35aa148414f5ae2535bbb5d38ccfa4dedf16
SSDEEP 49152:51bRpS/O3AaUP3F0JIyF/yDGZuiRpHbclYV6:5LA9PB+D/H4lE6
TLSH
T1B0B55A23FAA081A8C09AD1794B49D633B675B88C872539D72F544B513FB5FE02E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\msvcp140.dll
Size 530KB
SHA256 f3ee3aa7b355359a616ae5f8c8871420c72efe3af79fe6f577871d8b3056337d
MD5 85201df697257349d3f9cec3d7772176
SHA1 8509b44cf6dd734183939446bd9639edbde33f64
SHA512 df57fde8119279d6c6d323e52211e8cd60959be49e66d958bf7ffb55b37de549b8e5472c0c4d9476f4514907d2009432434c253a7be54493103c345019075c10
SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV77B:K0p1F/IiQEKZm+jWodEEN7B
TLSH
T16FC41A23F75906B0E195E3B8A1838302D7F1BC598322E3C752EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\msvcp140_atomic_wait.dll
Size 37KB
SHA256 90791767a188b565e136da53588cf5443a1b0c86b67ed5a6a51665db3dff889c
MD5 ddac04e4eaed3ce0eddb60eaf27efe79
SHA1 a5296465653965384dba22dae4939b422fcb95be
SHA512 ae1a023b9e995d401b4a10d6f928b8ee8647a94e84deb3b02f2bfd05c041e9844aaaaa23953541780aa241463748e6ba73578ca75000734e0bddedb3bead13c8
SSDEEP 768:9PMo5RIqKYwIgMhpLDQl4wFbZVsheSoQuoamfkt:iOR+tMhNQl4wxZ6kL7oPg
TLSH
T1A8037C19BB5804E1F5568B35C4E6122FDAB2B6E08750CBCF2225558E0F93BE13F35B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\nmhproxy.exe
Size 654KB
SHA256 94ee5de6769e3d7cf2447436794791722cd66998dbcafd73c35727f0b223333f
MD5 b454fd35dd11e8bc82668369402ed30c
SHA1 eab147458738a0dd1cf014a88c2e9fa1e3fb3978
SHA512 68562509ac38a38276ae0f40b9d15f5364088888cd3d9b40ce3c27da93f9e6868f81bb376d47a54481beb680be2181dedd13f9e2cf5a0fd1d0ddba346715e4fc
SSDEEP 6144:RP62NeH2RDNKsXRIS7IOcu5Afu+oPB+C7PZYS1vUOq0oUTqkv/wxIokNpIVszzpy:B6GeH2RDN3RdIA2uNZ9szknwCoefFMP
TLSH
T1BFE44B53F64684DCDA6BC07D861681326632B4CD47306AEB21986F3C3E6BED21E7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\notificationserver.dll
Size 59KB
SHA256 5cd25c53f5a331a56e663b85da4d3e0e8e70f97106f8b3a10243dbfdfc62a336
MD5 227860dbe8558ef69382d579e6a7c655
SHA1 fb77238b0fb5f64f64310b5b997cc85ce3c94b2d
SHA512 a3f2a519887b09bf5d5ae4ea6278198d24cb4547c1c2e017a0c27af269798d0eeb61dc375e9889ba55150096fba3c9c50f04b7772d48e562c6a76e8fc58276ba
SSDEEP 768:6ISMKPubs1ArYWz7hIBIcBTad70B0pnsyWdOddOBSQjo8xVsheSoQuoaiFff:MMpbUGSScBed7i0adpIQjo8x6kL7oP
TLSH
T193534B43FB9500A8F9E6C778D2AB59129A73FD49473161CF0381812E3FA1BD0AB36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\nss3.dll
Size 3.0MB
SHA256 688dc04be6063384e3e3c23813dbac20aa62b08055bb40c7df315160e386a039
MD5 6d123d3a09613d6614d1acd6c932054f
SHA1 1154636f58cdc3f210e113bd2f4d9ad6e5d17e53
SHA512 0403c7acb1ecf443131518df1c1fa86fe0fe84f04ba379bcc13554400f4c82db5d007e04056579a43489dcf9153349b5178bd10a77935fee41bda31abb20cc47
SSDEEP 98304:diEpceLlZscxRJFj3+bu0HpK0G2QhZXtan:MKZJtOy0HXQhZXtk
TLSH
T108E58E13F29510F8C429C279979B9223A6F2B4455B3876CB52945A153FE2FE03F3E368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\onnxruntime.dll
Size 9.3MB
SHA256 b599ebdf8cf762cdd8f1c9d634a54ceb50ceafa9d57d3556aae7a9b89bb720f6
MD5 99e7c1cf5943cbb7cacce34cb14ff906
SHA1 205c517c353b4c512288fbc9073beacd159c94c7
SHA512 5a8c920ddd260b8e3198189abcbaa7d71866b99af516a53b0b4b0f700bfda61612ee8898e3536470d02749028824686e6d6a3e7fac5da1d376d8fbc57e5e0efa
SSDEEP 98304:anqhXTtRrgH/kylO0NItAgFOis1rIzCgBlccEVcBl9M3t04xyW:aqhXTtRrgH8sNItA1iFzCgBFEVQ9qxV
TLSH
T1C3A67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB05E244912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\pingsender.exe
Size 78KB
SHA256 6c820717f7713c20276ab62fdf456637aaf02c9bec440109737bd8cc612392ee
MD5 17343047d04ce9875afe2a4623c48cfb
SHA1 a5d6cfbfad3a1c4118b3b0bf3f785946bc8684aa
SHA512 e9c7e53b88c054385022897d7dde00728669647296a1efff73802e5a336e0eaf60ccf8e0de2726e14e577b5cb06ea643a9d4313a99435dbc4505d22238c23a35
SSDEEP 1536:qUvOB/Dvszw91Sqh0/ZBxRhfRn6dhitZF86kL7od:qUGYzw91X0//Vh2iDF86kfod
TLSH
T18A736CDA5A2451F9E451C2F0E2EB1313EB667688276666CF938452623F037E01F7D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\platform.ini
Size 158B
SHA256 cf2bd309dd835f4ec46c679216e4c8f87fdb8af422d2154203716358461a6b56
MD5 4e3d0fbfb8e3791c18ae178265886985
SHA1 ee31894a9d40ae7b4a6abbfeb9755ecd51a9fc97
SHA512 91ac50aa246c1fb298816bbf54f4adf5416c88bbeb9906dc43dd15571c3bd46290b6aed1884aa0037b6c47c1821abeddb91adb57649bf20f48d22423dee30b8a
TLSH
T179C08CBB254044AD0B953A83C0A18289B19B1D888EDB6018F04661040FF600A8AFA1BA
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\plugin-container.exe
Size 138KB
SHA256 ebe0756743fd121dec4f447855d66594e07f26b005a286644f2c5df3bd32d3ee
MD5 631a32473161d5ea53a8a116b49bf65a
SHA1 b98be13517f838aaa82a453f82d96c7243a27b0c
SHA512 b71f4dd7acf79844102b34216e1f9815e8f21cfa49abef2e517fd3c323eed687a5779888936e0d28e68b6509ad66f38d330f1363148837e25f379ea4b16c6043
SSDEEP 3072:4Rv5BY9pJNMmwVY3L05VXVYXxpByfCwXLDRH46kfof:4RvnY97aHVY4jXVY/wfxlOgf
TLSH
T1FDD36B13FA0950FAE559C974CA824512DF72BC820B60B7CF27981DA12FA5BE4BF3D251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

precomplete

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\precomplete
Size 1KB
SHA256 fff279de7ebeea76df77587f28ab0da2ccd17117321d03a3608963dd09dacd9b
MD5 b62fbe944bf582825d7ba940c0b281a3
SHA1 3af21176421397c28234a72c4a7ecd1d95d04b23
SHA512 3a6fc011b7fd16f6316a54ce95667b8fcd789509ff3bcdb528f603a0af7df442faba7a9c50dce5fb421a3d0228de217f8b740ca8dd4ccd0c6dcb8629b5f8200d
TLSH
T1FD41F38CE06EEE2169DA51C884D31D8F3DAB42A6DD5DEA781EC301547FE35EF010D62A
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\private_browsing.exe
Size 132KB
SHA256 6c5ca7e12f53b777e038571a1b81ce11f742e2c0c55e6f6714acd665fda13412
MD5 313f07c84f38c75ad1e00cdee44af40b
SHA1 7376e474419c2b787518a230a09dcb2b0ca3b8dc
SHA512 b26c03bfbd01f3950d9afe59b7ca71f3053003b16ce93e088d8e06dd1da06b2e9f82e6de244b2b097b147353a336288b6d9046c4df57aff82d5a37089c72818a
SSDEEP 3072:Nzx0RGNqFx6m6N3MbE/66TsnA7FBH6kfo7:NW2qH6m6N3Mbu66gng5g7
TLSH
T128D33E8A9E858E57F07CF17E45B64D35D55AA60F230051C3BF3CAB83EF98B94282D606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\softokn3.dll
Size 344KB
SHA256 936a8de8a44028770ce0ed1c8bb69d924ce86f41cb518a9f9c29333961dc1c2a
MD5 d207dbda8da4eb24d22e78e1374cab1b
SHA1 d5503bad07024ca934aee75130ac437c1dda6462
SHA512 85e57169e1a16b8290f6d4b3d6fd262b0b5ffa2144355da5c82f4e937a2b8f21422e79aebad0854bce3bc64c4aaed15d9a4083941ab91692f5c538433fa69a66
SSDEEP 6144:JsbOGEfMVM/RPyZnjecaz251vC1r3H0Fc6yFPdUEdE2uoagY:KOGVnZxaSaoF5WFUEdE2u+Y
TLSH
T1FD743813F795A1B9C814C17492579333A6B3B8580761ADCF93648F2A2F60FD0BB39B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\uninstall\helper.exe
Size 1.4MB
SHA256 1cdbb0b9e9cd0b2a3eb57499e7c55f2e19b188086a10d070ea3b0e56be0ef951
MD5 4aec342a1b8b03a87ce69d47925347ba
SHA1 84f0741d7df8a46ae5312dd5d0fbcdbb5c4a1546
SHA512 d94a173f7079fadd76bbe47721a2b8b20e87d57bdabeb394adebe86d742a2aa655098505263276d874c32cff1b472f7519af7bcc6a6298cbfeccd44f0f0f78c9
SSDEEP 12288:UTyUjD5BCLe9euP+bnEPsSjlSoTUJDJM95+B7a2SooEPdN:UTDCLChmbEPsSjIoZ0BW1oZPdN
TLSH
T1B0651803A790A862D46E6D3064ABD7153B37FD822E7186473B1DB39C5F73340AA7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\update-settings.ini
Size 116B
SHA256 17224c6040c70203f9228f35c345ba7f72e3be84ddbada6fb8f971c701e87e30
MD5 68acb4ae209a1fe7910b85a3c43c5cf2
SHA1 c70a6335fc65b17453a88e59bdcec7a067c94cfe
SHA512 3bd99664ce6abd681bcf8c089c7db5759eafd165d6f00adaa8c900f7b988e98cb99342778e90658ffb17660ff95023f49f8efeac28bd7c366a208df6c3e1bece
TLSH
T191B092895A94A84C8113C462EA6D022305A2C529090521252748E441B3E77208ADADAA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\updater.exe
Size 989KB
SHA256 00dcf85fb52c6a0855eaf7ba39f21ef1525a4ff5d3c422e9426d41f5647b3f87
MD5 84419a175b304338efe16afddd4b841e
SHA1 8b709e9447bc018441b8c01a2a9d2ae91bf5a609
SHA512 b600a451d29a5faf212488767253154a53fe8ef6e518b827faffa465510970b8dee5ba94af3fc38005b5f900cc2ab49f64bbda9cf6bac849c4bd228c83e4712b
SSDEEP 24576:9Jr9+ujei/BAfazWS1l9f9qzxvh0lhSMXlp7pJ+RNa:9Jr9wmyffkqz85go
TLSH
T11625AD1BF79440F8E85AC574CAA68513EA72B88A4721A6DF03D48B552F73AF01F3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\updater.ini
Size 1KB
SHA256 a6d81b46188b52069c2582dfc6b4d682bb722c2436cf5f531fe6ed0c94952c9d
MD5 27a5a5f5ae9b41546c9b6c7a0eb6f026
SHA1 21dcaed4a05199f407230b60fbc554a23e195f33
SHA512 a6208e3819debb7a169adbfec9a426570acf5e8117258dbf8faea4d886c923007e52cdb3cc46028878c3aeb810a9f7b9482f92b1f77b5899319a1644156b11d4
TLSH
T1F62121562688B3F409D29B85BA4633D6D78381ED23513120A0ACC160434793547FEBE9
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\vcruntime140.dll
Size 110KB
SHA256 6b7cbaedc4be00d09e780ea67dead9899416bbe9b29057ddad8d4ceaacacb196
MD5 9d64a82e22618592d47252d350c3faee
SHA1 b44f4bca8b8a75e1572e2a35cbd0829374a464fb
SHA512 0d126842d0808645f4bceccfa8ab9bc5741de62ce05354128cba3847b8547660e50b7b70e032cac2dfc54724a2cfe7319bb374ed9ec39edb2dda4e627ecce15a
SSDEEP 1536:89pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lg6kL7ox:cyA+3EOfmpcGSdOecbeQ6Nxg6kfox
TLSH
T18FB35A4272A402FBD16AD275C1D39E6BE7B2F40587649BCF07AA46660F53BE02D3D381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\vcruntime140_1.dll
Size 36KB
SHA256 e61c4b65470606d9f135247b699e99354f38cdce185f3689262ef1f8440eab3a
MD5 71011f805977297dcae7374ea0af3e37
SHA1 0754da82b7bbe4187775f63e9d032eb99f1faffd
SHA512 00e15eead6aef7958a0cf0b5a715f8ea59fb22862a87cb05f648d508471d9dcc0e9376b750df88e6be75b6552b4bd459c83f91511387e0ed298b4ac9917e1a58
SSDEEP 768:mezSkbhNfI4fWLZyS/dPWxuVsheSoQuoaK9jxM:RYZyuPWxu6kL7oLHM
TLSH
T1C6F26C1697A840EAE4A7C670C4EB0E2BEE75F590976083CF2E68455D1F137E06B3D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\core\zen.exe
Size 863KB
SHA256 3f5677a811d23a1782090aed57b1ebc36914cbd3df024145f95f32e4878de879
MD5 abed4bda82eb3b6a52809cc705546b26
SHA1 05b8bf32477dc52d05290f12a46e43b727358794
SHA512 1e8aa7588e80be08aa1ce80deb2141ed230fc2d252238a33956ea06e23beacfe3ece6fd88fd31f01534e5bd220009ff916727bc0bd08ca6dd31f08dc6ba5284e
SSDEEP 12288:Sjju17LnFxtbejxGA8JfqZ1JjCMRIIO5wbGYbG65bvngdrXfKv:YjuNDFarEfqlWMRIIO5wJUrXyv
TLSH
T18415A212AB858C7BF078C0399632CAB5D5267C4E83D051C73EACBE633F75A9016F9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B534288\setup.exe
Size 1.0MB
SHA256 460ffe364a15c9894908b5867eac0c8755e9755011c0fa9c6ef66d0865cb89cc
MD5 f48cd868eeb27d8d9ca3da1e93a4e2d0
SHA1 4ec7b63a3b0d20149e535970bdb80a61b1f3c290
SHA512 45523a9b72b7127d6d559f7a6d692509368281c520c14d05b4ba702cc7262fd67e455db2df73e88b1737f46cc17eceb8d8e289ddcb85062f8ede061ce40ee765
SSDEEP 6144:AT4Dt1UjD5URVN9kM9es0mPH+WSnEP+rdlqSB9G3So4gSe:ATQUjD5URN9euP+bnEPeqSjwSoph
TLSH
T1C135F603B790A422D46E6E3068B7D7553B77BD822E71825B3A1DB39C0F737409A7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecff3ad9-fd4d-48ee-91e0-056c8c646dbc.zip

Path C:\Users\Admin\AppData\Local\Temp\ecff3ad9-fd4d-48ee-91e0-056c8c646dbc.zip
Size 3.7MB
SHA256 fa4bb42248df1a52130e8be56d582f50e1ab0bdc25c23f6d9f7e828a1f4045a8
MD5 1eafccfc48eb1e70528e63d20d6c012a
SHA1 43c571e55fba742938fec9b6d3fc9958f6a518f3
SHA512 9546855a178ebe36645573326dd6fbb5b09cf4453d499a5239a52dbf447555877b005fc36d0223541a838c0e459b86f76f087187bf1d53138b2d2e9f9e86528e
SSDEEP 49152:lhXF3Mp5f9e1lmgt+m33JFb35sYNg0BoysGGvK5qUC4GSoaHDxcOkBhMOSMLsUW5:lhXlmH4/35jVEvK5JC4ZHxivLsUWwCJ
TLSH
T1E706DF35D6DC1F08C98F83BA873C2F82987C4F66B057AB6F6A6E9D715CA31D21B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PinToTaskbar.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\PinToTaskbar.dll
Size 3KB
SHA256 6bec8a69845fe9012a0622e79b63328fb611151fd24f198a779d781a36dce5a3
MD5 70016ab449dd0034333b0df88193cb82
SHA1 add0b693b75f14e7f9a063d0de1921c3bc8d1a52
SHA512 1295dbe8596a37d0799b51c3be011b2aeb499d382bd860bba784dbe5a580f6d2e1116830c4c619ef32df9c5f7af0aceb600c2c7a29e321cf8e355c73627ffc71
TLSH
T1297162F3F3644076E22903B84847C42CBABCAB1213AE4697789B611E2E50CC579A3D92
MD5 SHA1 SHA512 TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\components.ini
Size 602B
SHA256 f1505640e352a1748d1cdbc6eafc0ab21b0de520c6ea6b750d6eeb41b868dfe3
MD5 637a9a06841221d166843d55316167c0
SHA1 0aaeb03991f6f828af3b90f37e6c73ee7b94e6ae
SHA512 7a3215326798d9682a8fc2eae643d47314c971f5acda4094d1e9daf59defcfb36e3ea86ccbeb3426160e0fe29fb6339c9bd70b52317fe8c1b42ddcf3b8f106eb
TLSH
T1F9F09A472AF80418F4F7B709FEB441718B393C45583DC50E91E1080E48E4A808877BEB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\extensions.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\extensions.ini
Size 630B
SHA256 0723b5d0c55354754b2084b712854c39ca089b1d883de067ac3c20935808397d
MD5 940e15a3691292c513f015e351f33072
SHA1 0545d9d43b188182988195db8a01fcd3ff43afc4
SHA512 cab225845a6ad929b643f3c6f8e9f1b8d0e7f0b19ca7ddaeb6350c508e9d21294749077ab3d041facca1d41578b2434f0faa37a5bb64f1ab1ddadda0edce4b75
TLSH
T14CF06D532AF9000495BABB04FAF581718B357C855C3DC90E92D0094E0CE5A818927FFB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\ioSpecial.ini
Size 1KB
SHA256 f3744d8159dd4b1c4127eb39bd60d690e0c4729047aff760ad6d41ebd4151e89
MD5 5e70f6d03821398c6332e9292f6b109c
SHA1 fa1712c879507ffa283ed93aff057f704ef64a23
SHA512 72550abb5f52962c5b703477250bb9b444e32b377b4d80a1937d337c364f391304d8d2735483dcac34c76e8775f6824d0f49cd3964ff644995f9d29ab15d8616
TLSH
T1CC217C032EF95024E2BABA48EBF4903697397855582DC51E91D10B0E48F5A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\ioSpecial.ini
Size 1KB
SHA256 3848b6f7f298f8468158d7b9b4fb08f8f93f9b3a86851de328f4e7a19695279e
MD5 1d3859cab0d42bf279dec2077a540d3f
SHA1 02dffdb13b1b6dbfd9576d95ee6f6d8f687f34e6
SHA512 91ee6ac912a6115a255794495cddbcf66646bb914f41e4b11b8bc886916c32cd7aeed1c49b5cadfae81a8c0449c23b87fd8114dd11880564e2634569f00ee18d
TLSH
T1CD21AF033EFD4428E2BABB48EBF4513597397855582CD50E91C14B0F48F56808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\ioSpecial.ini
Size 1KB
SHA256 7dcfcb07eb3d5258127458d40d5a99dd37fd13fdc45f3b7dc654c89581871ef1
MD5 e82780ef1a49eb2459ac22039e7a2393
SHA1 071ec617c45933b628f0fca4212b6b32e3d22c60
SHA512 c9c2aa84e1dd229c00ad86ea5a1fecc8fb60debf7b26982987be807a0ef4233ef3c19dbf1e8ea7c5458f6a4e88050642a941927a7dd459c2f497fc08f1240496
TLSH
T13631BF037AFD0514F2BABB54FEF451799B3A7C56A83CC51D91C10A0E09F6A408923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\modern-header.bmp
Size 25KB
SHA256 689ea80105f4e61ffc73062516c7d7053f92bae0c700c0673c3a9b445345df1d
MD5 cb1c4da8daa79279041011b85f48c3e1
SHA1 40496c445e18eb28686ef1efdeacf39153a91062
SHA512 eaca5a8e4503c3b62a3b675de44698af80952708fc4ef19a1e0174e4dfd5d6d4af3a3a9f02c4c8ae2c8fb257ff15fd26798d5dc04cfbe727a2fe7050491ee5ae
SSDEEP 96:aCCLLsFslQUlQhMs32QcJYQ/KgGvpNgFtQXPFD2ak29SiD0bFSCxPw:aCMLsFSQOdINUMD2V29S40bkCxY
TLSH
T156C26A110F8E1647E922B2AA323235587DCACE0D56F34667FC0833CE8AF701C2A352E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\modern-wizard.bmp
Size 201KB
SHA256 c03931e6f022e29943d410030595712a29285c1130537d552a7804845a07eca7
MD5 faa41c5d172376cb31e0bbee19d332fd
SHA1 eef931a54b02588e2ee9b202bda14a612cc8f423
SHA512 b65514d05512cbcf27c5a06b97a2454f66a58a2edb081fb1949a0d91d3d9a47c9eabba6dc521566ec44b7fa7b7a863d4bcd6d5bb01a6633d978441b6bf624ee9
SSDEEP 384:sGiFLVfy3SqviWSlk75o3gDVxYi9eFQthspiapMjuqh8fLCG8YHwDT1bmJ:t/OiapMqB
TLSH
T156147F8751C424B9323C3E4292AFA80974575481BD3DBAB63E8DA3634F938E78B3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\options.ini
Size 1KB
SHA256 fba4cfe357d29168de21e4718f15f070d08fc0241bf771d5ac9f6373979de176
MD5 15ed0cec8a172e53230584b54b69f882
SHA1 f58239eb5b9693b4baccc836f901416c2bc776ca
SHA512 620e4b83a1d2d5eeca2cbbf47874a97889f035a0341bd38aa07be7aac41d283a5cf7b9b86f1da60df0ea0ebef64e14d5f6eb76da56c40fc36438e804068753e4
TLSH
T1AE216A632AF94116E5BABA08FBB581309B397C46583DC60E82E14D0E0DE57808477FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\options.ini
Size 1KB
SHA256 6c36e64352d507462bb6f4b2458affa3fee108aa0986533e3e8a62b3141da1b3
MD5 e750599d20f29b4bd68efd238e326e19
SHA1 15cdd357ee96463b2f24bb1e02589ffbaaecf270
SHA512 c9d69cd6dadf5fbc0b57f237671bd4afec7ea68704e7a2a923903e82d2ac74e80a1029c911ce27c8b8d86bd7b6b7d317b3b27ca6a1836522f38f6a7f9a473a76
TLSH
T1DF2180632EFD4526E1BAB609FBB5403497343846583DC50E91D10E0E09E67808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\options.ini
Size 1KB
SHA256 caa75b5832312f9c46dc8f54dc03a84a25fa6b5addf4809290d013836b2424c2
MD5 5758402ea6c100a7211eaf411dd61b4c
SHA1 c4775985721229dae1ce411af852e98ee7bb9bee
SHA512 1ceb7153020445c03c24ff492847d34a68dbd6c95ea6a0a4b67f9b3372419b8b22021cd27df4809907d8f4d58ccb0647cff3811ff1fea34033969e19dd357268
TLSH
T1132180632EFD4526E1BBB609FBB5403497343846583DC50E91D10E0E49F67808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\shortcuts.ini
Size 866B
SHA256 d1f6b6b6fc20b84ce925e0925f9e180bc924c8f24c788edd90c3001ba15087bf
MD5 751525a3fd0e53134d4e178390655a67
SHA1 5ef73cda0e4677814a8a4ecfc4a112a563d430e3
SHA512 af4686c2db651d8c00c46f4800f2641f8870635b6a5b7961f2f1a4dfae64cfad0dfc485030488fcf2549a1b35748728c16ed1ed66ec441f672326ebccb4a1fbc
TLSH
T18A111E032EF94015E4AEBA4DEBF540769B397589182DC81ED1E14E0E48F96808577BDF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\summary.ini
Size 810B
SHA256 e00a7eb0ec9f49ada43da83d2f59ac3c6eaab7f505f2e3f40c751f3667123413
MD5 2d29621922b2180b06b5ed99f4dcd24c
SHA1 2b4a11315e223ce4205b378856c77fd052658c6f
SHA512 5faf0591f6fbaa238e86db44f2ef336d9ece43d58bd7fedb75108c258e913bedc263a8f20157b53716c0ea81efc17a226a5418f37c0d80184b1a27a7befbd62b
TLSH
T1CC018F132EF94029E0BAB61DFFF144759734B806086DC50ED1D10A4E48F66508927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgA005.tmp\summary.ini
Size 732B
SHA256 3a4e48b348f88a66bc81ce0c4fa1fcf95630f00ccac7c85a02192587f32c4f0b
MD5 389bfb8083da8e0d859429f3fd6adb28
SHA1 9a4d65667a91af11a76b2a7622ec2d4222aacf10
SHA512 0c76fb15e26d319bac4e88a2cc9b6ded0251483f57d03790a6d02718f73e6604a6b5f9cc93e4d57858e2607fddd9b2980a153900224cad0710664b30c54646f4
TLSH
T1CA01A4132EFD4429E4BAB61CFFF1407597347806486DC50ED1D14B0E48E66818963BEF
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 544KB
SHA256 86f95de33a360444653a765dce16a79ef6134aaa04bc7800c804ded0235442ee
MD5 ceb7de1efaed2488dd3fe960217122f7
SHA1 78e34503c1b2c7f6cd5c0eda73faf0d7ce01b9ea
SHA512 c83876ce385d502b361d4692cc1484bd5a75728184fd3de231470286c8bfa050db9b91f2e2d52b0c555795a723f34505b1a1479fb094997315b9ad44f8247a94
SSDEEP 12288:nw+ZM2sZGw9i6mi6ZpKT6620N1XHN7QSpYyrdxXjbOW4nejtP3Hxn:nRZMzG6mifT6d0/HSS3pJajGv
TLSH
T118C402F9B7A07CF7A7BE02079D863FAD16624922C38FA08C543A7BC2857772D6E55410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.shortcut_cache.json.tmp

Path C:\Users\Admin\AppData\Local\zen\Profiles\x7yvj3wj.Default (release)\activity-stream.shortcut_cache.json.tmp
Size 104B
SHA256 79e7ea2ce0b424445fba83883421eabc638eb11e0aa726c32d19866170cbbe11
MD5 6c07e051763c7a3736ecb5de54b1c4d5
SHA1 8e641ad8bec78ad3cf2f019eee7afedf9c20f761
SHA512 c6ddf7a3e1cdb00bb00e72a5e926db2bda62032857d5a9e661ec0c746eb8b2f99e2e501ca23483af3a422f72beb25100d70ee3988afe3dcfd400a9776ba66c38
TLSH
T1C0B0123024AFA320DCF3E8174C5C0906D4F16AC734844EC112C41F13100803D21CA54E
MD5 SHA1 SHA512 TLSH

Submit Download

57B9007611D6A1CCA49D2B7FD38AACD1267C1958

Path C:\Users\Admin\AppData\Local\zen\Profiles\x7yvj3wj.Default (release)\cache2\entries\57B9007611D6A1CCA49D2B7FD38AACD1267C1958
Size 41KB
SHA256 8af91d031292ab87bde82a447e303823c069b1ea460a41f7bd88a9922ce6832a
MD5 c0b0c823eef272b36465a70cc596674e
SHA1 9584d8dd48f154f704122f3aab349eabc0ff2246
SHA512 fd401c203b039a656d1d1ebf38d72fe5cd5ba225b1702c47ac10f7d814e97da471195145708e1d5da77bebc55a942f0c3d3f58dd982bc8bd7a44d57952b7bfbb
SSDEEP 768:D5fJiWAfYC5PfMzrLpMFz6ePXchfS2sDIVy8pYwdvNmVAXIuW:BJBqfMzOFz78kWy1wBN1i
TLSH
T17613D07B5F01586AC95F8176C4EAC180691CB03FABC8A4692C683248974E7DC7BB70CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\zen\Profiles\x7yvj3wj.Default (release)\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 17KB
SHA256 169d91da7385fe72bfc970ffa9d7b9e3cad42af5c3b5226fd40079918e654b6e
MD5 553ed73ffc193adfc92589dca4f560aa
SHA1 90f62adb1a20cdfb5d2c8a9b3e2e3c378d2578e0
SHA512 f2bff8e41268f6f3c0fa399f1b7e267b5455d4e226f781ea07c7fa929a23b49a6a69f3738460fb4ad23e9669cbabe0625a604b266d245de2ea7464aaf18c019e
SSDEEP 384:H9XghOiO024Y3o6J+Sl1ODnZBPsac4j0lpDIIzdh4XOVI:dX+ZY3o0+SlkzZlsac4ID8Edh4XN
TLSH
T15482AF7E5F0238A50D27E0A5D9FE4249CC44B6BBDEE291A516583C08CE447BAF8F14CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFCCBA9DAB0559A011620F23DC246FB3099B22B6

Path C:\Users\Admin\AppData\Local\zen\Profiles\x7yvj3wj.Default (release)\cache2\entries\CFCCBA9DAB0559A011620F23DC246FB3099B22B6
Size 32KB
SHA256 65161bf57577c612803809ce024ee5762a9fe6eeb8d52c9907cf07dc99bb8ce2
MD5 59f3110d404df1ed565fb24b56359295
SHA1 409af7c9b12cd6ed1aff11b985c19d3f3090ae32
SHA512 92bcf6897759d5642056c7989ef1ecfda493e2b841f293680a786551ddd02b2f28f8f25244087039382fe315998be6457c2af328d8eb3128e7d934480b0ad607
SSDEEP 768:OuPgEvIzFnieWp+IcJq24FwdvNmVAf+hRMeJq24FwdvNmVA2JQyQF:OuPRvIzFnc64FwBN5s4FwBNUJ/W
TLSH
T150E28D9EBE41359C0D2B922AECC5E3D1BE1B108D47446C69756E3048B3FD529D0BE6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ce45f87ad8aa327.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8ce45f87ad8aa327.customDestinations-ms
Size 8KB
SHA256 b28d33001eb79ac0fd9ffe216ff12b821184cab68d2b3e3a89575849a44ea85c
MD5 5e43a36fa4ffdcc319aa1e1dde612f1d
SHA1 9778b578e8a50ce35e92fc225039b2723efe509f
SHA512 dc58e4886c9fbe8618f005a0a298d023be025ff9727bd6bb9abb3c09bef5220757a30127f0f65687281d0aa99119d165167b10155b8ebbc516d2a1e20026e573
SSDEEP 48:Mucdw4JBUYd80BBztDcdw4JX6pd80BH3txcdw4JXid80BVx84cdw4J5EThd80BTV:lNyhBLNyXkBH3NyXUB3NysBHNyPBA
TLSH
T15902B00017EB5A36F1B79B3344736F21AA7BFC41979D065E818642490CB0261D5ACBBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ce45f87ad8aa327.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8ce45f87ad8aa327.customDestinations-ms
Size 8KB
SHA256 7dbf1e8efaeb17fa63537faa211336f3e246f1d68b8a9946ef733cf99d53fc21
MD5 23563d4953348becc6273d0c67ac9bf4
SHA1 be84a8518d59e8037112ff44b3fc6e2d05b8af95
SHA512 3cc1124bf0adae0d83a4ebcb9ac4737a48a4f614c33bfee02345af1feaf10d07a54e205ff73ea37c6422c05e7c41e65e2da0ffc1575d81c609061af18123a953
SSDEEP 48:kcdw4JBUYd80BBzkcdw4JX6pd80BH32cdw4JXid80BVx6cdw4J5EThd80BTgPcdy:kNyhBaNyXkBHGNyXUBONysB+NyPBA
TLSH
T14E02C00057EB2A26F1B39B3344B36F21AA7BFC42C79D465E818642590CB0261D59CBBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\nqi972jh.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\nqi972jh.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\nqi972jh.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\nqi972jh.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\nqi972jh.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\nqi972jh.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks-2026-07-05_10_3GhA7lOh5uhd_iSkPzRXoa_HTZnhG5b6Vyb7c23OHwU=.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\bookmarkbackups\bookmarks-2026-07-05_10_3GhA7lOh5uhd_iSkPzRXoa_HTZnhG5b6Vyb7c23OHwU=.jsonlz4
Size 845B
SHA256 24d69ec75a6c08f3b68f459f255d700b4592c9d0ab6488025cf1a503dd50131c
MD5 af37ce79506faf3c37a9ef7a6115979f
SHA1 cd6c2410e6997f96262c86db9b38b90052aa681d
SHA512 821255d46798b847c957292145aa29a31fc482b56801267bce1dcc8952c4978fed7798aea101c59cb191a049ed94c4af3f8ef158f13f2279ed72fad70a3ceb32
TLSH
T10801860DD5F514C10ED340760002266667A33F03CED948ECFBCE886950EC69453D668A
MD5 SHA1 SHA512 TLSH

Submit Download

containers.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\containers.json
Size 688B
SHA256 b32a837702b91f3d6c3a6a50da2e31f1cbe6384e991aefd08eb595a05dd27761
MD5 332d1459439502d9605d59b2c597af52
SHA1 aeee847012744a06ccd5201f288efc6c0ee6094e
SHA512 18ebc86d13eec67ac1e3705ce9239598f1a9b7ea5d5406ae41b854caba080d4d9f9cf3965643b793e6c8561f96177aa68806bb7ecb700e8515e8ce3be0095278
TLSH
T18901D1364507546EB3C503A912426D22675C60B1D71EEEE9E8360A4E4ADC3E6CE31BFF
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\datareporting\glean\db\data.safe.tmp
Size 286B
SHA256 51ae88cf0f07ac40007b1d9240e48a0a77d77a4c27d6d81d1ccfaf98a1767a6e
MD5 46d4e42e548b0f41af172a2f2d9bad01
SHA1 9d8a804202feb83a26ca0cf00c29c908257dfe38
SHA512 adf732079d87d9fcfbb9850e9bc80689347b1b747d52790aa73f94ad4ed0e56f7d4c93f1ebac583bcbf0edaa2d8dfe929f1645b6b31f1b9b81e15432d22d2a00
TLSH
T120D0A767D191980DF4C1183909D66FC4573070014197ED036478F205C61B310B96EE12
MD5 SHA1 SHA512 TLSH

Submit Download

77aa3826-4d3f-4bd1-b6d7-f3585c418724

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\datareporting\glean\pending_pings\77aa3826-4d3f-4bd1-b6d7-f3585c418724
Size 711B
SHA256 fc5eaa3726b1a012964bb7a52d7a6fb7b84e3e90343b7f096cfb01c0b1893ec3
MD5 44ed0ba31a6f096a298e22c3d9f78175
SHA1 48fc54002bd42faf85821910b7468731d2374918
SHA512 bd5fd2c61441e97c4a2903fe58d470203eece282fb014ebfc5184a5d5cf064ba10ecc57f9445cd08ef40211cc4e58f9736c72fb1f1d1f87f8413a3c6b7f09e5a
TLSH
T10A01FE1665A8C06648B0934AF1D97F00917900336076F704C4A1E53C796F1AB637B74B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\extension-preferences.json
Size 1KB
SHA256 2b7a92f513589cf967227a6e61b80e7874d654966ebf292f4a4f68b893c7668d
MD5 b0a4d9d704df406c1f458cf4aca7a06a
SHA1 2bb5c9e2972c91bf53545afbd68df98d5cca0bb0
SHA512 041e1d1b623d0d7cbdb50e4f5c1cbeb1aed4399f0ae77b4a164e75a6bd20b40b47f297c1a886607c75dcc3260f6a4fc9b6e8f6edaf256dc68b7c86e954ae72fc
TLSH
T16021862670072EB01ECE6770B9344B91E7E2311B50B7E2A87E25E34E53D387491E938D
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\extensions.json
Size 14KB
SHA256 c8d6f1af2306bac724128ad75dc8f43d9888e3f296ea9c417a03257b3b71ebcc
MD5 6b1934288638d0df5f69b5206c590645
SHA1 7b7ac7c41933319a15950d284aa33619565e9830
SHA512 7baf6bb40e539968412c7fc703bb2ae54ab78bd240a3477875c7c4dc5d20ed0f14694f5820c2739ff76ea907d9b260dac4c65b8fa37a78004465707cc7dd838d
SSDEEP 384:CVTEdj/7QT4ij/7ThT9uj/7lTYij/7GgTldij/7ST4Cj/72T6Ej/7ML4H4nL4HDw:CtEE4w9MYLKf/4R6N4YL4jJh4Z4i
TLSH
T1CE62ED1544155EB8298FA3DAD976BE01C27C663B70455C7CB8ADCFCC42FA0BE06A361B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handlers.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\handlers.json
Size 426B
SHA256 26a56d83b2cdaba5fccd2d0fb84a919bf303deb96365798cea4a7a6c375f34c6
MD5 8bb6edf1536496d498e89e44684cbf30
SHA1 69d3ea3ccb9ead36173f138cd3225147cff37c14
SHA512 5bc0cab233681407a349c0bcc65e3dbe113650284a0a9a0042183ffb289618b2daa52a0e71ef4ef823533ec6e59873c276a3923dd06f22ef4c9d9d0e0b522e5f
TLSH
T19FE0E5926C1DBFE20B3DA56CFE4B790AC1B6051B3CF8EAAE58D1CB040761A6DD007359
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\prefs-1.js
Size 11KB
SHA256 dee763fb6f5eafed1af93b9b9d7f68f7fb13bcf412fb6159bbfc9e06ce1805cf
MD5 bb59e75e34da98cc3fbd73568e8dd9f5
SHA1 ebdd497e2c2724892a4d4dc76175ccdeac5a1ef1
SHA512 5ba9d03fc617c6a8b30add4866b10a0c6b5bd1c4556026a7331ec682743314ae5da8690a3e3322b8cf5242e38f911d49ce951adc6d6aa79d8652dd7fa4bedd99
SSDEEP 192:ayRDlahgXpQU8vgH2vOR5tgLefhXOBw8C+U+q+wZCop:0hyNR5qo8woQPZtp
TLSH
T1EA32BA3890409B7F65B772BDAC61867015A142377BBF7CD605F884C6450CF2A41EEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\prefs-1.js
Size 3KB
SHA256 4faa8e92eae300394afe7209b39ed395147e06a29549caf80c9439511e1890ef
MD5 4945e7f47aeec8630918aa09d1827419
SHA1 5c9ba99566355adcf61cd312f8894fa324683a5a
SHA512 d675b1243f0547d697b7deb3c06a87eca53175239cd48006e3cfa85c1d1c4b4bed3c6d102a8868e1e9c7aad9529235a2ef3a7b4c979a2a806eb8b0d1120eb4ed
TLSH
T1D6711E765400DF7F61B637BCAC248AB08672417A777F2CC224B99089161CF3452FAAE7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\prefs.js
Size 7KB
SHA256 4d7218fa26aa2491cf5d4e6811a6a11e2d771e14aaf7ec1a5c00be7306407562
MD5 f776e0a4f62360596b6ca724a5631582
SHA1 3611ef2f416e46f20580b637cfff32a92cf607bb
SHA512 165307eaaf3114e37d5673ed6b50f1536b082c3ced7057692377585d1660e114f833b9618241f6675c23a7d35c739b5b67e050a4bf7a778cac14efa07076b8bb
SSDEEP 192:lyRDlahgXpQU8vgH2vwR5tgLeBhXOBw8CawZCop:bhyXR5qq8wlZtp
TLSH
T12EF1FC7891149FBF65B273BCAC64897156B2017B7BBF58C610B944C8150CF3882FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\prefs.js
Size 4KB
SHA256 90acff528111df4f97a03396360446efa9072e1fd5bcbbe1cca48e1230067b69
MD5 6e299d61ae694eb5e109fe48a950cc35
SHA1 4b797a3f262754286031481a16bdefa91279125f
SHA512 353df582a86ef04d07ac5c303cc6e262729133a6174c6416a67f81d61d0d13ec9cc145729daa20e66dca6b04efb9d28f40179d6d32f9069062423457cbf0ad96
SSDEEP 96:xH1mmSMqIhzhznGTy26cHdffWR5tXQLe9YhMkOBoxw/xH/0:+9IPGT6R5tgLe+hXOBoxwZH/0
TLSH
T11BA10F799410DF6F75B637BCAC248A709672013A77BF28C620B950C8110CF3956FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\prefs.js
Size 3KB
SHA256 ca328ddf1498e09a2da3775b732b21736b216bf11fd055a626e35cdd41a1ca99
MD5 f48a3cfc2819ee40cffcf85c0c5953a2
SHA1 44a106395e1bb6b41d022fff2b52e5df76e0c156
SHA512 2331334bb3b02fa24eec3977a05eff8c2303e7e5d52f821ef7aabed05ebb8bbe194c45f37f12ac938a846d466d2b2b16f9e8aa1b1f2c1d4c1c3119bba5668053
TLSH
T1F3710DB65400DF7FA1B637BCAC148AB08672017A777F28C224B99489150CF3412FAAE7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\prefs.js
Size 7KB
SHA256 7366cb28e59c581fc4d9f7c5a6ebbe89faa0e3ddf149ff7a5d04813a9cfdb26f
MD5 6050830fd01f775be53b660bc004d22c
SHA1 73add68f3516342dd3cbf9999c7c31d35e30bdcf
SHA512 8c1a6db82ce9145c2e4d3a2d1a6c87230a4b511fc9fcc5ef886ddeeb3e25974965c6f0ee7eb3b4d677f16cdcacd8a9e9ecddb10cbbffcf750711d1a54ed38d72
SSDEEP 192:DyRDlahgXpQU8vgH2vwR5tgLeBhXOBw8CawZCop:xhyXR5qq8wlZtp
TLSH
T1AFF1FC7891149FBF65B273BCAC64897156B2017B7BBF58C610B944C8150CF3882FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\prefs.js
Size 1KB
SHA256 ea93417123c4048ae1be574e6d0caecd353b2a39d5d6ce5338f91c824834d004
MD5 cd16c0b23269de26845021a920e91da6
SHA1 ee2f2bcd276151c1a92fa70b30649811b1accb9d
SHA512 9a88c5cfd390b0b524c3cd7f0a5d8eb3f7c361a8913858b6a8d6db25dacf042cbea64a8511ebb69e1321801aa24b8e2e5bb4f2a724adb453fa36a983e104041f
TLSH
T19131F2671405DF7EA1B5376CFC268AA086734132B67FA88624B895894518F3047F29DB
MD5 SHA1 SHA512 TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\search.json.mozlz4
Size 267B
SHA256 c889e2cdbbe6b2c3729459dc94a15c6c720a962b0fc79825d33758b442e43afb
MD5 5427b52a41128faec4d25f275dffa338
SHA1 e371d6e3e9f2e62765fffead6e0d5a21856ac62c
SHA512 f3a7d21074be3cb9ab087ae5f0ed6682fc0385960bd065c231271e2a8c64f0f9da266c4220b5703263aa2a145d6ef74418b24e3d6e03be183d542e1f479b1b6f
TLSH
T139D02B3EA4B4E477434899C34B855649CED6010D96203C8442A5ADD1653E785B100D3B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 b65d7c04466d01fcb9c2be964921c958e6306c975cca172071b0c8d68c045021
MD5 d4fb40118173f3ae33274f0a99feb379
SHA1 0df8cf901b468c61fbe57a8b406cecde148796ed
SHA512 7e86afa663190b8c5bbae86ffe2549b82e399b4ee24c16564f305d613333f8fd930a1b611a8d49a0cfb6d5986fe49260ba0bd1c033a5878b824fdc0b3c0532d4
TLSH
T1E2716D03BCB247F0B3D6CAD9138D6C6A261AB55285FE4C80D6AD287C0BB070F3EC8185
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 0fcce3794898a0a51a16c92dac8f9b4923b3ae06cb8a9d32f242762a88dcfcb2
MD5 357f07a11af9bc1ff11b341c67f79def
SHA1 83325719f305924a3b6a22ac14a14bd9ace9a90f
SHA512 170095c4b9f753f37fd641475d1d509c312902593b8e89335ab60f7823e828f6b1bda6ab4d498ee7d0dcfbc7f5ea60968bab93d4cd184fb420747240d05c22e6
TLSH
T1C441D451FD7ACAA0F79AD5DD028E9EE926567C1286FC9C81E58A04244F3835F3E8128D
MD5 SHA1 SHA512 TLSH

Submit Download

2918063365piupsah.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Size 48KB
SHA256 56889662a0ce6a445c1a0727dc086d00fa7038ab97b931507444e336b4135a94
MD5 985c5fb516a39ed8efe67f8c6bea0add
SHA1 a507dbfcf9a72a4c9253957e9ead823abb30a50a
SHA512 0e37eef66032714a2cdcb95d3ca89f8e237c4cc1e8cbf2d8c1bb246e37891f2dabe9b8d8e85c8c071d30e916bca86133667474ab5149fa4b32992e9d67712739
SSDEEP 48:T+OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEb7:616S6CKnqlizbxV+2xVeU7X2B0b
TLSH
T178235E8E3F07E511C53AB0B178A08D51BC5E321D07222AD57990DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 af3154a74a4cc88497f276e5cdaf11210e247bfd1ae00c9893cf5eb1b017ba59
MD5 c70024699cada88e0b648f56f0f4a446
SHA1 13af2d84843d82f049891adfb8f0441627686f1d
SHA512 949d76a1258f5a96ee7f645ceed2407e6825f9531be49dca3ee3007963d7d1b5bc864ffc4e1d25a5853ee01c1e6d3bee446992fa10e78a1d5b4d7c3eb1a0f691
SSDEEP 384:G6S6CrAW7RBvOPv7hvKovVYvC6v1xbvAPvp0H7/NUeKN6eAs0eq8hetMRe9cLef4:G6S6CrAW40H7mCoefl
TLSH
T1C14385C87336EE4ACB02D87E04C683EF808D7E6900B64D893676D75C84654EBDB6FA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.8MB
SHA256 282442bd01e7871bf5f62e97b1e7db55d36e4014bfba00fb8e6b306fc242f29f
MD5 b00af80e5bd60c549e301045a4b5cc72
SHA1 2b700c438711aa35d8368f8339c8dd11ca491fdb
SHA512 39adade6e009f5952950163c496157739fbbe341ef53e2380bdd00f3be50d3d18656ad3a89a64bc8ca4d90397935453d58122dac4922fd3ca45e4caf1f51053d
SSDEEP 49152:U24rjl1vYxHfu5lFL69w5GyOMNwukDy0AQ/FnsM+PlyC8fEK/U+:2wfunFu9w5GyERDj79sblB6N
TLSH
T131565BF820D1A257F3814033654593EB21EFD00D6037DA085BA99AF9D4B4CEB9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 15.9MB
SHA256 2050cd068754e68deae2e72400da1f9227431ba0d827bc29daf2d51a64f4dbe9
MD5 4f1e721b8fdb9cb70228a6e92a7309a0
SHA1 cb1e117558cb64d1e748384fb176d8cb5a8b9ac3
SHA512 2d5328535626df98a094db5dff691303a59bd27c8a2275a16d2d87625fa72eb1a6cfdaf535ca97318a278b2d07f4413a83eab4e163102ae6ca24b37fb255fddc
SSDEEP 49152:tU4r6l1QYNo6l5YjLqJF50v8ZvNkDy0AQ/FnsM+ol3C83EK1UhfeyA8v1C0EGqiE:rZ6lmjmJF50v7Dj79sMS1syi8ve0ja
TLSH
T1C0F65BA670E0D692EB0146B2F31F43EB307FC1DC20E589941678B65C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 15.9MB
SHA256 e7e7d05f0304cb587f6ebc51653586d7b76cd8feb09c404032d82ba2e0dd1ea4
MD5 2ce7e557ddd2766a1f7dacfa8f045968
SHA1 542fe5deb640dd44a59a213dda630612d247e7ee
SHA512 b3597ed3e3121d650308c483be6a32eb8e367c370ad1dd6e0f39cd7a820c78f5908e09edb4cdb81105b93f09ff056193b9578a26b3ab87bb3dfbb707f2bea1c9
SSDEEP 49152:DU4r6l1QYNo1lzYvLqJU5LCvMetkDy0AQ/FnsM+ol3C8rEK1UhA5aeUgkwYYl5/l:9Z1lkvmJU5LCcDj79sMS5syd88q2vC3
TLSH
T16AF65C9270E0D692EB0146F2B31F43EB317FC1DC20E589942678B65C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 320KB
SHA256 acc820a6964708c33821d607187967892b7023304fbc5c4bb7394d5ac065a4c2
MD5 35d1ff4c7e564969f49ac04994fde7bc
SHA1 fa9d64c20a22896b8413e93e5fb046a5c06b0ced
SHA512 6755d35f431d2c25f81a0f72d50bf29abcefe867991717e3ac2d8d4cec8f0ac1deaea75223b487cc46793c1702f3059862cbef1892ed2be290888a7f7c20e989
SSDEEP 3072:AVQbLLv/56alxg1alUmz7KCq8mXowXhdkmyTY4dWUo/1rRPsytn4IeYnm:qQb/H56a/gU0CAXvxdkmys4dWUKryyC
TLSH
T173647CD16BFC764EFBE1F83A9A5A82D71229E404D8B4EAD01FC723C453D49C18547A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen-live-folders.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\zen-live-folders.jsonlz4
Size 15B
SHA256 0dd22af73bf7560a8bc72ee90aba611c1241c2054d488f75d90a4afc27309efb
MD5 e88094f8457c6fd244c2787c6524b125
SHA1 a5823f19d67c3b3d9cda80aa3acf20dd00a2d437
SHA512 769ffbd35a9c2a1be4ec91c60036f4a7d3925e15a947d909f9e4b14573ee9b993508917d0e28513c6fe13b4202d7f4c39173ba729ddbfd400a90a01812910ea1
MD5 SHA1 SHA512

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 586B
SHA256 53baa71c8502bcb3e7dfa78b189ceb92f45b66ccc1e855d516152375c666baed
MD5 0ce9ff900daa12f45c65115ece3f83e4
SHA1 21cb3922424d1d4fd7dc704c1aba191a0821f9ca
SHA512 03bba096f05ec252cae3e33523138b32347aa99c6968c88a8faabf81a1420e458f587cb8cea33c2528a87294fdda4490f3cf9042d254804c161a9f31763bc356
TLSH
T188F00C10AA10DFE1A6D2A1E881918618BA027A2CAAB5FCE054018509828A0B73E3558A
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 2KB
SHA256 7d2029d5190fc6fa0df259fba3de3eaff56c860110aa476894888013b3514a33
MD5 8415d861075e7df68eb9c9bae2b08a2f
SHA1 da9b2eb153dad4f43b0cd784b1c7383f4561ca99
SHA512 4ab1bfe6bbe74d9dcd67ca72d83bcd1d584690695ff472dbc2a2ae78bdc4b5de1dab2f4528343881f0dfbf7542b1b91f30239cd6cacc7a8f3bdd6d732fbc84b6
TLSH
T1B9515C16B9F283F9B2AC4F9D068C2816EE1EF0A715A2ACD0549F2F8D4170B0179BC0A1
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\zen-sessions.jsonlz4
Size 67B
SHA256 88e9fe372bb0f7b16ebeaa6ebb131a1b5ea9ee35eb2300b0b7155eb118e2b7a3
MD5 8416a7f4ced4db1016a00c4f6574d49c
SHA1 641e010f4af3cc0026225112d99fd20e42f0c5f0
SHA512 9048e2e6e4aeebbab23232a0ddf935a9bc07cc7dfd03365c9b338faf4ef7a833b932d14c129f8de86753fabb0da2b45e4e092b315f71a264a604b4e7018f3208
TLSH
T1E9A02200C0802B0002E0BA0A808288CF03A2F02800300CF0BCCB00C38380A0B0C83082
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\zen-sessions.jsonlz4
Size 2KB
SHA256 256552048c9308d61985713934bb27deef3e0ebc71c5ce1d269dff03aa298c64
MD5 c9ed0396e15a5e6835def38bdad44d1f
SHA1 29986a9462658d83fff4eaaa0cbfce5a8de20fd0
SHA512 54040a4859f3c322ef535a4d7199c55ee7aa4b6475945078b5e6b02d63f9fc2da34f4cbec1eaf15e349c9635c1d77969cf84912d4de99e09d93a31bcb817ca7f
TLSH
T1F1515E1679F283F9B2AC4F5D068C2816EE1EF0A715A39CD0549F1F8D4571B0175BC0A1
MD5 SHA1 SHA512 TLSH

Submit Download

zen-themes.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\x7yvj3wj.Default (release)\zen-themes.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 1008B
SHA256 b82ea5eca999121892190134a2cefb6b8ea6cd65cac973af38f705fbeb1ff5af
MD5 b7c5e33278272d660d3237e6a01dbc99
SHA1 b202aeb23797179c5ef8f91c84794136a75cd640
SHA512 a1d23db6d9de5d2c14012af5a6e25ef74f09b11821227f98274f7128f027a4ee57503b316b9f5d4249aa5bc8507a818144e4dc3266a5c01a252771f340dbc267
TLSH
T15911AF0057E7563AF2758A3259F36E329767BC42D7B8036E828952490CB1111D55CFBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 910B
SHA256 b72f98ee93a577c740aaa0f27b640328a592c2f0963cc489af6a6446467c8a5b
MD5 7e9d73ac34bde92438e9b35b153b0d47
SHA1 662a56c0dfb56a438a5ca7c2b6679adc55bf5af0
SHA512 4d253dfe05d9dc925b95f2b10254b3ead75727dfa2b77f1f4e7a31414ec4f92696e5064ea0e4ec12db57ef9fccd0e3e650610cb9a18e6c32d0361005632705ec
TLSH
T1CA11680013E3562AF2768B3259B36F719BBBFC42C7A8476E868912494CB1111D55CFBB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1456-384-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1456-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1504-2758-0x0000012BAF260000-0x0000012BAFD3A000-memory.dmp

Download

memory/2956-10526-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11068-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-9347-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-9616-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-9794-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10067-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10334-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-8001-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10774-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10904-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10912-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10918-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10924-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10930-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-3484-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-3017-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-2862-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11249-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10990-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-10998-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11004-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11010-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11016-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11022-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-2726-0x00000134EA140000-0x00000134EAC1A000-memory.dmp

Download

memory/2956-2725-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-2705-0x00000134F6F90000-0x00000134F6FA0000-memory.dmp

Download

memory/2956-11044-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11050-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11056-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11062-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-9094-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11074-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11243-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11093-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11099-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11105-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11111-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11117-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11123-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11129-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11135-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11141-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11147-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11153-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11159-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11165-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11171-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11177-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11183-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11189-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11195-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11201-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11207-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11213-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11219-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11225-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11231-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/2956-11237-0x00000134E9CA0000-0x00000134E9D56000-memory.dmp

Download

memory/3168-2756-0x0000029EFEAA0000-0x0000029EFF57A000-memory.dmp

Download

memory/7072-2688-0x0000029D15250000-0x0000029D15D2A000-memory.dmp

Download

memory/7072-2687-0x0000029D15250000-0x0000029D15306000-memory.dmp

Download