d64a89c7df07dfbdff23d73c19b23dfa5c852eab92c6156d9e20e18cfd826b27

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zen.installer.exe
Size 91.7MB
Sample260729-rx93vshr3x
SHA256 d64a89c7df07dfbdff23d73c19b23dfa5c852eab92c6156d9e20e18cfd826b27
MD5 5f3ebde6d612b0caa9338ddb53ceec53
SHA1 d78e8ccc7c5d19c668b943381146471f5059ed44
SHA512 f059c693c1ccfb5d162af1b262d6a120dac39057b7142fe3b9e4d9f883d755cf3b0503fe66f624b27bbc26dddf8cb7a1f85de5d0d3fd666008231722418eaf23
SSDEEP 1572864:Za2R2HQ7a5MtABliGclam0uJVNYGX8e+9fKeTyLKwAOxmY/ahLMsH:QW7skam0+7bHyKvWO83
TLSH
T1062833B2480C46BBF499273A9CF54E3BCA16A35B1501BFDDF1E7634D21B664EEE84402
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1548-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1548-388-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Zen Browser\mozglue.dll	setup.exe
File created	C:\Program Files\Zen Browser\omni.ja	setup.exe
File created	C:\Program Files\Zen Browser\zen.exe	setup.exe
File created	C:\Program Files\Zen Browser\precomplete	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	maintenanceservice_tmp.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Zen Browser\notificationserver.dll	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.exe	setup.exe
File created	C:\Program Files\Zen Browser\update-settings.ini	setup.exe
File created	C:\Program Files\Zen Browser\install.log	setup.exe
File created	C:\Program Files\Zen Browser\dxcompiler.dll	setup.exe
File created	C:\Program Files\Zen Browser\removed-files	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\clearkey.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nse8347.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\nmhproxy.exe	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140_1.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File opened for modification	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nse8346.tmp\	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nse8348.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\mozinference.dll	setup.exe
File created	C:\Program Files\Zen Browser\platform.ini	setup.exe
File created	C:\Program Files\Zen Browser\xul.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png	setup.exe
File created	C:\Program Files\Zen Browser\plugin-container.exe	setup.exe
File created	C:\Program Files\Zen Browser\softokn3.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\	setup.exe
File created	C:\Program Files\Zen Browser\default-browser-agent.exe	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice_installer.exe	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140.dll	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\helper.exe	setup.exe
File created	C:\Program Files\Zen Browser\browser\blank.pdf	setup.exe
File created	C:\Program Files\Zen Browser\browser\omni.ja	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_150.png	setup.exe
File created	C:\Program Files\Zen Browser\dependentlibs.list	setup.exe
File created	C:\Program Files\Zen Browser\updater.exe	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\CoreMessagingXP.dll	setup.exe
File created	C:\Program Files\Zen Browser\freebl3.dll	setup.exe
File created	C:\Program Files\Zen Browser\libEGL.dll	setup.exe
File created	C:\Program Files\Zen Browser\libGLESv2.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Input.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavutil.dll	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nse8347.tmp	setup.exe
File created	C:\Program Files\Zen Browser\lgpllibs.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.Internal.FrameworkUdk.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavcodec.dll	setup.exe
File created	C:\Program Files\Zen Browser\onnxruntime.dll	setup.exe
File created	C:\Program Files\Zen Browser\installation_dir_layout\versioned\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\installation_telemetry.json	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\uninstall.log	setup.exe
File created	C:\Program Files\Zen Browser\nss3.dll	setup.exe
File created	C:\Program Files\Zen Browser\updater.ini	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_70.png	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.InputStateManager.dll	setup.exe
File created	C:\Program Files\Zen Browser\fonts\TwemojiMozilla.ttf	setup.exe
File created	C:\Program Files\Zen Browser\browser\confused_fox.pdf	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	maintenanceservice_tmp.exe
File opened for modification	C:\Program Files\Zen Browser\nse8348.tmp	setup.exe

Executes dropped EXE 25 IoCs

pid	Process
1140	setup.exe
4488	maintenanceservice_installer.exe
1260	maintenanceservice_tmp.exe
3760	default-browser-agent.exe
1448	zen.exe
4564	zen.exe
1284	zen.exe
4856	zen.exe
2888	zen.exe
2632	zen.exe
3892	zen.exe
4932	zen.exe
1376	zen.exe
1504	zen.exe
3784	zen.exe
4884	zen.exe
4256	zen.exe
1976	zen.exe
912	zen.exe
2212	zen.exe
5048	zen.exe
1000	zen.exe
4428	zen.exe
5952	zen.exe
6284	zen.exe

Loads dropped DLL 64 IoCs

pid	Process
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1724	regsvr32.exe
1724	regsvr32.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
4488	maintenanceservice_installer.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
1140	setup.exe
3760	default-browser-agent.exe
3760	default-browser-agent.exe
3760	default-browser-agent.exe
1448	zen.exe
1448	zen.exe
1448	zen.exe
1448	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
4564	zen.exe
1284	zen.exe
1284	zen.exe
1284	zen.exe
1284	zen.exe
4856	zen.exe
4856	zen.exe
4856	zen.exe
4856	zen.exe
4856	zen.exe
4856	zen.exe
4856	zen.exe
4856	zen.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zen.installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Colors	zen.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	zen.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\ = "Firefox PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\FriendlyTypeName = "Firefox URL"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.json	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.mp3	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.opus	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xht	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\IconUri = "C:\\Program Files\\Zen Browser\\browser\\VisualElements\\VisualElements_70.png"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.ico	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{F4335C57-2D3A-4261-8145-8F1FEC37E00F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,5"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.webm	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F4335C57-2D3A-4261-8145-8F1FEC37E00F}\DllSurrogate	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "ISimpleDOMNode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.bmp	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.pjp	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\ = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.flac	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.avif	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods\ = "8"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\CustomActivator = "{F4335C57-2D3A-4261-8145-8F1FEC37E00F}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ = "ISimpleDOMDocument"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.apng	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.shtml	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\SupportedTypes	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F4335C57-2D3A-4261-8145-8F1FEC37E00F}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.gif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.m4a	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.webp	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1260	maintenanceservice_tmp.exe
1260	maintenanceservice_tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	zen.exe
Token: SeDebugPrivilege	2632	zen.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1140	setup.exe
2632	zen.exe
2632	zen.exe
2632	zen.exe
2632	zen.exe
2632	zen.exe
2632	zen.exe
2632	zen.exe
2632	zen.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2632	zen.exe
2632	zen.exe
2632	zen.exe
2632	zen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1140	1548	zen.installer.exe	80
PID 1140 wrote to memory of 1724	1140	setup.exe	81
PID 1140 wrote to memory of 4488	1140	setup.exe	82
PID 4488 wrote to memory of 1260	4488	maintenanceservice_installer.exe	83
PID 1140 wrote to memory of 3760	1140	setup.exe	84
PID 3760 wrote to memory of 1448	3760	default-browser-agent.exe	86
PID 1448 wrote to memory of 4564	1448	zen.exe	87
PID 1448 wrote to memory of 4564	1448	zen.exe	87
PID 1140 wrote to memory of 1284	1140	setup.exe	88
PID 1284 wrote to memory of 4856	1284	zen.exe	89
PID 1284 wrote to memory of 4856	1284	zen.exe	89
PID 1140 wrote to memory of 2888	1140	setup.exe	90
PID 2888 wrote to memory of 2632	2888	zen.exe	91
PID 2888 wrote to memory of 2632	2888	zen.exe	91
PID 2632 wrote to memory of 3892	2632	zen.exe	92
PID 2632 wrote to memory of 3892	2632	zen.exe	92
PID 2632 wrote to memory of 3892	2632	zen.exe	92
PID 2632 wrote to memory of 4932	2632	zen.exe	93
PID 2632 wrote to memory of 4932	2632	zen.exe	93
PID 2632 wrote to memory of 4932	2632	zen.exe	93
PID 2632 wrote to memory of 4932	2632	zen.exe	93
PID 2632 wrote to memory of 1376	2632	zen.exe	94
PID 2632 wrote to memory of 1376	2632	zen.exe	94
PID 2632 wrote to memory of 1376	2632	zen.exe	94
PID 2632 wrote to memory of 1376	2632	zen.exe	94
PID 2632 wrote to memory of 1504	2632	zen.exe	95
PID 2632 wrote to memory of 1504	2632	zen.exe	95
PID 2632 wrote to memory of 1504	2632	zen.exe	95
PID 2632 wrote to memory of 3784	2632	zen.exe	96
PID 2632 wrote to memory of 3784	2632	zen.exe	96
PID 2632 wrote to memory of 3784	2632	zen.exe	96
PID 2632 wrote to memory of 3784	2632	zen.exe	96
PID 2632 wrote to memory of 4884	2632	zen.exe	97
PID 2632 wrote to memory of 4884	2632	zen.exe	97
PID 2632 wrote to memory of 4884	2632	zen.exe	97
PID 2632 wrote to memory of 4884	2632	zen.exe	97
PID 2632 wrote to memory of 4256	2632	zen.exe	98
PID 2632 wrote to memory of 4256	2632	zen.exe	98
PID 2632 wrote to memory of 4256	2632	zen.exe	98
PID 2632 wrote to memory of 4256	2632	zen.exe	98
PID 2632 wrote to memory of 1976	2632	zen.exe	99
PID 2632 wrote to memory of 1976	2632	zen.exe	99
PID 2632 wrote to memory of 1976	2632	zen.exe	99
PID 2632 wrote to memory of 1976	2632	zen.exe	99
PID 2632 wrote to memory of 912	2632	zen.exe	100
PID 2632 wrote to memory of 912	2632	zen.exe	100
PID 2632 wrote to memory of 912	2632	zen.exe	100
PID 2632 wrote to memory of 912	2632	zen.exe	100
PID 2632 wrote to memory of 2212	2632	zen.exe	101
PID 2632 wrote to memory of 2212	2632	zen.exe	101
PID 2632 wrote to memory of 2212	2632	zen.exe	101
PID 2632 wrote to memory of 2212	2632	zen.exe	101
PID 2632 wrote to memory of 5048	2632	zen.exe	102
PID 2632 wrote to memory of 5048	2632	zen.exe	102
PID 2632 wrote to memory of 5048	2632	zen.exe	102
PID 2632 wrote to memory of 5048	2632	zen.exe	102
PID 2632 wrote to memory of 1000	2632	zen.exe	103
PID 2632 wrote to memory of 1000	2632	zen.exe	103
PID 2632 wrote to memory of 1000	2632	zen.exe	103
PID 2632 wrote to memory of 1000	2632	zen.exe	103
PID 2632 wrote to memory of 4428	2632	zen.exe	104
PID 2632 wrote to memory of 4428	2632	zen.exe	104
PID 2632 wrote to memory of 4428	2632	zen.exe	104
PID 2632 wrote to memory of 4428	2632	zen.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\zen.installer.exe
"C:\Users\Admin\AppData\Local\Temp\zen.installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\setup.exe
  .\setup.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Zen Browser\AccessibleMarshal.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1724
- - C:\Program Files\Zen Browser\maintenanceservice_installer.exe
    "C:\Program Files\Zen Browser\maintenanceservice_installer.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1260
- - C:\Program Files\Zen Browser\default-browser-agent.exe
    "C:\Program Files\Zen Browser\default-browser-agent.exe" register-task F0DC299D809B9700
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:4564
- - C:\Program Files\Zen Browser\zen.exe
    "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies Control Panel
      PID:4856
- - C:\Program Files\Zen Browser\zen.exe
    "C:\Program Files\Zen Browser\zen.exe" -first-startup
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" -first-startup
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies Control Panel
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260725024203 -prefsHandle 2644:26774 -prefMapHandle 2648:302711 -ipcHandle 2692 -initialChannelId {d1b9e8ac-987d-4876-93cf-0e12412ee508} -parentPid 2632 -appDir "C:\Program Files\Zen Browser\browser" - 1 gpu
        5⤵
        Executes dropped EXE
        
        PID:3892
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260725024203 -prefsHandle 2920:26774 -prefMapHandle 2648:302711 -ipcHandle 2960 -initialChannelId {6973f91d-4cf4-48d1-9e2d-d0cd3cae1398} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 2 socket
        5⤵
        Executes dropped EXE
        
        PID:4932
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 2244:26877 -prefMapHandle 2248:302711 -jsInitHandle 2128:156236 -parentBuildID 20260725024203 -ipcHandle 1896 -initialChannelId {50cb29cb-f67a-4d1a-9b7e-319d4ce7bdae} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 3 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1376
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260725024203 -prefsHandle 3832:27480 -prefMapHandle 3836:302711 -ipcHandle 2248 -initialChannelId {e6defbdd-325e-4293-aaab-fb5461269a49} -parentPid 2632 -appDir "C:\Program Files\Zen Browser\browser" - 4 rdd
        5⤵
        Executes dropped EXE
        
        PID:1504
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4116:27591 -prefMapHandle 4120:302711 -jsInitHandle 4124:156236 -parentBuildID 20260725024203 -ipcHandle 4132 -initialChannelId {f04216e8-71ee-4367-9830-6b1a5ee2225d} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 5 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3784
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 2884:27908 -prefMapHandle 2556:302711 -jsInitHandle 2904:156236 -parentBuildID 20260725024203 -ipcHandle 2004 -initialChannelId {7ca1cf30-306c-4dcf-9b2e-a22757dc0d1b} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 6 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4884
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4268:27908 -prefMapHandle 4264:302711 -jsInitHandle 4260:156236 -parentBuildID 20260725024203 -ipcHandle 4120 -initialChannelId {f027ae76-4b86-413f-af70-4a588bd11a7e} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 7 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4256
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4432:27908 -prefMapHandle 4436:302711 -jsInitHandle 2316:156236 -parentBuildID 20260725024203 -ipcHandle 2568 -initialChannelId {6329533d-d38d-46e1-9077-e8a7256d8b79} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 8 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1976
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5152:30849 -prefMapHandle 5156:302711 -jsInitHandle 5160:156236 -parentBuildID 20260725024203 -ipcHandle 5168 -initialChannelId {dad91bb8-879e-4f32-be19-3b23249a5a37} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 9 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:912
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260725024203 -sandboxingKind 0 -prefsHandle 5940:45270 -prefMapHandle 5944:302711 -ipcHandle 5868 -initialChannelId {bd745473-296f-47b5-a4b8-2e6b2fb3a455} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 10 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2212
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6332:43694 -prefMapHandle 6320:302711 -jsInitHandle 6324:156236 -parentBuildID 20260725024203 -ipcHandle 5660 -initialChannelId {518a9f4b-13d8-48ae-bcdf-a9322642a03b} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 11 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5048
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6316:43694 -prefMapHandle 5568:302711 -jsInitHandle 5508:156236 -parentBuildID 20260725024203 -ipcHandle 4952 -initialChannelId {9cfb67f8-261e-4d22-90f0-8e8f34fb4feb} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 12 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1000
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6360:43694 -prefMapHandle 6348:302711 -jsInitHandle 6352:156236 -parentBuildID 20260725024203 -ipcHandle 6320 -initialChannelId {e7c7f6ed-f9d9-4d39-a5b6-018b0fafd2d4} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 13 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4428
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 21600:48463 -prefMapHandle 21592:302711 -jsInitHandle 21476:156236 -parentBuildID 20260725024203 -ipcHandle 5764 -initialChannelId {e4e0b86a-c21c-4976-8c2e-c3bd8ea6f3ea} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 14 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5952
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6300:48503 -prefMapHandle 4260:302711 -jsInitHandle 3628:156236 -parentBuildID 20260725024203 -ipcHandle 21300 -initialChannelId {82dcd1a1-48a3-423d-a556-db06dff1ddda} -parentPid 2632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 15 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shortcuts_log.ini

Path C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini
Size 198B
SHA256 5fbda59442223c5d2fc4779c116f314fc4ee448ab786e102f570aa5de4336cbc
MD5 c18e70154afa4c346b4a5f28ca9a5664
SHA1 1c71628ac2c1609c57db351a2127e16834947173
SHA512 476971174289ce8dc076deb5bbfcdd21d0e55f3dd7ebe635702a2b9d5c4c671713e06c0185f157ab731f7b0c3400e866ad850d7c4990e70ec9624112c5cca3f6
TLSH
T1A6D0023206D60229AE465F81EDE84179DFA6F959609DCB0CF082161E1DF4440C9925F7
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 19a233cf2727eaa1d3eb2faad54a8e480ee7bd954e0c25f51f596e82fa3acef4
MD5 694bf0ebec788555da82d018f67dc52f
SHA1 cb32fecd6c6039e565f4ba74aad39a3e7b51b0d4
SHA512 90ba766920a9d758b37ee83c722827dc6a53b6261e789ffb65f47dcd4a4bb7d06dae67bee28407f3c322bdf6172c6b27c81375555ef1ddabc96dd5a833837317
TLSH
T13F419D0147F76638F2B24E7256723E314637FCC1E76982AE838DC6850A71020C5ACFAB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 be7714c8414a8eb1f925bfbbc1a596e6fea51a98a22dd96851b679c8409062ea
MD5 4f161be743b4752f4bcfcde1bb0266f7
SHA1 bde4b3ec2c422134f46b0b89773a1dfca052ff13
SHA512 a915f954acc6ce101f2c2b18fff0b49691e37b314642114cf8fc69d40c8b9a14792b863be4b41c5ef48edc83b663d4f00e8e294f30dd0d72b10e6a9751b2ca35
TLSH
T12531571147F75638F2B25F7256723A314637FCC1EB6942AE838D86954A71020C6ACFAB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 922B
SHA256 1c0911071a0d951933392d042f5b2d1043f1881348818e7c0ed1398d6f95e0bf
MD5 92763d2a4265670226a904df0cd0cd58
SHA1 9d6f071f5355a7a560e0e2d5029764f4fb852923
SHA512 86a6065f7a4faed5fbe49205a1b06d523d629a565194f9b16bb6796654f5569515945233a9e5b85f915cc7ec5236a6c76efa0d67d7f24e787af35c1f3a515cc9
TLSH
T17311494007E76B25F6668B7216722B318B37FC81DBB9475E46C841A04DB5110C96CFBF
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 1020B
SHA256 9ef2f7ef6f38397de81fb3b1b00f16af11f4395709ddcd327030312f5481887d
MD5 5a72ae6087de277369b78c2f7d99f6ca
SHA1 412e352adb338d7001d916ac1b81a3c4bc36eab1
SHA512 cc9d2ace64f6cde195dd911dbb96533b802d933059fcfae326b242c8228923cdc9f2eedbdd28143ce22e9af5c2ee46a9efb9ee2708f3b1264f396e74df51e6c8
TLSH
T10D1180000BABAB31F1768B7155B227328727FC81E7B8076E46C841644D75410C96CFBF
MD5 SHA1 SHA512 TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\F0DC299D809B9700\update-config.json
Size 78B
SHA256 3f7b3252ef3b6217ad78adb7007738601ce1eebca69f55990b64bf254bd4fc63
MD5 fe74f5c38f433736ee7015868cfb159e
SHA1 f723b0032565fb3007407201963f7bb762bdd981
SHA512 19fe20baff40c195955a921ee2fe1927d00da14e0ed3eb683e5f6f026353bfcd5322a1d2399b8977bdf97bb23dfd6cc811c9a9494f019b6e404aff477316cafd
TLSH
T1EBA011800000A2A8B0E888CC00302A3E02888028008B2A02800A30A0383A0020A0A8BA
MD5 SHA1 SHA512 TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\AccessibleMarshal.dll
Size 30KB
SHA256 85693589562a06276b7893313ada711e45185d09143211201a29bff2247a1c24
MD5 923efb97cf3555d7833d41510b557e21
SHA1 e1b3ab9f9e12a5596000ffabd7d3fa1cb546c2af
SHA512 bddf501b7e32ab1a7b683a2a23d3cab15260f557238342193b435cc2e7993f8f151b05b19777bd7581ffe42206e85765e2db83301e8704dacd7a4d975515c0b7
SSDEEP 384:w9MSlCaZ8nvlfN0GeUMc255g0u46dWl2mNDsSofousJUKURFR2t9OSix:UCaZ8vkGeq20PVsheSoQuoay9OH
TLSH
T1F5D2E555BF0084A5E81D843088DF8AAA5E31FE419F9247CB3395332E1E737C56F366A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\CoreMessagingXP.dll
Size 1018KB
SHA256 492ea39c5e65b709471687da24e8e4a80da041453d21e61f66a1012bf1f98ce5
MD5 4e128a0f23e9574c76c9928379134de2
SHA1 9311c724dec6775a1c9e8e9d38b55e05875d8c37
SHA512 6e7c856b16557ab52a3e775a8e20af5b3f77c9fa33fb134144d1dae41f61b76e387407dffebf936bea66b9c2c27e57c886dd8492cce6b6c45453e19d0dbfdaef
SSDEEP 12288:htl2DdkYB2Zme5NY1RZq3SzFJeb8HzroHCpstWcLObI6DPsb8UsAfO:hgdP4meM1Rlwb839pwWrDlUs8O
TLSH
T18F252C6F6FA84097D17AC27E85BB8A8AF2F1B8531B3187CB0451426D3F27BE45979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\InstallationDirLayout.dll
Size 19KB
SHA256 4faa4ff3a918d6b15c644942282e5b163d7d5386ab8ca67a9da3d98513495ac3
MD5 8377c4ebd473909bccacfb6c50986899
SHA1 fa75ece478a64824346bb23aad96de38e7800b39
SHA512 c48c8a7a09ed69f1e301f8c1a935668187ece1148ec6b14885c04ee46cc06624744ac98832c2fab1989f73a5507d633ecd474086e2c3e8af21e2a3a51094e4c4
SSDEEP 384:oNmCCN3LNn2ddsku46dWl2mNDsSofousJUKURFcD8SSXp:qjwt3/VsheSoQuoaOgSQ
TLSH
T163927D9AAF6084E6F9278A3085DD4E1BAD71F7805B9146CB6219009D1F837F87F3932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\Microsoft.InputStateManager.dll
Size 446KB
SHA256 cf530bcd96b6229487c9bddf11e53e70c2fa1b107cf2db20e7ea9ed382ccdb1d
MD5 254420b4ec60e8877b49cab81a7a0b44
SHA1 0715b273899e816d666c26518591d649dbc70eb2
SHA512 db0fffdc961afa98e1d44c604dd5282dbbf8c2fc4e49664c33ec39e51cee3b2f2d0c37ba22f5d4c718f0b49edc06a18d8230957680e05431bb9d810fa98245e2
SSDEEP 12288:NCfOXk5FPwj04LiaHVnZWz10AmzdTVCK3:4BMLTVnZP3
TLSH
T130A44A7BEBA844A0D536D23C85A78A07F2B2745507329BCB42A0926D1F37FE46D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\Microsoft.Internal.FrameworkUdk.dll
Size 910KB
SHA256 c53015a28feb8dc47b8647f9990280b512e52bf6289ab15274dea31ac5fd234b
MD5 f3eb1f5c02c2aa48b979ee0ac4a40662
SHA1 0c09a89ff5fe80a2cd11a0ced7e1bac3db36b3dc
SHA512 a1c9df1e275a5a3b758757c415a16953a973c647c0234aab261ca343faae888b5ef09eeced2a6c62b6d31df485ad84b809bbfaa9cdad10d3c64945b33aed93b8
SSDEEP 6144:0q2pdSEZxDjmUlfp04mtVkookZea4u2IUWB8Yi+c0p20GHs667I7IK/ECQ23YRgS:CWYdjm9VkookZ4TT+cHH6OIK1yeS
TLSH
T12415741BEE6991E0C4BAD03D9192622FF8B170A68B7057C3D6515A1F1F32FE4A93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\Microsoft.UI.Composition.OSSupport.dll
Size 66KB
SHA256 43bc58fd5e6ec4b76dfd81acbc08d2e6025855729adc3180578077accf942f64
MD5 133d838fb6aa6320ca6eda0b6360d459
SHA1 5130ce888606cfccf9a865e8d444101cf4215304
SHA512 31654621f63ae21829659786760d6fb2928f91c8bed94f32385848ecdd45c0902f57e6a08145c32c53068caf320a64ceca8c29ca36760c0ff9a936c8c369a7cd
SSDEEP 1536:bcum2n7hIpk5Bsshnj9gQFPS47L6kL7oE:bcuThIpkDfg+L6kfoE
TLSH
T1C6636C596A8830FAF536423DC4964E19D9B1B22163405BEF0364C2BD2F83BD9763EBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\Microsoft.UI.Input.dll
Size 1.5MB
SHA256 43535a5d2f0878166c6ff3db4e073a4a27eec5ad015bba20bf23cfb721eefb86
MD5 f79c19deea2cd9866c5ddf6dc8472e3e
SHA1 fb57d8110203bbadc1c21da912c6946aa43f0e22
SHA512 d9d38455900c7bfbb4a15424e90e7dce8cbfee16b6eb9d2539502a996f130268b266394ca06cdd5756a80353a71339ba0cdd2f4167b5cc076741cb6923644b89
SSDEEP 24576:CB6TePxZNKmKI9tp/jLNXoqWnbvxtXypp:CAaMmFp//sndtXcp
TLSH
T1A9752A2BAFE881A6D331A23DC0974E4AF2B174421B7166EB0165412E5F3BBF45D3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 5dd6f6db3cba1e80476bebebee4730b3af0870cd75a7ca1c53eb92b1e0009441
MD5 ae97cdff78b7e9ddf8e09a9dd7cfacf4
SHA1 cc3f941e6e25aba7e242e780cd9646e4f91bd036
SHA512 6527b899f20dafd0f40f1491095dc9032e6e7c49647e51553fb35c89001296acf6afcd942f26c511a96c730074716ff3502b7573c310d265b1123c3dd6c1c121
SSDEEP 6144:fs4jY1PnSzURJG9m3+v6Vtcu5/gm0qV1OU4IkhNFSDm/RuZ2QlXg9:USY1PSw+5CcuOm0q/OUhUNKm/Ruu9
TLSH
T135B44D6F6BA84492E22AA13DD5978B0AF6F174125732CBCB0111D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\Microsoft.UI.Windowing.dll
Size 538KB
SHA256 6b4603d0822d8504125425c12ef86e8afe1fd4bbdd82423b38c225012e6ed253
MD5 025fdaef26f9fdb2feef63dff87a91f2
SHA1 5e99181eb5cea7c759a27696c38295848dfd293e
SHA512 f1ca8826555ec60f5ebbe3e027c1cbdd7aa78374b2943d696c62763434b97dd8df856e463c62b8ff7ae47dbb152504478ffa3d96aaf58e42ed3ae61e6a663d33
SSDEEP 6144:+lLJdDCMslOzqjXsvPueIP7mNq6CIRPDoxSTHXapklto2UInrMRAc6egD:cLJdDCrkqj3eIKFC6DokjaaBjcwD
TLSH
T13AC43B7EBBA44696D12A813DC6AB4F06F3F0B8515731DBCB4161823D9F27BE8593A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\application.ini
Size 632B
SHA256 6a0668283528add9844349cc7c93f45707a135c10cb602d8c69b49e6575d8174
MD5 abbd671e23311a76eef35fbedb36a84f
SHA1 c552ea1ed5f8e9c6c369c2e29dc66ba18a181350
SHA512 73c67fa936b90eaf846d9e58e85a47f9892b7453c7282e534bcb2aa8665836eb07a3c97be7a5a21769df228238cca94d48c16d570bd70ab2407f7dca3344f497
TLSH
T152F0D8E7030974FE8EF33ABA700557D49333082898DB382C1046810E062932A2B8EBA9
MD5 SHA1 SHA512 TLSH

Submit Download

PrivateBrowsing_150.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\browser\VisualElements\PrivateBrowsing_150.png
Size 9KB
SHA256 2ee22aa49d12fa9146274dc5a03793fc45bb632bb341799542516fb17c142371
MD5 2b47f5fa099f97fb4b7d1a88aa494541
SHA1 eaaf09c44abcf6f7495224a3a3d8e651afe59403
SHA512 4e4e03b804c64085e701055f9b741f99b4715807682a7141eca184a6ad03fb7626c9ae6e9f74a6dd54d717330b154a68193e52cb97f66bd232f788c77ad01e9f
SSDEEP 192:379hCymCdj+pGzVoFkPc8Y1F266DMQdcv+mwI4NNR92uITz5s:r9sojPHQFVJ3wLH92uITz5s
TLSH
T19412BF20F215CF2E91743884A4CAC6C5D23B7217F7C02074482FA4FB1C2EF152AB5AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateBrowsing_70.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\browser\VisualElements\PrivateBrowsing_70.png
Size 4KB
SHA256 c348fb831e245763f6c1ca74e769599daf4b88d6b2487144a5a8a58c7172d9e5
MD5 f938a334dac97a3b99e020a4fd45e39c
SHA1 b476456542430be300a48bed22dd0b3c496b9920
SHA512 d2f490a4bae244ded37dd6270f01a24e461cc2df2852834133b7a38db7b3f46221fbccc8d66b33eb2237803174f7e68a7b65d28eaea759f990ead3a203674b67
SSDEEP 96:fqPxsxciKQQsIBEzEZXhaOec0AGHL5lYRTBXWAhh3+KW789+q5:fqJsxXQsIK+XhYc0AGHLSWArBSc+q5
TLSH
T1EB919EF983A10CEFBB40289FBB26A67DDC470D7590063234BEC155E32675A9E09E5251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VisualElements_150.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\browser\VisualElements\VisualElements_150.png
Size 102KB
SHA256 68e5025e6835c0142272276dba9a3f2ad8cbe6f6ad8c425882befd3146a9f7f7
MD5 a0ce9ccbf2dbdb3a3d2e044e0f74bc7a
SHA1 88cbe63c90dcbb5c9abdb48a983c4f153513f8b1
SHA512 6f7556d3622868599dd8f3dccbbef21fcd3c9a71349327f2474159a7131d563b176f940882a1c19d3cdbede983bcc436a7f61b50a7495a0a553c6d95e77ee10a
SSDEEP 1536:XqShEeITCdH1Xxi+BmgdUMhh3le4HQtOfRuWaGOaOK3Yf8QKaqaZAtyaiWNy:as5ITAVhXBHTaOVFOaOKjQrqaoyau
TLSH
T16FA3129A941BC481CC5E19B2486EE06865BF95C752264AB4D03C7CEAFCB917CC186D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\browser\blank.pdf
Size 8KB
SHA256 81a4b1da9df2cfe8f229abb939591b708e2a6ab7d4bc58d411ddb471d0dc3964
MD5 0a98a0712d09cec3945c0728b0c7c465
SHA1 f4e62cbdc0afd816e24929c2a6e71e63072c4b32
SHA512 02619d47e399fe4ccd8138d58f68acd9d692fa61a59d43ed5bd97f709916c4de781f83aa32c9404030887afd55467aa2fbf9ab086fa8ed858d3aeb562da6ee0b
SSDEEP 192:KCYALPEyUKCIoYxrfJeHrJhnAynX/fCQCwQwJsqYmMNVoDVoCow4YePa/TY61/:WUP8KCIXxrOjAynX3hCwTLbMNmZLPeiN
TLSH
T1B9027B34E99F5C5CFA94CA1BD276B70D8E99B10F6FD8349241310F52F080971EB6A2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

confused_fox.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\browser\confused_fox.pdf
Size 51KB
SHA256 e2916092e9764860829db21b78ab0fbfbb22f976687e65716ba7dbc16e954ce8
MD5 10aaade034c04af93ad3c805642e5b0e
SHA1 a6e98403bba37c9e87c632e4a8662284a9098e3b
SHA512 9b9621dcc753e8d7b545fa225b2c3504bb8606bcb4b5bc8dce4844cac7f82722bb3882ed8170adb7ef737460b07aa1b078c0ed820ed9d22e19b39038f3c157d1
SSDEEP 384:4c7vp5LOr9QrOjRzYOv06lPBP2R7uJS9lEWHEugiGB2LtlC:17XWRH1J5DSX/HEugr2O
TLSH
T1513363F291801999F401CD789F9F3D9C109E30ABEED98DDA74FCE711AF228A429E51C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\default-browser-agent.exe
Size 31KB
SHA256 01e28ec83d9e595103ce2584c423e20c638d7b1d3b7c4454f5653c52ed5d0196
MD5 74c7ca913c521e001769fd400f2d19c9
SHA1 f14b2fccfa5fce2bf906ee4a16798e71962a367b
SHA512 2aca2110a93fb88134674692de1eab3b59b182ea0b388c3b17015efc6bf52e7ddbcc291fd432f028c575e8a6138cd3f1685c57114357c7cb03368dc625a55f5c
SSDEEP 768:HOAwmvZpMBwlHpUsLVsheSoQuoakqbQ0t:HO2phDUsL6kL7oOQ0t
TLSH
T16BE27C66DFA040F5FC16D13542A59127AE72FB811F6351CBBB86026D2F21BE05F3A3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-prefs.js

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
TLSH
T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
MD5 SHA1 SHA512 TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\dependentlibs.list
Size 67B
SHA256 c50ddbad2bb7ebdf2ec6643fc2e7744adf3870c5744e80ba3665cbdd3e9c559d
MD5 1992be27df8264e37bfe5ab87209000b
SHA1 8ac394c7b9193cbfdff35ea29d731d5481a0ac58
SHA512 0a8515b65e35396db0a3bea1b543aaa95c25b3228cadc66707d4c940b80158bda9c277753df22efcf50233fbaf2174cbadc152e0fd6d43175da0115222c7b272
TLSH
T19DA00292006F91236685EDE1684DC90C801D6156DC9101D05667260E16269C04BD45AD
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\dxcompiler.dll
Size 23.2MB
SHA256 a45f31a3a8bca938b1ba2bfb25815a690abca78bac02287b8284e78a90b2fbce
MD5 0a6415428b28edd8a1519ffe6d6c946f
SHA1 fdc548188718f97c85a36eb9cfbe0190241c0e0f
SHA512 673c629d4e14b5a571385b277a88455cee792bc64cca68f0b496df99fa7351001dca3e3bb9d8c85accc1e822e599e3c436530df085ec9987106cb181ceaefa39
SSDEEP 196608:PLn8gE6byTF5lWua5oiVfMn6puhDpn5yeKr0J:PL8v6+TFvWuanOXh1Ke
TLSH
T1E1374C123686946DC05AC878C3574B279A2870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 dded8c3942e2d8eca65838e55379b1da5765c2dd6183dd5c3530c9976cb25a86
MD5 613815852a622ff9e54d697b9b3d2862
SHA1 a49149260f4e6d09412ce09d5847f15be65f527b
SHA512 64993969eccb8f75496b11cecab6f351a3ac659d8d6906cda2bfec8684b2d0d253f4c1bc23eefbec388939dc9ad0e898bec0a8f3e03c78d1b9c73d714fa5feb3
TLSH
T112F0C0DCB158130016CA6A556113528FB10F11FB46D501DEB0ED80381B8AB4C491EBCC
MD5 SHA1 SHA512 TLSH

Submit Download

TwemojiMozilla.ttf

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\fonts\TwemojiMozilla.ttf
Size 1.4MB
SHA256 6d90152ee0d29e82fe2a87793af5aa4b7ad13e6538360889e141e81ed299ee8e
MD5 aac75d901445bc0419d56e56dbc18891
SHA1 3ada434f3a727167ce6dce3b865fa6bfb70ed86f
SHA512 83fd92ff444ab6de18d48997247f49845abb8420a07b74ebc8a65bda8da69d28f87b6abe0f607b2fd7da398dc0f8cbe7fbf655af6d25785ad8b2f1a3afca136a
SSDEEP 24576:jUx1tOjzy675RUa0cHib00er/4TMXvBo2IvyCPKsUxJug7WwObnkBl0Z1koEXdwV:CeIa3iurjIExYrdz
TLSH
T1EF656C3FA704CBEEF4951AF6C9640A27B5D08D8522021287F74DF87F8C9D3985897A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\freebl3.dll
Size 1.2MB
SHA256 065696ee43963721a0536535425b4695e0d94f2b4fe0aa608efb878749bc1b40
MD5 ad34c39a4ae115f29cb63e9c9daa9004
SHA1 9e37e28b070301d9a9c19108c7edc094b43ddf69
SHA512 d4ae2a543e95ae1efd69f3279188e761cdcb28193584a9639a196b9684896d936c2fcad7ae0829bfcc47be6c19a4b4a325bd8d6a1bbb5d34fc8ffa5ece7c18ed
SSDEEP 24576:j1m82H/nJ99XunnnZnnV8sBkfmRfUUxvfUI0vXJMMha59Z+UMo+hB6L:Bm82H/nJ99XunnnZnnVPafmuI0x9wLMc
TLSH
T103456D0BF2B647E0D067CD7C1396BA23FA253C5D4B5136D357C886213AA1BD4B21AF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\gkcodecs.dll
Size 10.4MB
SHA256 1142a2f58fa36bf47db1fd5999baf5820259460e2b143a7bcbee613486e27963
MD5 64856f0d4d27f0cae7e3c8650faf297d
SHA1 5bf24e9a6807993f00c31431ba1413db13998fa9
SHA512 eb12185bb6924389d7fcb37eeff30aaf49c7beca5330a5365d2bbfa00d05484e791f2c0d9c64620a15a17be5de473ca55b0474463731615d8c39db334d8a5e9e
SSDEEP 98304:X+resjEk6GdCwxnjZ+kMhyjuCxJTNPuBNncTh9jE+O2h/rmuBp5tmOacv6+obQTk:gesjew1jZtPxwIvO2h/qOp58QKRR8oF
TLSH
T1A3B67D4EF1A351A4D41BCCB4527DEB12BD18389EC71856EB77DA16243AB37C0AB29F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clearkey.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\gmp-clearkey\0.1\clearkey.dll
Size 111KB
SHA256 5fe11f792116270944aefdf1ba57c508611314c2a11b6a5f0ed9f7da05196ddc
MD5 dd6d4030055a9b5914788ea05a4eb48c
SHA1 ea480de9943226ebb3e0ea41b89c512ef1e75385
SHA512 fbe53d330322ed7de7c6dbb958c470df6d5847790d5196ecdf7c846bf6ff47ae2e77f8753ca7b94001fde5ccd0374e5f58b14b841ba036977bb07dfd007a231e
SSDEEP 1536:58Y0s17l6EhSJjRNccHreuyyHnIR20TYpGK0uiC6kL7od8:59T1KHhLewIR2yYAK0uiC6kfoK
TLSH
T15FB33913EA9A90BFC649D97892475802DF63BC864B5276CF53510EDA1FA2BE46F3C300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\gmp-clearkey\0.1\manifest.json
Size 229B
SHA256 ef47e83036753b53f59d079fef62bfedc749abdbcdb0fe16f448d9920f11114c
MD5 cffdadfaeeaaf0a5a78e7f9a299aa7f1
SHA1 7a8f06d7c91877484301ce8474dfbb1bde08a040
SHA512 5a11e448389326ddbd3be792d9a10ae746c66e4a41f9c96f4979ec71fde385fc4deb205a40f1b4f24415abd9d41c453ca1285f4b813005b1d12a2701f214db85
TLSH
T100D09214C812DEF33CECA2295D554D5867A9129B19823C847B08174EDF599BF92AAB0C
MD5 SHA1 SHA512 TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\installation_dir_layout\versioned\InstallationDirLayout.dll
Size 19KB
SHA256 3428fa4a6d73dc71546a72697c80e245ff57819e19c7cc4b5711a57846276509
MD5 7b93c846d9f73642c2575af94117a701
SHA1 f1104bae34831e6140eed6cf281ad6289f8681fc
SHA512 841e52afe487df75f77febf27b1e1e84fb396b270049fee82a8803acb346e554e5e59fbe71c7ae06889917019a02e1f38f1dd6ab7433a87ddcdde2acd29d44e1
SSDEEP 384:YNmCCN3LNn2ddsKu46dWl2mNDsSofousJUKURFaNyxkOsSoM+:6jwt3BVsheSoQuoaEyxkOshM+
TLSH
T16A927CAAAF6044E5F51B8A7085DD8A1BAD72F7805B8142CF6218004D1F937F83F3936D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\lgpllibs.dll
Size 161KB
SHA256 e272866db33183a4ab7ce0036ee0395406030c22038385da399d12cf0e53e4f9
MD5 8510fd51781e25519faedccdb4f3462f
SHA1 7d52fd468e0b06270f82b7e732e4363ed8858038
SHA512 901a92db1038d20d739319ab5c13fe2c05c1613e785e4b5a6fb40d8c065bf880d00e47372f06d5d43bce3a1ad3678993de8a1b16df0c7d8b52c6624a5181101f
SSDEEP 3072:EtaNMj4r08U8SO2HegDHYvME5GabbNNV+urBnr3S6q93EduDoxWQnS26kfoz:EtOMj4r0Id2He3T1NV+mBnr3S6q90dup
TLSH
T1A0F38E25DE44886AD43A8C748DA38A179B7E7C8107151ECB5BC45E9A1F1BBD06BFB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\libEGL.dll
Size 57KB
SHA256 341cd2a7718958274aff31c9fee0f09ed1afd1340eeb05e2ffde9b659bea0723
MD5 befe4508c0c79fd4bde0399263191bbf
SHA1 8b65808110c761ec1279ff5d66c19392492cf6de
SHA512 e344368f80df16a44877d39de7eec0d5ff0fbec6b67a8ea1eb5958d48bdcec04a385ab0f00a998ce82e7507d042e1921380e3a77a0f881a148faeb60815f8c6a
SSDEEP 768:fe2kmzvPW2iggs5a5r8tsyw1aNZTx56nvcERWR4EVsheSoQuoaeUtF:G21e2igZ5a5ZD1aXx56njRWiE6kL7om
TLSH
T1EC430A3ACD6AA237DA0D8EB4C9A30C16EDA1BDD58BA274CF67140DE50C54BD86B7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\libGLESv2.dll
Size 4.9MB
SHA256 7f9391f6c4c9c4033c6add08ecff49ed65a1883ff2ef0352e373e6f3171b197c
MD5 45ea40c4ed40e722feedeb67ac3cf114
SHA1 be20afd8d2f199ac137a2af50707477bc9a40510
SHA512 6e874c408b5a357148f3bcad0b04d31373f0ae5d135d8ca74f500cd05b12b575fe8a57c8caaec28a34540843a06e1eefdfd1846080308797ed9ae33fd31f81df
SSDEEP 49152:AVazQiqiuAPU8H7Z4ZDaLvQn2HypAGyRA53RObcfPIw8jkt3YEKldSFHlGq8mrWZ:AVkuAaeH9Dkt3hFFe
TLSH
T146365C07F6A140A9C40DD279975B9623F636B889071173CF269883363FA7BE06BBD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\maintenanceservice.exe
Size 267KB
SHA256 bdd30603c18d7aaf366f06d296c1e4668a2e4b0e4678eec059b2166d76b527fb
MD5 4172d3ab94f29b09e6d2cb72dbd18fbc
SHA1 321009e143cd112ad608b0a423269327babad3ff
SHA512 3a379b8d16af04d5053e215cd6898aa0b2ea34963fe7ebb689ab6ff625bad6c728389b03560e8245865db1a09cee5eb84b4bfce09de638d06808d4feff4db121
SSDEEP 6144:E8VimJlrSUV2TUaSlr9/U+SJZ1fJ4wj5CLf/Mgs:tkmJlrFV2+9/U+GZcUIf/1s
TLSH
T1D1448E2977940DF9ED6BC23CCDB28516EA72B8514360EBDB03A489261F237D05E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\maintenanceservice_installer.exe
Size 181KB
SHA256 e03e88773dd3e89085fc216f0d69bdb1f5cc1e0154bfcdb097cb9f3d85947569
MD5 6ed6f008726a3e081207b020306ff848
SHA1 b125edf56847bf3f5f406bbb20943ccd8b51ed4b
SHA512 81952a7a37f9ccd4efd1489fedaa2ac8891807408b8d814170d0b8dfc208f30c3021ad5411b83cc221ec2ad579b93b1cab0fb49632cb74a95c5dc4c0be74d2ce
SSDEEP 3072:eNRCywDw1DiJku6UNRD5bEmdtjem7y6tuU/RDObU7y4jem7y6tm6kfoy:eT4DtOUjD55dN9oU5DOY7y4j9Wgy
TLSH
T10A046D01BBE0D592F9B20A303CB79B365F31FC666E90870B6350B75CED72391A92535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\marshal.dll
Size 498KB
SHA256 daeb83b04a5cbbebb56c21662d12ab30c1ad7d49d685c071e096924a185d384c
MD5 7f6f016caccb452d600fff22c64aa9a5
SHA1 0ae2ddf5494c1b9c59dab034e8b99bb9c35dead7
SHA512 eeb9b62b6ecfdbb2c9b51f6a3fd7253fd73178be7a7927f9b8a0e36d66d3b1a7b48752241a0ff30efce476259a899d9b35d8f8cb83619280d4c8b6be223211b4
SSDEEP 12288:wQFOnIXiS/m+7FpMenWosalm9r/0jX/L/yH6a:wfIx/maFpMValm9wD/yx
TLSH
T105B4068F616104A3C57F5378B95F474EDBB1BA1103509BCF026072A99F5FBE42C7AA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\mozavcodec.dll
Size 3.8MB
SHA256 331514d07402873faf6d4afd1fd8e256204eccaa15c0fb27f2c14722eff56d0f
MD5 3e0aec423f61fadf5eb01caec347eabc
SHA1 59de52d59cecb25fb03ad990cbe013e8045be4ae
SHA512 b8f211003865461694d5e0e2e3a11ab42feacaa5fb576057279f34d66471f517bacf7d47a1f77349364491ecdcb5a9c9ec38a6aa65af94c9498d7980168c5e77
SSDEEP 49152:XfjgPUnOhYjyStoC26ags+B+WWj2sgRVxSV6x0fY94S487bG8+cIAZGf6ca6svhs:XQzStJags+B+WE2sgHu6xj948G46um
TLSH
T1FC06AF4EF0A34195C50BC9B493BBE727F924345DA71475E71B8782247AA2BC0AF3AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\mozavutil.dll
Size 595KB
SHA256 43b8a26a7a54ad37bb4071970714eba016ee0c0d8df2a6d9811b25b709320ae0
MD5 6e19a2d92becf9b1c7cb1503777986ce
SHA1 70dd93efb91d65d0e568170ac7ebe2467d4e0506
SHA512 32f75565577b006c924fbc441c66dc182f703a28617be3d9fce698cac2afe40f6066ce7b324399bd339e543634a85aa9d88c8c35f4699fe537bf6df6f8d23456
SSDEEP 12288:U74r0T54d2Fnc8mZLslR7T0L6P1wiq3Jky:U7YO54h3ZLk7oL6ZqKy
TLSH
T152D45B16E5C2086FC4068575839F6529F3763442CB94BAEF379205243F28BE17E7AE36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\mozglue.dll
Size 726KB
SHA256 5a7d5843af794f613597cbe1210e6561c22d653c687cfd450b420ff29f5f7505
MD5 62a368122ea789c295214e4cac7763dd
SHA1 887512bb6414f4d67347a4bc01e2f829320deb3f
SHA512 6069378b10a9cb8153fb49e29fe954ef6ef9ad738212e7489d60b696b2a791cffa336482ba891417a1641cbb1cf603682dd2ba81965f64bfe4353108339d7e76
SSDEEP 12288:GohOrzFtv5pzZ9o9A9BWB4MUgulUOZFXqSFRnOd4AvCY:GosrzF/pzZ9o9APGUguuOZFXqSFRI4Ab
TLSH
T1E7F49C13F68A41F9E058D539579BD523FA72B8450B24B9CF0790172A2FA9BE0B73E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\mozinference.dll
Size 2.2MB
SHA256 74abf83360032802db5a4acbb24bc29ada1bb11d6d0c4f18a80f3d33d6dd755f
MD5 85cd16fd62204d03eab84614d8f0bb98
SHA1 68f12f686d71e8e0059bedd60dc2dc20234b303e
SHA512 2cf0fe023dc43259a01240f23738eea7f5df138706a374fdb0ff9e5f3ba0659bf883ae22c2e18620d6e7a3ff1da1e217f8b48af38f532968ab011683da8bc149
SSDEEP 24576:arwbMsZH2KrrQugokbdw1BEaFp16R2V+dYjbnT6ho4jqclhn0s:aY/ZH27ugoMaBEaj16k+yjjT6hhqclhd
TLSH
T1E5B55923FAA081A8C09AD0794B59D673B635B88C872539DB2F544B513F75FE02E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\msvcp140.dll
Size 530KB
SHA256 2efa67fa2828da813879b4df1218a997a816bf4f60e7ee9868a6445bbc73c97e
MD5 857fcc9f765a8711a31ebaa9061b1ab6
SHA1 f89516be917a635d2ef80445fca0a6c2a4b44a00
SHA512 83635f7369eec7ff087c76d2d1db25317b21f7b8c3e536e50b6e0cfa58c5617836bfa06ddd1ef0e5df10ac837662c5ab33ef834d13105b83a7f5ba45b0b36250
SSDEEP 12288:30MrE03u1mHWV/I3z+bQEKZm+jWodEEV77q:30p1F/IiQEKZm+jWodEEN7q
TLSH
T1FAC41A23F75906B0E195E3B8A1838302D7F1BC598322E3C752EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\msvcp140_atomic_wait.dll
Size 37KB
SHA256 5dddc5cc1ae6178b6049b9c43c7aacbd126a28702c0ed2ed457d0adfd2a6f58b
MD5 af7ab12345560ecd55321d315ddd0b96
SHA1 ec18b5efd9ce77d557ee857dea27ee6eaf6f8726
SHA512 75d818450079240b8da1bda25373d93773c74f8e0fa94babd4365dd754cfce8b6cf162a771e80b0a085737b96ce57d835d56543b5e91b553da37464cb4a24020
SSDEEP 768:tPMo5RIqKYwIgMhpLDQl4wFbZVsheSoQuoamf/wy1P:SOR+tMhNQl4wxZ6kL7oPF1P
TLSH
T1BA037D19BB5804E1F5578735C8DA122FEAB2B6E087208BCF2225559E0F53BE57F34B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\nmhproxy.exe
Size 642KB
SHA256 4f1937d9a2914351c3e2fb2ef00713c1c81b1a13d388aeb4e2e0919208a26355
MD5 b96f139671c7ef0832e8fcc8ce97633e
SHA1 a0f6aa5434d5967a40376dd1cc92ba9ee783c636
SHA512 ba8046448ce8a5bf32995ece414af1a255f7e723e34e0ea3075960be91b36b07fa79c714c97386bf54722194f7de097cef0a5ce34fa977f0a64ac19b39ea6251
SSDEEP 6144:z1lV66kwdUln3IvPmnh6OCZI4qb1t5+TcA8QkxGQNEPcfQRD2+OSzzpAQFZ1868X:hlV66XAB4Dg6rkxhNe+QRISfF50
TLSH
T12BE44B13F64689DCDA1AC07D871682326633B4994B3169FB21886F3C3E67ED61E7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\notificationserver.dll
Size 59KB
SHA256 b1783c3218e0360afcdd8cdfb70b6e2bb67b6e4323dede89c4fd5a43df51bee9
MD5 8ecf8f1faf1eb18ad301bd402e06125b
SHA1 f3b1b28edbcaf4db7491ea1938d624c115d50e18
SHA512 4429b1c165f755132e83cbc43b296ee76d626b385ae2e7b9629049d65a1ea5c8793447a47d226a36489bacd3f00bc22a5109c050a7a936fa77cebf91f88d06db
SSDEEP 768:BJn5UBSXv1biOFFzxJ36wmcLuJxCgK7uEraaiNQalyDDJFbLSbdNVsheSoQuoa2h:z5JXd596sqJfk1aZQXWbdN6kL7oF
TLSH
T1AB535C47EB9500ACF9E6C738D2AB49129A73FD5D073161CF0385412A3FA0BD49B3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\nss3.dll
Size 3.1MB
SHA256 6ca79625dd439c8edcf715443305e6c9a275c7f3354795c96a16d178e56fa9ef
MD5 4339232682d52a08e7c86d05c257bdc7
SHA1 faf839f28e7e02871b3f42d6855f29b032bb57f6
SHA512 56755cfd046d6e5975a39bd37e20cd3bab04ce9570633cbbe09fb25f5d7d14dff622e64e3598e17fc98706d9482079e9eace48b2655b4d5f7680e0743e56713a
SSDEEP 98304:X9UJMdieSeojtFKBRyoNUFJEh6aIKpCSd4:UN3FzoNUMIKpCSm
TLSH
T179E57D13F2A510E8C029C279979B9323A6B2B4454F3876CB52945B153FE2FE07B3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\onnxruntime.dll
Size 9.3MB
SHA256 efd74e41721ba08ec956eeccf83c81a91a60044c58ffbff2f715e2ec38c97721
MD5 1f88e3a0b22929e89c40098b3bdd4381
SHA1 0f3b65490b0d878c90f08ef4a25d8707261707a4
SHA512 527f6604bce1b6aa47fe69c747d47d9a20aac4bf84301970abe40b8773d4ab33a935d72084cd51e855152f14928a7706ce97274c8f477db0bb71c073e98a5272
SSDEEP 98304:2sihXTtRrgHYsE1/0xYNAvFOyj1rYOCmelEwEuTB5Nnad04FyP:2lhXTtRrgHDBxYNAgySOCme1EunN+F8
TLSH
T165A67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB01E254912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\pingsender.exe
Size 77KB
SHA256 a87f64606f539d31fcd9d5c296eeaf2db48cabfb4099de14a1a2f74f2cb5e902
MD5 0d9e1b73e13ed40ac882c37ab9063e1b
SHA1 8504661520f1ddc223d80e83a6d16f20a12e85d4
SHA512 fad30488690fd9c614a465a0d95e7994ea2cf9e5363ef61bd9a00c11b5a679e524916d41af02547bc260b0a474a248dd6991903e7c36e1df1142a4deed886a92
SSDEEP 1536:gILDYRoDMwGZw+adBkxVyFQ3Rn6dhi1b6kL7oO1:gILwZw+a0xnh2i1b6kfoO1
TLSH
T1BF736CEA5A6051FAE451C2F0D2EA1313EB7575892B2666CF938453623F037E01F7D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\platform.ini
Size 156B
SHA256 450043e80a7dc0c6bcfde25f098419ba94cf41c4a27ea48c2b98379c24f3396f
MD5 3b761602e2304a5df4ca50629c9805d2
SHA1 285f91826b82000f6cddf2a338d9f723912b9495
SHA512 aa22302d02211ec46e0335eefc76a670dec21d2e6387bb4a7b3c0d005a6fa148f3c384c6aa700c7b565bb8b16ba74a1740bdc946492232e0b42dce75dbe832f2
TLSH
T1AEC08CFB040118798FA63DC374F563899E160EA04E8BA018B0A1428A0DB190B43AB425
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\plugin-container.exe
Size 139KB
SHA256 dff2df9aa77e3344ab3fed57f02b6b02d7b6f3cb03154622243beb0437a1c1e6
MD5 76d57f93fb3b62330f13844fc66b1852
SHA1 da56eb9c355d3f753697a2396cbc75c0bc09285f
SHA512 463a5890a6af4b051abce429ff8a53202fb40d80cf993db1c35f3868517e1234585d7c0c0be47a689ceb433317143d9be51436cb44650be92f0eae4f2440f3a7
SSDEEP 3072:9LsdUYIn2jRqmNXNeSyYA2rAG2q4V5MbM4t/B6kfo+:9LlX21qQXNUX2rAGL4Itpg+
TLSH
T149D35B13FA5950FAE558C9748A920512DFB2BC860B30A7CF67940DA12FA5BE4BF3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

precomplete

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\precomplete
Size 2KB
SHA256 22c96cbf4013bebc53b40513ab38df386f69e2f39755ccd85b3efb19699dd42b
MD5 e48e2c4a43825a2c9fb8709991165ead
SHA1 6325093334b65d628f9f217844d0dd4b3fc7b0ff
SHA512 7302dac2c8aaf8eb4317b3e0acbdc63523e5f4c1510cd886fafd11201cb0d791bc922c50bec05050f1348276dcc6f41fc6ea3d0fb6111a84ef42b04cc5085a8e
TLSH
T1BB41258CD02EEE6169D651C884D31D8F3DAB42A6DD9DEA781EC311447FE35EF010D62A
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\private_browsing.exe
Size 132KB
SHA256 78b0c8864b2429b671d2a7adf6f77b1051ed3a976dd0e7d2e9ae2d30d4589dab
MD5 a86d4bc85f003b2e67459b6092668590
SHA1 bf8b13d59891fc6e9f6c813c525261824c402f22
SHA512 933e066a415e2d5fae75418d35ef1d2b7794d938068bc754d1493fb6b2ac915c07e429f5582da4badb49a1182f81c4dc83eb18376ce3e7fdb2410ac1a8ef5551
SSDEEP 3072:yv1i0UtNqFx6m6N3MbE/66TsnA7FpK6kfoM:y12qH6m6N3Mbu66gngmgM
TLSH
T1FCD34F8A9E858E57F07CF17E45B68D35D55AA60F230051C3BF3CAB83EF58B94282D606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\softokn3.dll
Size 355KB
SHA256 064cb540b6e8468bb88bf5d660613b9b8b9e4fde7fec20f604c90689ccab8178
MD5 c298f810c29db341f482a829f91ca026
SHA1 55188049d6ab1f49a406582d3c590cb90d24f896
SHA512 bff270128e29738718e939783c40bff92f595679a15e7d523be195eb8aecbb4852edbaf842ed1a04adfa89d7f7fa54cba43f1129dc3b124f190e00abc26099d3
SSDEEP 6144:C80A2J4DmexNlUGyE3QovWJ5SCyVppCTca83eufTySJtoON0E9kWIx0g5:h2J4fxp96SCpcyymSJGs0E9kWq95
TLSH
T1B6743B03FA9155FAD806C475A1678732B5B3B8940731ADDF93285B2A2F61BD0B73C788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\uninstall\helper.exe
Size 1.4MB
SHA256 123a78bedbd671a0c3e60a659b4476379099c452903fd4d101b2b242d9fcccb6
MD5 7cef90b9508de405f61785251bdcf811
SHA1 bd50ef1a50f0a7135c06195b9c26a7fd790bb96b
SHA512 28d24a66cc63ffa1e59d35443d93fdac926c9905d3414fdece3ac30261e167094f68e2ce880ebe3af6de358747bbd0d0493d1094cb5511b4a08192dd078ea00b
SSDEEP 12288:8TyUjD5hFL19euP+bnEPsSjlSoTUJDJc95+B7a2SooEPbi:8TjFLfhmbEPsSjIoB0BW1oZPbi
TLSH
T130651803A790A862D46E6D3064ABD7253B37FD812E7186473B1DB39C5F73340AA7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\update-settings.ini
Size 116B
SHA256 17224c6040c70203f9228f35c345ba7f72e3be84ddbada6fb8f971c701e87e30
MD5 68acb4ae209a1fe7910b85a3c43c5cf2
SHA1 c70a6335fc65b17453a88e59bdcec7a067c94cfe
SHA512 3bd99664ce6abd681bcf8c089c7db5759eafd165d6f00adaa8c900f7b988e98cb99342778e90658ffb17660ff95023f49f8efeac28bd7c366a208df6c3e1bece
TLSH
T191B092895A94A84C8113C462EA6D022305A2C529090521252748E441B3E77208ADADAA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\updater.exe
Size 984KB
SHA256 d83359bdf81232bfe264f73e25f0862bbc9fd2f7b858d3c8fd7fc1002ce84495
MD5 52bdefcf06a9c503c01b641e5b2fb865
SHA1 32e0bae03a7e33efd349d16818c7ef1620ab7d49
SHA512 3bc3a5fe500288ef2aea3bebb4e9c9368c4b67bbb4e3b4064ec17c7779a3dcea87df4ea0bff12784925d83e7d4a75e0c8d91776b79375ee386b3685e9be4e7f2
SSDEEP 24576:JsVMK1ud/HFTfkxEJt+7T3+T+h0lhSMXlXU2zXJ+RjX:JsiK1uddTfkxh76Tr02SD
TLSH
T14425AE1BF79441F8E459D9748BAA4513EA32B88A4721A6DF07D48B152FB3AF01F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\updater.ini
Size 1KB
SHA256 a6d81b46188b52069c2582dfc6b4d682bb722c2436cf5f531fe6ed0c94952c9d
MD5 27a5a5f5ae9b41546c9b6c7a0eb6f026
SHA1 21dcaed4a05199f407230b60fbc554a23e195f33
SHA512 a6208e3819debb7a169adbfec9a426570acf5e8117258dbf8faea4d886c923007e52cdb3cc46028878c3aeb810a9f7b9482f92b1f77b5899319a1644156b11d4
TLSH
T1F62121562688B3F409D29B85BA4633D6D78381ED23513120A0ACC160434793547FEBE9
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\vcruntime140.dll
Size 110KB
SHA256 b7034e14d2ade740c06ad8d5e0cce71eca9fdec91fa626bbe47547257a9fc23c
MD5 3bc035789ff8df5fc0f486e92710e9f7
SHA1 1a2d070a07305946f5600d0435d0e20b98d53ff2
SHA512 f68df0f19c092214de88ae00871ee6b034c2547e1cdfe968c422ae6a831a9f1680fdc1d2089ace33713eb5ba2a5727fa669ec310570571f2bb5ec0ef880533cf
SSDEEP 1536:h9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lg6kL7of:VyA+3EOfmpcGSdOecbeQ6Nxg6kfof
TLSH
T1A9B35A4272B802FBD16AD275C1939E6BE7B2F40587649BCF07AA46660F537E02D3D381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\vcruntime140_1.dll
Size 36KB
SHA256 448c68a5cde6436bf169264d8d41901c0eeaffa146c6357674bf1afffb843249
MD5 c4155d5430e1f8edee78daaf7eaaf7b0
SHA1 a21ac2e1d15d23ba751e2065d562188968e84846
SHA512 70ab03a8451a92a2def1dec72a239bfb71254800ae87f806d54cf08cb0e3de5ff8fc20586bbb667b58f3719e27f0515890404c492fadd8bc72c2903ebf684d73
SSDEEP 768:cezSkbhNfI4fWLZyS/dPWxuVsheSoQuoaK9sLHP:/YZyuPWxu6kL7oL2v
TLSH
T19BF26C12976844EAE4A7C670C4EB0E2BEE75F590976087CF2E68455D2F037E06B3D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\core\zen.exe
Size 862KB
SHA256 1ec60beb619df54cde1a3818a17ad45900c38f100f54ea9d91c48f27a4521480
MD5 2d48430ed0cbbb7a31b3a4093f2922ce
SHA1 49dc50958ac1b05fc6108dfb1606fb10949cffdd
SHA512 6a2f2c5af2d8c94153c0d9e59f1dbe7ae5da8e372c42cb55b93946704f86175e71d033b722359da2a9cd1cf9a8fcb81cd9bdac4b17313c6d11008d9160379e68
SSDEEP 12288:qgvs6SMZtvV1KocK6SSlqC2v6IKQ4wbGYbG65bvngdrXfPS:5vs6LZl9cK6jqCE6IN4wJUrX3S
TLSH
T12815B312AB858CBBF078C0398676CAB5D5257C4E83D051C73EACBE633F75A9016F9606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06A0908\setup.exe
Size 1.0MB
SHA256 6b7514ce0b3ddfc4f67207f6267943996c5df9ac47e9ec1b7b56a4ecd51b5bd4
MD5 68c1a4bf18b9a77d143427e1e8b06b74
SHA1 75aba3d2bc633b0b70d9f3a72e683e71e4e1be5c
SHA512 a8c8246db97968f31c4d3ba2b79c098543bee2767a96816d6707fd9603fcf194826fa775c94c6b16f89ce6857e419ddaf518de9992c704a826f6b54abec29d91
SSDEEP 6144:VT4Dt1UjD5UW9YM9es0mPH+WSnEP+rdlqSB9G3SoLg1:VTQUjD5Uo9euP+bnEPeqSjwSo81
TLSH
T1B035F603B790A422D46E6E3068B7D7553B77BD822E71825B3A1DB39C4F733409A7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8be3985b-70e1-4ba7-a2aa-68cc6e2a2337.zip

Path C:\Users\Admin\AppData\Local\Temp\8be3985b-70e1-4ba7-a2aa-68cc6e2a2337.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PinToTaskbar.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\PinToTaskbar.dll
Size 3KB
SHA256 6bec8a69845fe9012a0622e79b63328fb611151fd24f198a779d781a36dce5a3
MD5 70016ab449dd0034333b0df88193cb82
SHA1 add0b693b75f14e7f9a063d0de1921c3bc8d1a52
SHA512 1295dbe8596a37d0799b51c3be011b2aeb499d382bd860bba784dbe5a580f6d2e1116830c4c619ef32df9c5f7af0aceb600c2c7a29e321cf8e355c73627ffc71
TLSH
T1297162F3F3644076E22903B84847C42CBABCAB1213AE4697789B611E2E50CC579A3D92
MD5 SHA1 SHA512 TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\components.ini
Size 602B
SHA256 f1505640e352a1748d1cdbc6eafc0ab21b0de520c6ea6b750d6eeb41b868dfe3
MD5 637a9a06841221d166843d55316167c0
SHA1 0aaeb03991f6f828af3b90f37e6c73ee7b94e6ae
SHA512 7a3215326798d9682a8fc2eae643d47314c971f5acda4094d1e9daf59defcfb36e3ea86ccbeb3426160e0fe29fb6339c9bd70b52317fe8c1b42ddcf3b8f106eb
TLSH
T1F9F09A472AF80418F4F7B709FEB441718B393C45583DC50E91E1080E48E4A808877BEB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\extensions.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\extensions.ini
Size 246B
SHA256 353c5908e3f4075d2d828618b39d27fd88edc344f792c732401b9a50a31b2f08
MD5 46c521e239d92d4003037bbb3b2938af
SHA1 354712cb1d830db838345d3aee503abf1de5d013
SHA512 d468a20d70a1771635b9d9548e4164c2f84162bf36b180529d15d1d4706be612a9b64683087a8dd0966af5d6fc67116e5f4cfca8648b915b1845760f61158e06
TLSH
T1E8D0C9032DE90024E4A8BA19FAF540719B3978881C1EC80E91D5094F48E5A818577BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\ioSpecial.ini
Size 1KB
SHA256 8ab3b609c24ae6d6b2d358650579e73b400523c0c6ea1478012125db30cd6ba9
MD5 edf1c9b989e1328d5cd41ee8b4c7b17e
SHA1 55b2e332b2f30c1e25e347e607776ac0399d542e
SHA512 c317453c350ed73056bbdb8545fa37f2de45c938634de2117aad983fb4e7050d72ed062a1e07740dfe7ae7839d248d57a75e70c0f5324c6ae3300614556d6290
TLSH
T1EB218E032EFE4424E2BABB48EBF5903597397C55582DC51E91D10A0F48F6B808927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\ioSpecial.ini
Size 1KB
SHA256 5d38aedcda47d8b7b0e62468ee8f847b1536baa0f297b3c5ebd72914daf6b2e7
MD5 ce703cf495ce7ed6340d536cff59f649
SHA1 5cc67f33f7bfbea7fedb4ef5fd5a6718fc0f0802
SHA512 f03ffe7834b552395bbc4c0e4033b1364798c51052a4d8c98cf7ee0a2ec26a7a51aa4cbb71013a7736d63526c492806f16cc173da104248f51c55ead76120533
TLSH
T17A319F437BFD0514F2BBBB54FEB451798B3A7C55A83CC50D91C10A4E09F5A508923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\modern-header.bmp
Size 25KB
SHA256 689ea80105f4e61ffc73062516c7d7053f92bae0c700c0673c3a9b445345df1d
MD5 cb1c4da8daa79279041011b85f48c3e1
SHA1 40496c445e18eb28686ef1efdeacf39153a91062
SHA512 eaca5a8e4503c3b62a3b675de44698af80952708fc4ef19a1e0174e4dfd5d6d4af3a3a9f02c4c8ae2c8fb257ff15fd26798d5dc04cfbe727a2fe7050491ee5ae
SSDEEP 96:aCCLLsFslQUlQhMs32QcJYQ/KgGvpNgFtQXPFD2ak29SiD0bFSCxPw:aCMLsFSQOdINUMD2V29S40bkCxY
TLSH
T156C26A110F8E1647E922B2AA323235587DCACE0D56F34667FC0833CE8AF701C2A352E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\modern-wizard.bmp
Size 201KB
SHA256 c03931e6f022e29943d410030595712a29285c1130537d552a7804845a07eca7
MD5 faa41c5d172376cb31e0bbee19d332fd
SHA1 eef931a54b02588e2ee9b202bda14a612cc8f423
SHA512 b65514d05512cbcf27c5a06b97a2454f66a58a2edb081fb1949a0d91d3d9a47c9eabba6dc521566ec44b7fa7b7a863d4bcd6d5bb01a6633d978441b6bf624ee9
SSDEEP 384:sGiFLVfy3SqviWSlk75o3gDVxYi9eFQthspiapMjuqh8fLCG8YHwDT1bmJ:t/OiapMqB
TLSH
T156147F8751C424B9323C3E4292AFA80974575481BD3DBAB63E8DA3634F938E78B3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\options.ini
Size 1KB
SHA256 fba4cfe357d29168de21e4718f15f070d08fc0241bf771d5ac9f6373979de176
MD5 15ed0cec8a172e53230584b54b69f882
SHA1 f58239eb5b9693b4baccc836f901416c2bc776ca
SHA512 620e4b83a1d2d5eeca2cbbf47874a97889f035a0341bd38aa07be7aac41d283a5cf7b9b86f1da60df0ea0ebef64e14d5f6eb76da56c40fc36438e804068753e4
TLSH
T1AE216A632AF94116E5BABA08FBB581309B397C46583DC60E82E14D0E0DE57808477FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\options.ini
Size 1KB
SHA256 0d0254023d6f00e0e3b222e809e1e56e3fb2868a0e2880ae3deb689c8e4ae2fa
MD5 7aa04a3a08cb12081e43855af46e7dec
SHA1 6e68d909b38a3961ff81ce446237466538edd2dc
SHA512 d405d5112133a3f7ae2dfcd765516e6eddcddcd8786eccd206b5047b1f717de75896f71ca9d0eaf1dd0cacb16ee5f9ea706850970ac0236ce41a722239e8faf3
TLSH
T1922180632EFD451AE1BAB719FBF54031A7383845583CC50E91D10A0E49E67808967FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\options.ini
Size 1KB
SHA256 434b133eb83958db0514af3aecf1aa0157a880594d95e5312fa7d76d198d6160
MD5 436757c33dfb4db263700adccf210e41
SHA1 584bddd8b97e15730071bb3e096aeaf0650d9b5a
SHA512 9a6e3e161a12f7914e476b74f24ba9470bd71712ece042f3dec2e5145092c79fc8cb3a9125bfd1bd32e1ccb70c7b7bdabffd76aae159de18b05c16f3502a8c22
TLSH
T14A217F632EFD451AE1BABA19FBF54031A7383846583CC50E91D10A0E49E66808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\shortcuts.ini
Size 848B
SHA256 8578486cec4937bdba986c11b251d241a181fbf6f09233c1daef3a8d9764a6f6
MD5 36d7b68eb45baff04dfee4e632d9161f
SHA1 dea95246fe37a26be3bd36fee93e43c75c39675f
SHA512 388d2f7176b10df7a879b640fd463d664d6c94650ceb2956b6eda82172dc18d6cabd727be312ac873ee9bf38a469ff23e47d042fffb0a1aeecff49978920a816
TLSH
T1AE0121032EF94015E4AEB64DEBF540769B397589182DC81ED1E14E0E48F96C08577BDF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\summary.ini
Size 810B
SHA256 8c19be3f30e74f78cbf8c835b23fec8c9c63dfa0d2d7f24ea511028d3e76e59a
MD5 23292c6fcdf4af46edd78bdf2fbd0d19
SHA1 3d6f6e6f0ea5b080a79ed5b82ab7e70b8328a331
SHA512 df84b10e49dfd3bb07757c74a3a2a8e1e308f408008d099d8f0dae5859d197ebcacf266c1408db81098104414c8cf03c0a61b5803befce79d0fe462f0d3561b2
TLSH
T1C401A2032EFD4028E0BBB609FFF14475A734B816182DC50ED2D10A0E48F56508927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nse4EF7.tmp\summary.ini
Size 654B
SHA256 f992973d4bd9c3a9313b56f75133df02a7bef20dcf0a72d8dd19717bdc08461e
MD5 fe47800b5174e74c796f8d0bfa4b9af8
SHA1 c420f33e2d5f5e1750a4fdc2842d19f9fb71535f
SHA512 8ddc435e96c4062f18462f02ac5e3a021c9d72b6160f9d9c4f1284420d29da3100493a743109bc0bcf7e7355dd482691a48eaf7a0487bd1379e376098d54f115
TLSH
T1B5F06D436AF84068E4AAB61CFFF5807597347806182DC90ED2D14A0E48E52908467FEF
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 546KB
SHA256 86d00885177880a37721807fe8d9f54e922d5076ec77020af121b1967d6730ca
MD5 c903163a922ce45278cf2c9a7ae37e58
SHA1 f839cfd78a5a0a684b8f03b17cae9f0b8d373fde
SHA512 7c5fb1c99762396c6ce9fc2dae57f58d1048b0610f52e86f5251fb26a7decc15b9cb70369314fa348edbb8be9d90ff830375ed80aa42f847094eb96e86a178e2
SSDEEP 12288:bLS85gjrz2IOoyWpqvfbYIaW4neX2yHqN1X0oDUj2DjyrdEhlY:nS8ujrmoyWpqLqjy2mq/0o+G2pEDY
TLSH
T13FC4F2F5B7A07CE3B7BE024B9D852FAD1A525522C78FE0CC543B67C2495772AAFA5000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 23KB
SHA256 98d20fde58130fa34aadfdf731c7a3b7d63ee8472abe375516f69876f308c10e
MD5 d6b2437974a443d6dfa874396cc7235c
SHA1 c6e0862067c72dfe24d5a356b60737b67d1a4d12
SHA512 45de628c195ba9cd39a366169afef097a3bbcb8e194bb36cc3cf096d436cc08c77f778464104c16a4afa6e168eee2ab3ad79741812c8830ae2ca9e1cdd065a8e
SSDEEP 384:pNT5fDTJfmNlTlW1qeI/E3rPNVeU+Ph5n8tA82pWLp8ESYIzbZUm:D5fJiWAfYC5PfMzrLpMFzR
TLSH
T13AB2AEAB5E064626CB7B873500F2C141923C443DFB49B5166DA232991B1FAC83F17ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.shortcut_cache.json.tmp

Path C:\Users\Admin\AppData\Local\zen\Profiles\va2dghtd.Default (release)\activity-stream.shortcut_cache.json.tmp
Size 65B
SHA256 d7a8116c1dc3eb9bb628d3b2a948bfaa3ea9039bb5431f29c7ba944c4a93afe6
MD5 e3cead42e656b0391e52e7c59aeba93f
SHA1 2319b907c17abcd1489819e2653130e0536bafb6
SHA512 abd31a70de57ca94e4e2e0c055ed234b7554289a449ddca3f9bf44de277d74a6aff0b095b1fdb200fc88069bf948e0ada674ed11ad9463c1926ae6e8a07ca0dd
TLSH
T12CA0023064BA5721D973E416DC4C0D55F9E1558A69CC4EC612A91F451014975158950E
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\zen\Profiles\va2dghtd.Default (release)\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 21KB
SHA256 3002aa98f58e222b23e1df864c6a9c21f9568cf0a2d9ba51b8e9c91c9da924ed
MD5 0a57ac2dda554653d814b4ae5a1b336b
SHA1 96cca14e06a5dd4a0c9bbb4b81771e75124afc6f
SHA512 da589ab758e0538e8d55e43fadee4420e4f5ebaf6b9590896be253a9d54b6266c072d463023860f2eb85c6c4ac7a298e081206020d8db42cbc4010bbdd5c66e1
SSDEEP 384:HwCe7iO024Yldcs3hkhnhfdDE2Ba/rIVy8e7dcs3hk61wdvNd9KVRar/z++z+Q:QqZYldv3hkhnhfS2sDIVy8Sdv3hkuwdn
TLSH
T10AA29E7A9F017C8D1817D955C9BE87A55C05F9ABCBF6C0AA0C343549CB8472AB0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\ihmcm67f.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\ihmcm67f.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\ihmcm67f.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\ihmcm67f.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\ihmcm67f.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\ihmcm67f.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

ada2ef29-635b-407c-92e4-136800a6f8e4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\datareporting\glean\pending_pings\ada2ef29-635b-407c-92e4-136800a6f8e4
Size 711B
SHA256 21bf7ec1210ee1b68a27606455b4dc88628393ed4bf5184cc0f9b08749fbdc27
MD5 acc8bf2cc51f2a852b4782d4480b9f15
SHA1 bceaed217a3304850a0a0ee56363a7694b148729
SHA512 59346c5b42c5c7c21b652bc7bba3138d6842f471becb0d76aea6aebdafe43dad1744f61defb4cf1623d846c92a1f3fe45714f97f377db44ff208d5d1a3950449
TLSH
T11301F40A76A4D0664C714306F1D47F0198B910376065F715D4D0C63C7DDF18B87A7757
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\extensions.json
Size 13KB
SHA256 b08e9e2667524c60fdbbba8d00145a9c8f512be1b88bc88aee3c475cf606c083
MD5 d5e7630f1b898c5b413de5a98d757736
SHA1 681317a19ec6cf3bc8f82ff5db1ee448be0551fa
SHA512 8b09d5b1f0c95b0835dbfc24b8152aac89e2a32f854ff7a0f1bf9252e8cd3b37e4b8a69627583fd6b831a4687d3a6001e2d134b03160bb02d42c1a5f97bbe488
SSDEEP 384:kT4ij/7TNT9uj/7ZTYij/7DgTldij/7HlT4Cj/7qT6Ej/7BL4H8qL4H0YL4HFL4i:W4498YeKfm4J6C4cY4U64F4i
TLSH
T11752FE1554155EB8298FA3DAD976BE01D27C663B60445C7CB8ACCFCC42FB0BE06A361B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\prefs-1.js
Size 9KB
SHA256 2d0fdc606fd7957695d63d313d47ed215b4c2959142b756700b1fdb8bc46ee0b
MD5 02f415f532d48784bfed46574d03e70c
SHA1 e3ae709b3b5089c45ba662bf1f76783e38468afa
SHA512 703dbdee7ffe4587adebfba187d950c073bbd58d10a8c51a83610da5b1cdf4fd695a42f5f0e2808cda99289933115578ed33d0487107b423241ab91c476c7961
SSDEEP 192:noyRDxFg4pYvgH2vYnRBbxwnvph26Bw8Cb9W:nhN1RBbxkVwrW
TLSH
T19C12CC7890049FBF65B332BCAC24897169B1027B7BBF6CD611B94489050CF3545FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\prefs.js
Size 1KB
SHA256 dc3bb095b7bf5fa15e2c54f9b3563ffea14dae9009ee94faed1a3eef1f3a80e3
MD5 3cbd27943c3d708f29e9bb3790dfcfa0
SHA1 fd0b2ba25ca4c9cf5869ec4d2ecc444f3859e472
SHA512 73e59b096b76bb9a5e95c86a7a4833c18719394a721c178357f3a71fd64f172a492d263060cb187ca7a734bc9d2a079dd709c3f4c16911f7996abfafcd0bec44
TLSH
T19B31FE725845CBBFA27536ACFC2A4DA0D6624232B23F68C514B4948A462CF3047F39DB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\prefs.js
Size 3KB
SHA256 ea02eb380c342b6227521780de827702733cd2618c969d703e50829e1bc77f12
MD5 980e17af630bf8d09e49d4ba0b8086fb
SHA1 66a3f01e39c109b38a24c011b25e82ff6c994f32
SHA512 f169fe1ac4ee1bc6a1045d68c4c4ae3adea052fb06025e5b39bea908dd4810155f398eb137301cb6528f36d08035129f9230465c4fc8c8d42900ce4f95d4e3ea
TLSH
T1D5710D7595008F7F61B237BCBC1889B08AB2457BB37F28D610B84489551CF3442F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\prefs.js
Size 7KB
SHA256 20cff1b2e5f2413d1f3ed9a7071ac945d58749a94d161ae90ea61b9b1d6ef81c
MD5 e559c2cc91dd19eb90d578a362564496
SHA1 8d98644cec410c60243965d0577a4959250be3e5
SHA512 f8792ff3efad8630999cc099d8940fd2ca417e386a2d0af4320cd1391511f88de7482880a8214d1c8eaec5fb67472bc99c77c427d9072fa34689d1eede858d32
SSDEEP 192:ngyRDxFg4pYvgH2vYnvwnv4h26Bw8Cy9W:npN1vNVwGW
TLSH
T113F1ED7890148FAF75B236BCBC64897169B1417B7BBF18D610B944C9050CF3486FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\prefs.js
Size 3KB
SHA256 ca5beefa8c7e8d0bc455e2eab1140db5d66dfee4662ecb89390e41d9bee54fda
MD5 5845469cd3ecc6c7de87e55686714dc2
SHA1 852975bfd85ff09a819ca9dbb33dd61ddd5433fa
SHA512 ec88f310e10c2fab51bfef76283562810d6b5ec62c2ef07d42d2f3152084280b14e7f084257710b6fcdf62cdf50a48958b16449e7dad7be04950665eb382d718
TLSH
T1EA710E7595009F7F61B233BCBC2889B09A72417BB7BF28D610B84499561CF3442F69EB
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 b81d2ce5d1682a66b220920106a4ad87801c2a2e61c177817e23de0c789181b9
MD5 5a6f263edf72ccd2384fd3f5d27a0b19
SHA1 33036e0ece2bc76c83e5d087d4bf3ff837917205
SHA512 2f49b4b89ab02a73a02e89c4fbc837a5beafac15590d951ce5f1d6819f1e843f0a0f540391e08e2b9cac1b1a393f56c5322eb34bd06d131bbde2cfb6e7424b18
SSDEEP 96:iZpJMudFcJ6QK1aD4vezIR3knM2UDFPb88BVFKU8FxLlA7JU0:Uz86J7cQOM20RbfVFF8FxGr
TLSH
T1EF816D9AA5841FF4EC2459DB30486A3CD157B4188FBDEB90D0DE32C81C9071ABDC1AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 63884900b1ec59d1f7954346c01ec1bddcc56e596b79e9ff14c9f5c1b6dd381b
MD5 7f2d8d71d763c04ea65ef29c2195e44d
SHA1 99b9d1f87b9d39dd5339f7f7cf86a3fca77e9e66
SHA512 eaa5bc90caffaebd08791289d7e495760210e398b26ded097e55a779e1fcada48762bb29e7f0fd898d893f6680d2cff23e49c30abcf520c3adc2d37f20a41c2d
SSDEEP 96:iZpJMudFcJ6QK1aZ4vezIR3kt+M2UDFPb88BVFKU8FxLlA7JUO:Uz86JpcQc+M20RbfVFF8FxGl
TLSH
T116816B9AA4841EF5EC2859DB30482A3CD15774188EBDEB80D0DE32C80C9070ABDC1AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 e1946e2017bd932681109370f26d396204f450252a5f93c9c111eee4f4884952
MD5 bf2181b24324a2d0b34461650a415d5b
SHA1 40b0670b8fcb884f3428eb2294da6d55d0377f8f
SHA512 bae28564b09e71654f31d35fa45165d31d861a1bed32edcf3f87b977479c029016eaf83fbfd0c77807db7ce050f13b0c3ef6473d49031fb1616f842a7fbeadfc
TLSH
T1EB714B57B8A10BD1E92AC7B6700D4D2927156C2B4BFE38C495A928A90BE430A3DCD285
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 641a49f67135eedf2556c37f3012a8de3c0921891c4844d0d0334400baeb8d24
MD5 d2222311d97460a4059a313118b28719
SHA1 7048dbbfce7f489a21fbbc9579cda4ba08c02c29
SHA512 09b49d4e9c61906a0aea3b5f28c7642fed19df577af0b49514873e8b2ec462f7f889ca5cea0d47ffcda3cd6c9fee7e2c55ecaebbb9c6ca7bd293da8e233e9d64
TLSH
T1BA410A52F8B94AD0E799C1950249DFBC215839178BFD59D4E84D09284A3822F3E46788
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 4fa14ed627c46da3129f6ac75089a413e46deeb31ba24a3cd7bcb555a601e260
MD5 8993526f8472645868d25400b690fce8
SHA1 e7c66cb5a7c364c877050fc7048896da533ed98c
SHA512 df503a6aaeac10cf78759b1d09c01da09736a66ef4cc97f81e1fe717737fdce790f04b9c8ff44323c24758ead99774910c069b0b6b5a611995799a8c4ba4d7c5
TLSH
T14F714B57B8B10AD1E926CBB6700D4D292315682B4BFE38C4959928A90BE430A3DCE685
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 6abaed6e7aa3551bf8057ec3660b7aad38a44e0ea6b07f3c210d192e4da71150
MD5 ede62d62fab411f48ee4fd8a175cad33
SHA1 819efdfc903d1869b4f08212f43f14bde79b639b
SHA512 a79c62625dc47375195ee3ca3b50aab53e403b94e5675cf31e654a08b30fecd6eedd246eab02590ba869f24ec679ba0da1cb999285886ad3f55d45295163eef2
TLSH
T1BE714B57B8A10BD1E93AC7B6700D8D2927156C2B4BFE38C495A928A90FE430B3DCD285
MD5 SHA1 SHA512 TLSH

Submit Download

2918063365piupsah.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Size 48KB
SHA256 acdbe247c3ff4a07e92d9f1cea2f2816d23cae25102e3ef0a9af23a275040fc3
MD5 f6a1ac9af9391ba73022dcbe8bed88d1
SHA1 7e2e9d8d296ff903a196d3b8ce29408302910f10
SHA512 33f07820cf6dbea652d42310a31056e24915593ab74daf8bfe0e144946a711627a533e8c680d929abc1725fea935e8ef724f08b9616b7595cc24fd18d654bd17
SSDEEP 48:T+OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEb7:616S6CKnqlizbxV+2xVeU7X2B0b
TLSH
T17A235E8E3F07E511C53AF0B178A08D51BC5E321D07222AD56990DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 e00718b074d3f1ce68aba09cb7a6cdf0d539c759719ce36f8da5258f6883aa93
MD5 5a028a82ed46dfa8057b1a0dbcf2a62f
SHA1 a34c711b94b577b30dfbe1394459a9ca69856a73
SHA512 1cc8eced00714454726463f89fb92b6a49305dcdb3e038be6044772db9e9bdca51ece7da75906ad91e1bc8040eb94b7c9110b664c7b00f8723832aba97e28aae
SSDEEP 384:G6S6CrAWCRBvOPv7hvKovVYvC6v1xbvAPvp0H7/NUeKN6eAs0eq8hetMRe9cLef4:G6S6CrAWj0H7mCoefl
TLSH
T1F44385C87336EE4ACB02D87E04C683EF808D7E6900B64D893676D75C84654EBDB6FA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.2MB
SHA256 c36bbd8a045ae3c5b38222bdeaf8c5a095c287fde9a6075dd78f82af5df0bba8
MD5 abcf16cac7ce36ba6d46a179362077f1
SHA1 214ac4fcdaec570eacd335d1d9263e998f12aaba
SHA512 1753226a6f583fa1fb19a318e6a065cc6650261ae3487ad9b558f897087d6de20daa26e4962642bf4d180f6732ec15b87c0bcb541581f05bff7b1c147a261399
SSDEEP 49152:Ex/XHuwYEiEH9+Zh3B3vCw68zkzBeR7LC8TJziglsLLIhiWcL:21H9+Zhx/T68fTz/qfkpQ
TLSH
T1E5666CF820D1A257F3414033658593EB21EFD00D60379A085BE99AF9D4B4CEB9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.7MB
SHA256 ed15edf81ea5bf6788c989f89f74e6734a07a65347e375bd73b5552fd0a5c6e3
MD5 70ad13d5d7d021be9af5b97f7f1ca8d2
SHA1 985544f151869b9c3ac83d628f4d89331982506d
SHA512 0b5caaca626d3f38ff0c0228dd07e094ed334b0876854c1d62e855c28ad6b0cf54862953f6a8654bdaddbafdff804f54dd56d575df077225f898336f62f6c6f5
SSDEEP 49152:Mz/xHWkY5iwNG+Zh3BYrCwO3f/zBeSxGPxPJzig5sLLQhRWiLVZZjBAXydi3:zhNG+Zhx2TO3RURz/Gfs0ugD3
TLSH
T101E64BA774D4CA92DA0146B2F30F43CB357FC2DC20D5859826B8BA5C995329BEE2F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen-live-folders.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-live-folders.jsonlz4
Size 15B
SHA256 0dd22af73bf7560a8bc72ee90aba611c1241c2054d488f75d90a4afc27309efb
MD5 e88094f8457c6fd244c2787c6524b125
SHA1 a5823f19d67c3b3d9cda80aa3acf20dd00a2d437
SHA512 769ffbd35a9c2a1be4ec91c60036f4a7d3925e15a947d909f9e4b14573ee9b993508917d0e28513c6fe13b4202d7f4c39173ba729ddbfd400a90a01812910ea1
MD5 SHA1 SHA512

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 588B
SHA256 6703d7368ba0806924115ed7d1b33681048bf36e4ed96015ab112a5fefe94ed7
MD5 07fdfc0167c0eca6f0208124c0068bcd
SHA1 2cd0e5a3529f274346ffaef534d3897fe692b2a4
SHA512 a97256e5ebeb01f6256a6416323be5c5f735fdeaf005011bc52027c21703bcd2a466bbb9987efe3da723ee33db1c7b9bdcda1ec8e9dd5d402f5d9ab592b7092f
TLSH
T1DFF04150B9008FE2BBD299A9E4D14A4CF502362CCBFDBCB09401810841870B73C3138B
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 2KB
SHA256 c9b4d7f5b4b745a34923a8301225af44f5a6350e4644014768b8458df1b4ec67
MD5 1b20ce7103644e5ee2b099b7f1b00360
SHA1 3f4d7edef085c21817b9121b63f2072734e85187
SHA512 452ccae6d42171242230fb2b1432271fd803565f18f7e291be3bf7afa53929bcf9aeb5d5bd90add4a3546702231d201785a5b8de3670a7ad2987a9d79c99ad09
TLSH
T1BB515C97B4E287DEFA38436E1148591CA942843B4BE4B8D0A4CD728D08F2B0538F9466
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 2KB
SHA256 fe0f1d8a383dd25bcbfda3c36fc2a40ced4ed3af2a084eefac6bb7ec7010cf1a
MD5 07318814cfd824477f870bf72afa8e13
SHA1 b0f586a500eee1eb6462e8c7f8b174ebe742c3a7
SHA512 e01ba29305fef2702bc2d40cec319c8c46f6f2e19eab3d25d16d77823d69066befc2f2d933103eb28ee803112270258b77766ea5687235ed773b1a73c57b4e1f
TLSH
T1A7515E97F4D287DFF938436E1148591CB942443B4FE4B9E0A4CD728D45F2B0578F9466
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 2KB
SHA256 96553df6b154241aea86279149b55938a5d7354ac5191e86c9636e862b5a3842
MD5 86fc4d30050c3ecaea416c338b1df125
SHA1 6b6890bb7576756842a8131c6d3f04a4db3ce7a0
SHA512 be2abad0f8f435af27b78608e2051cb2d54f4552b9573aa9461a9dbb00f3e166dbe319d960346abdb21eda6edba4064de3e8270b5d7ad289509743af8530d2aa
TLSH
T143516E97B4D287DEF93843AE1148591CB942443B4FE4B8D0A4CD728D04F2B0578F9466
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 3KB
SHA256 44a9cc88ab8077a302834097f64a2704077c976f3962e242fd6464b985514086
MD5 a81559e8f0201530aaf279175863c2e7
SHA1 0d7df1fa131350560bc20ba2f8ca2e1a88661ec5
SHA512 f0c2bb251efeee1663772905870c95b2f3c27b1a6fb3c01fbd1eb54c6c6d1e5a874326f2eff70695f0d98f7de0ec9ba15fe6fe023a517ed0fcc926d4dffa4271
TLSH
T1A1513C8E79D11BE5EC5419AE60D40B3CD94278095FF9AD80D5CE638918D0B09A4D00E1
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 3KB
SHA256 3ea8ef06c2cac2a1fe7d0dad319548704957dc7a8c9a018bed1171736a72a70a
MD5 18c84462d641adbc4526b95999eb201f
SHA1 e826288ec7a0962e34fa5eb77c416b58037c65f6
SHA512 c170dc908e80748a01828015687799b96de52812f74392bab9d413bed932afa331ef2c9341d1d8619b6064d81b0689bf57571bfa2835122f82085b1626a92060
TLSH
T1E6513C8E79D11BE9EC5419AE60944B3CE84279095FF9AE80D1CE63891CD0B0994D01E5
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-sessions.jsonlz4
Size 67B
SHA256 e229f002e0b28ce1ba15d139b84ded463a30ac6974ea49d617f4b3cf775ddffb
MD5 347f188dc701d27a479122f7745fd30c
SHA1 970d019705a716dd3cf16c02aeedf8767bea6239
SHA512 866ae3ff18fac5f63432756f93e3e015b2034e95d3d1f54a3983a63424da3427d25fbd397f3d49ca580d92ccf0da89dd1ced3ad4ccc3d2a77262a95f62c68b09
TLSH
T161A02202A0202B2302A0A200E0820CEF2382202A033008C0388B00CE8208283CC83083
MD5 SHA1 SHA512 TLSH

Submit Download

zen-themes.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\va2dghtd.Default (release)\zen-themes.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 1008B
SHA256 a7db58be36924780eddcb675d628eb719af8d9854b42275aa1f44e705be92ed8
MD5 d50630d02455e8f5983009e48e4c24ff
SHA1 fc08279bffd686d6029d31b9a14918cd792be038
SHA512 6027fe3b2bcd5398ef034dda909bdd16e59b091414aa7928162022ec5ceaf5c7ff03c54dcb821d484d417d03c60663a4a7962455ce0535f01c68b598c5544c4d
TLSH
T17D118C000BEB9A35F17A8B7256B22A328727FC81DBA8065E478841644EB1410C96CFAB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 910B
SHA256 a1ebb7728021aecf6ae5ea5760dc1f03a738b1e7d7320880ba2cf2cdc7d8c5b2
MD5 f11ae46f9eb2dcf65ff41d7ec059913f
SHA1 f803b44d2d1240639b22273e84cd1ba08bd43160
SHA512 681190ecd5906e27485d4e5e50aa4efa081ec208aa397aeb2b5954d27a950de086f4544d3ee0154ad3bf8cb9f45b66c50e0c45cf9e93822ceafa56cc955797c4
TLSH
T1AD1145000BEB5A25F5668B7266722B318B27FC82CBA9475E87C841604EB1110C96CFBB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1548-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1548-388-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2632-1727-0x000001E265A10000-0x000001E265A20000-memory.dmp

Download

memory/2632-2730-0x000001E266660000-0x000001E266670000-memory.dmp

Download