njrat | e32e0109a3850cb7e47aae741da28142eb0eaec16a8c5ac86faaa78637f9b52a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 92.1MB
Sample260806-d9tpraff43
SHA256 e32e0109a3850cb7e47aae741da28142eb0eaec16a8c5ac86faaa78637f9b52a
MD5 4cd42793079d71e1b86bd318b8d3c174
SHA1 d588f01259df3657258097e389af7e6948e6a4be
SHA512 f698ca679ebb06934f838c8b3714add431e720f57f4be38968983bf5076ed949523881c5a3424a81d4b1cc59bbcb0433380cd9efb0c9fb287f1d40d79387f2e0
SSDEEP 1572864:rCHw3qSUvBGYJR9XLMpWDbsmkcas8l5RiV3UA4vLwZzxaHC3cOCx9s+b/cAuaY9G:ubd9XLeusm8lGV4m0iTk9sy/cApY9Z3k
TLSH
T11B283349E28231BFD14A65FBC91EEEC29935FE85037049DB2272B5266E6F5C26C35303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan upx

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/992-23-0x0000000000400000-0x0000000000446000-memory.dmp	UPX
behavioral1/memory/992-407-0x0000000000400000-0x0000000000446000-memory.dmp	UPX

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2132	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	zen.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 25 IoCs

pid	Process
3032	.exe
992	zen.installer.exe
2340	setup.exe
4448	maintenanceservice_installer.exe
1004	maintenanceservice_tmp.exe
3276	default-browser-agent.exe
2064	zen.exe
3816	zen.exe
5076	zen.exe
3068	zen.exe
1768	zen.exe
644	zen.exe
1080	zen.exe
2252	zen.exe
4612	zen.exe
2384	zen.exe
648	zen.exe
5000	zen.exe
3380	zen.exe
2336	zen.exe
3360	zen.exe
5484	zen.exe
436	zen.exe
5540	zen.exe
5576	zen.exe

Loads dropped DLL 64 IoCs

pid	Process
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
3124	regsvr32.exe
3124	regsvr32.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
4448	maintenanceservice_installer.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
2340	setup.exe
3276	default-browser-agent.exe
3276	default-browser-agent.exe
3276	default-browser-agent.exe
2064	zen.exe
2064	zen.exe
2064	zen.exe
2064	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
3816	zen.exe
5076	zen.exe
5076	zen.exe
5076	zen.exe
5076	zen.exe
3068	zen.exe
3068	zen.exe
3068	zen.exe
3068	zen.exe
3068	zen.exe
3068	zen.exe
3068	zen.exe
3068	zen.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/992-23-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/992-407-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Zen Browser\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavcodec.dll	setup.exe
File created	C:\Program Files\Zen Browser\pingsender.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	maintenanceservice_tmp.exe
File opened for modification	C:\Program Files\Zen Browser\nsa9D78.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Composition.OSSupport.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Input.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_150.png	setup.exe
File created	C:\Program Files\Zen Browser\gkcodecs.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.dll	setup.exe
File created	C:\Program Files\Zen Browser\platform.ini	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\firefox.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\updater.ini	setup.exe
File created	C:\Program Files\Zen Browser\browser\blank.pdf	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\uninstall.log	setup.exe
File created	C:\Program Files\Zen Browser\mozglue.dll	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140_1.dll	setup.exe
File created	C:\Program Files\Zen Browser\fonts\TwemojiMozilla.ttf	setup.exe
File created	C:\Program Files\Zen Browser\defaults\pref\channel-prefs.js	setup.exe
File created	C:\Program Files\Zen Browser\browser\confused_fox.pdf	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\mozinference.dll	setup.exe
File created	C:\Program Files\Zen Browser\precomplete	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	maintenanceservice_tmp.exe
File opened for modification	C:\Program Files\Zen Browser\nsu9D56.tmp	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsu9D56.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\install.log	setup.exe
File created	C:\Program Files\Zen Browser\dxcompiler.dll	setup.exe
File created	C:\Program Files\Zen Browser\libEGL.dll	setup.exe
File created	C:\Program Files\Zen Browser\nmhproxy.exe	setup.exe
File created	C:\Program Files\Zen Browser\omni.ja	setup.exe
File created	C:\Program Files\Zen Browser\update-settings.ini	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsa9D78.tmp	setup.exe
File opened for modification	C:\Program Files\Zen Browser\AccessibleMarshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140.dll	setup.exe
File created	C:\Program Files\Zen Browser\installation_dir_layout\versioned\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\manifest.json	setup.exe
File created	C:\Program Files\Zen Browser\libGLESv2.dll	setup.exe
File created	C:\Program Files\Zen Browser\nss3.dll	setup.exe
File created	C:\Program Files\Zen Browser\onnxruntime.dll	setup.exe
File created	C:\Program Files\Zen Browser\softokn3.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavutil.dll	setup.exe
File created	C:\Program Files\Zen Browser\msvcp140.dll	setup.exe
File created	C:\Program Files\Zen Browser\zen.exe	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.InputStateManager.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.Internal.FrameworkUdk.dll	setup.exe
File created	C:\Program Files\Zen Browser\application.ini	setup.exe
File created	C:\Program Files\Zen Browser\dependentlibs.list	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Zen Browser\msvcp140_atomic_wait.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsa9D77.tmp	setup.exe
File created	C:\Program Files\Zen Browser\freebl3.dll	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice.exe	setup.exe
File created	C:\Program Files\Zen Browser\marshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\notificationserver.dll	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.exe	setup.exe
File created	C:\Program Files\Zen Browser\updater.exe	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\AccessibleMarshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\CoreMessagingXP.dll	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zen.installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Colors	zen.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	zen.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.gif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.htm	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.avif	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\ = "Firefox PDF Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.pjpeg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\CustomActivator = "{B7B7F385-9D9E-47E8-BAA8-A50087C39AE6}"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.mp3	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\ = "Firefox HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\FriendlyTypeName = "Firefox HTML Document"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\URL Protocol	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.jfif	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B7B7F385-9D9E-47E8-BAA8-A50087C39AE6}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.webm	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.pdf	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.jpg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.opus	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xml	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.png	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.html	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.oga	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.bmp	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,5"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\SupportedTypes	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FirefoxPDF-F0DC299D809B9700\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1004	maintenanceservice_tmp.exe
1004	maintenanceservice_tmp.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: SeDebugPrivilege	644	zen.exe
Token: SeDebugPrivilege	644	zen.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe
Token: 33	3032	.exe
Token: SeIncBasePriorityPrivilege	3032	.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2340	setup.exe
644	zen.exe
644	zen.exe
644	zen.exe
644	zen.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
644	zen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3032	3908	2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe	86
PID 3908 wrote to memory of 992	3908	2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 992 wrote to memory of 2340	992	zen.installer.exe	89
PID 3032 wrote to memory of 2132	3032	.exe	90
PID 2340 wrote to memory of 3124	2340	setup.exe	99
PID 2340 wrote to memory of 4448	2340	setup.exe	100
PID 4448 wrote to memory of 1004	4448	maintenanceservice_installer.exe	102
PID 2340 wrote to memory of 3276	2340	setup.exe	104
PID 3276 wrote to memory of 2064	3276	default-browser-agent.exe	105
PID 2064 wrote to memory of 3816	2064	zen.exe	106
PID 2064 wrote to memory of 3816	2064	zen.exe	106
PID 2340 wrote to memory of 5076	2340	setup.exe	107
PID 5076 wrote to memory of 3068	5076	zen.exe	108
PID 5076 wrote to memory of 3068	5076	zen.exe	108
PID 2340 wrote to memory of 1768	2340	setup.exe	109
PID 1768 wrote to memory of 644	1768	zen.exe	110
PID 1768 wrote to memory of 644	1768	zen.exe	110
PID 644 wrote to memory of 1080	644	zen.exe	111
PID 644 wrote to memory of 1080	644	zen.exe	111
PID 644 wrote to memory of 1080	644	zen.exe	111
PID 644 wrote to memory of 2252	644	zen.exe	112
PID 644 wrote to memory of 2252	644	zen.exe	112
PID 644 wrote to memory of 2252	644	zen.exe	112
PID 644 wrote to memory of 2252	644	zen.exe	112
PID 644 wrote to memory of 4612	644	zen.exe	113
PID 644 wrote to memory of 4612	644	zen.exe	113
PID 644 wrote to memory of 4612	644	zen.exe	113
PID 644 wrote to memory of 4612	644	zen.exe	113
PID 644 wrote to memory of 2384	644	zen.exe	114
PID 644 wrote to memory of 2384	644	zen.exe	114
PID 644 wrote to memory of 2384	644	zen.exe	114
PID 644 wrote to memory of 648	644	zen.exe	115
PID 644 wrote to memory of 648	644	zen.exe	115
PID 644 wrote to memory of 648	644	zen.exe	115
PID 644 wrote to memory of 648	644	zen.exe	115
PID 644 wrote to memory of 5000	644	zen.exe	116
PID 644 wrote to memory of 5000	644	zen.exe	116
PID 644 wrote to memory of 5000	644	zen.exe	116
PID 644 wrote to memory of 5000	644	zen.exe	116
PID 644 wrote to memory of 3380	644	zen.exe	117
PID 644 wrote to memory of 3380	644	zen.exe	117
PID 644 wrote to memory of 3380	644	zen.exe	117
PID 644 wrote to memory of 3380	644	zen.exe	117
PID 644 wrote to memory of 2336	644	zen.exe	118
PID 644 wrote to memory of 2336	644	zen.exe	118
PID 644 wrote to memory of 2336	644	zen.exe	118
PID 644 wrote to memory of 2336	644	zen.exe	118
PID 644 wrote to memory of 3360	644	zen.exe	119
PID 644 wrote to memory of 3360	644	zen.exe	119
PID 644 wrote to memory of 3360	644	zen.exe	119
PID 644 wrote to memory of 3360	644	zen.exe	119
PID 644 wrote to memory of 5484	644	zen.exe	120
PID 644 wrote to memory of 5484	644	zen.exe	120
PID 644 wrote to memory of 5484	644	zen.exe	120
PID 644 wrote to memory of 5484	644	zen.exe	120
PID 644 wrote to memory of 436	644	zen.exe	121
PID 644 wrote to memory of 436	644	zen.exe	121
PID 644 wrote to memory of 436	644	zen.exe	121
PID 644 wrote to memory of 436	644	zen.exe	121
PID 644 wrote to memory of 5540	644	zen.exe	122
PID 644 wrote to memory of 5540	644	zen.exe	122
PID 644 wrote to memory of 5540	644	zen.exe	122
PID 644 wrote to memory of 5540	644	zen.exe	122
PID 644 wrote to memory of 5576	644	zen.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\.exe
  "C:\Users\Admin\AppData\Local\Temp\.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\.exe" ".exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2132
- C:\Users\Admin\AppData\Local\Temp\zen.installer.exe
  "C:\Users\Admin\AppData\Local\Temp\zen.installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\setup.exe
    .\setup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Zen Browser\AccessibleMarshal.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3124
  - - C:\Program Files\Zen Browser\maintenanceservice_installer.exe
      "C:\Program Files\Zen Browser\maintenanceservice_installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1004
  - - C:\Program Files\Zen Browser\default-browser-agent.exe
      "C:\Program Files\Zen Browser\default-browser-agent.exe" register-task F0DC299D809B9700
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2064
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:3816
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies Control Panel
        
        PID:3068
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" -first-startup
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -first-startup
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies Control Panel
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:644
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -prefsHandle 2540:26779 -prefMapHandle 2544:302811 -ipcHandle 2588 -initialChannelId {24a6306a-db65-4ffe-ad16-1f5eb7e527ff} -parentPid 644 -appDir "C:\Program Files\Zen Browser\browser" - 1 gpu
        6⤵
        Executes dropped EXE
        
        PID:1080
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -prefsHandle 2852:26779 -prefMapHandle 2856:302811 -ipcHandle 2864 -initialChannelId {4e8f094a-4553-4b76-80e4-88ba51ea9de5} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 2 socket
        6⤵
        Executes dropped EXE
        
        PID:2252
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 2104:26878 -prefMapHandle 1912:302811 -jsInitHandle 1916:156236 -parentBuildID 20260729085236 -ipcHandle 1868 -initialChannelId {0abc5d7c-78cc-407c-be04-4052b95f6712} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 3 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4612
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -prefsHandle 3616:27487 -prefMapHandle 3620:302811 -ipcHandle 3688 -initialChannelId {fb5aad23-59aa-48dc-b6c8-37783eda53f3} -parentPid 644 -appDir "C:\Program Files\Zen Browser\browser" - 4 rdd
        6⤵
        Executes dropped EXE
        
        PID:2384
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3856:27738 -prefMapHandle 3860:302811 -jsInitHandle 3864:156236 -parentBuildID 20260729085236 -ipcHandle 3868 -initialChannelId {f1b0a791-d46c-4282-bc25-2026e2a56286} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 5 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:648
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 2080:27992 -prefMapHandle 1988:302811 -jsInitHandle 3564:156236 -parentBuildID 20260729085236 -ipcHandle 3552 -initialChannelId {64030d58-2e67-40fc-afc3-ecedfff73480} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 6 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5000
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4692:27992 -prefMapHandle 4696:302811 -jsInitHandle 4700:156236 -parentBuildID 20260729085236 -ipcHandle 4708 -initialChannelId {b047e5b6-9405-4c66-b663-8440179448bf} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 7 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3380
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4884:27992 -prefMapHandle 4888:302811 -jsInitHandle 4892:156236 -parentBuildID 20260729085236 -ipcHandle 4900 -initialChannelId {7ca4680b-b369-4cb1-877b-0c7403d39c1b} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 8 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2336
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5184:30942 -prefMapHandle 5188:302811 -jsInitHandle 5192:156236 -parentBuildID 20260729085236 -ipcHandle 5196 -initialChannelId {0d0c4919-c998-4d75-8357-f05f8e92c1c4} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 9 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3360
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -sandboxingKind 0 -prefsHandle 5744:45570 -prefMapHandle 5748:302811 -ipcHandle 5320 -initialChannelId {8eee9333-f44e-49d2-9a54-805d7a4f722c} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 10 utility
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5484
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 1516:43781 -prefMapHandle 6048:302811 -jsInitHandle 6052:156236 -parentBuildID 20260729085236 -ipcHandle 5960 -initialChannelId {0c47ad10-c552-4fad-a025-201b89ddc1f3} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 11 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:436
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6068:43781 -prefMapHandle 6072:302811 -jsInitHandle 6076:156236 -parentBuildID 20260729085236 -ipcHandle 5428 -initialChannelId {c1228bb6-55fe-4219-b41f-716429f91648} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 12 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5540
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6052:43781 -prefMapHandle 6244:302811 -jsInitHandle 6248:156236 -parentBuildID 20260729085236 -ipcHandle 6256 -initialChannelId {4133db21-90ca-443b-92ab-c784d3b4afd0} -parentPid 644 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 13 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PrivateBrowsing_150.png

Path C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png
Size 9KB
SHA256 2ee22aa49d12fa9146274dc5a03793fc45bb632bb341799542516fb17c142371
MD5 2b47f5fa099f97fb4b7d1a88aa494541
SHA1 eaaf09c44abcf6f7495224a3a3d8e651afe59403
SHA512 4e4e03b804c64085e701055f9b741f99b4715807682a7141eca184a6ad03fb7626c9ae6e9f74a6dd54d717330b154a68193e52cb97f66bd232f788c77ad01e9f
SSDEEP 192:379hCymCdj+pGzVoFkPc8Y1F266DMQdcv+mwI4NNR92uITz5s:r9sojPHQFVJ3wLH92uITz5s
TLSH
T19412BF20F215CF2E91743884A4CAC6C5D23B7217F7C02074482FA4FB1C2EF152AB5AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateBrowsing_70.png

Path C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_70.png
Size 4KB
SHA256 c348fb831e245763f6c1ca74e769599daf4b88d6b2487144a5a8a58c7172d9e5
MD5 f938a334dac97a3b99e020a4fd45e39c
SHA1 b476456542430be300a48bed22dd0b3c496b9920
SHA512 d2f490a4bae244ded37dd6270f01a24e461cc2df2852834133b7a38db7b3f46221fbccc8d66b33eb2237803174f7e68a7b65d28eaea759f990ead3a203674b67
SSDEEP 96:fqPxsxciKQQsIBEzEZXhaOec0AGHL5lYRTBXWAhh3+KW789+q5:fqJsxXQsIK+XhYc0AGHLSWArBSc+q5
TLSH
T1EB919EF983A10CEFBB40289FBB26A67DDC470D7590063234BEC155E32675A9E09E5251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VisualElements_150.png

Path C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_150.png
Size 102KB
SHA256 68e5025e6835c0142272276dba9a3f2ad8cbe6f6ad8c425882befd3146a9f7f7
MD5 a0ce9ccbf2dbdb3a3d2e044e0f74bc7a
SHA1 88cbe63c90dcbb5c9abdb48a983c4f153513f8b1
SHA512 6f7556d3622868599dd8f3dccbbef21fcd3c9a71349327f2474159a7131d563b176f940882a1c19d3cdbede983bcc436a7f61b50a7495a0a553c6d95e77ee10a
SSDEEP 1536:XqShEeITCdH1Xxi+BmgdUMhh3le4HQtOfRuWaGOaOK3Yf8QKaqaZAtyaiWNy:as5ITAVhXBHTaOVFOaOKjQrqaoyau
TLSH
T16FA3129A941BC481CC5E19B2486EE06865BF95C752264AB4D03C7CEAFCB917CC186D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shortcuts_log.ini

Path C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini
Size 198B
SHA256 5fbda59442223c5d2fc4779c116f314fc4ee448ab786e102f570aa5de4336cbc
MD5 c18e70154afa4c346b4a5f28ca9a5664
SHA1 1c71628ac2c1609c57db351a2127e16834947173
SHA512 476971174289ce8dc076deb5bbfcdd21d0e55f3dd7ebe635702a2b9d5c4c671713e06c0185f157ab731f7b0c3400e866ad850d7c4990e70ec9624112c5cca3f6
TLSH
T1A6D0023206D60229AE465F81EDE84179DFA6F959609DCB0CF082161E1DF4440C9925F7
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 a4d43f0bc138d09fbae6fd92e08e484d77e9e25843f02002c7125806514a8ca8
MD5 8ab6e68f9bca2e6ad7002a45c3e02d61
SHA1 abbab086dcf6e7c0160cf67bdccb3033b04829a2
SHA512 6bd469603de9b2b04643acb79e1233df605f60c58824c1aca5c2c5e266e64b3077ba781dec3192eb9980f43d635200bcf4056ed4b4ff0d329aae0840100090aa
TLSH
T1AC417F1157E66278F1B35E7282723A714673FC80B778826E428DC2C509B5030C5BDBBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 4d590fafeaa560717f935a98d21f65b133965e47d700ed1dad51ec515f6383f8
MD5 a6058186ea4d34b6776dae1719819876
SHA1 7a621e26065d38ffbb5faf4fb343090874ce0d7c
SHA512 c0b9fb1dcd91d910c43c7463d620633ce888187413b9e19fab2d5710b1d71d64c4f7ca6622a8eab9bf8ecdf4fd7b8c1d1eb0bb6cf1fc488a02754cb01ac8f13b
TLSH
T196316A1057E66378F1B35E7241323A704677FC80AB69826E838DC2C549B2030C2BCBBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 922B
SHA256 10eb2e5640266073d25ff27c910c16ba07360379431f1d3c2280008cb37d5f1b
MD5 a646d907099756277fd912932415dfce
SHA1 de77339130ba6e5f5fc93ebffbb3766c4c18bf33
SHA512 e516dbb64de50625c0b64ba9fee851c86eeaf5fec9fc913574ac04043989919a9ed00fc0335cb23bcbe86db57503186f9ebe8ef6f55fdfabaea18d895013a86c
TLSH
T19411850043E76769F1B38A71057237B18A3BFC01EBA8032D82C8828088F1110D66DFBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 1020B
SHA256 ffaa437d4878a68f8acef1d1a97966b564f417bc6863b77548cd9d20f45bd553
MD5 617b2e1fe610afc413c5df23b501e3cd
SHA1 657ba9a19675e9f5c1c82dbcc136077b61310319
SHA512 8db6206d00600facc8725edf75dfeed6072723a65eec8e76106b3e992aa9534aef91aa4fea88ed0009061b4cd7cd42e1070fd533463edd7ffd73b044e94dd451
TLSH
T15B11550147DBA779F1B68A7155B23662863BFC01FBB8032D82C8C28449F6110D56DFBB
MD5 SHA1 SHA512 TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\F0DC299D809B9700\update-config.json
Size 78B
SHA256 3f7b3252ef3b6217ad78adb7007738601ce1eebca69f55990b64bf254bd4fc63
MD5 fe74f5c38f433736ee7015868cfb159e
SHA1 f723b0032565fb3007407201963f7bb762bdd981
SHA512 19fe20baff40c195955a921ee2fe1927d00da14e0ed3eb683e5f6f026353bfcd5322a1d2399b8977bdf97bb23dfd6cc811c9a9494f019b6e404aff477316cafd
TLSH
T1EBA011800000A2A8B0E888CC00302A3E02888028008B2A02800A30A0383A0020A0A8BA
MD5 SHA1 SHA512 TLSH

Submit Download

.exe

Path C:\Users\Admin\AppData\Local\Temp\.exe
Size 36KB
SHA256 0dc3df5a336edc1a680899c4d257a3a6e331a1e6769ac2e4d3a6be6deb220ec2
MD5 d897a1d213efab02e05ec222332bd456
SHA1 328b14e254fc821fcdded20c5500ab099bab5e7f
SHA512 5f12d12b94f2c4ccda9f38809f9a2de6dc47139cf93a55134ba2701576d6091b88fa7157deb17e53b15ab74669ea8a205dbe738ba109a149b1c9bae43fd4d6b5
SSDEEP 768:uUSq6sqEhKzBpJsSifUGepMfnJFXiT4chZFtbIjC:uUSqfwPJsSifUPpiDSTdhdF
TLSH
T16CF2194DBFE24590D3FC5A778A71E2230376E04B1922DB5D8EE844B61BA36C48F58ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6783b762-6bff-4ab3-b884-10b946eb8925.zip

Path C:\Users\Admin\AppData\Local\Temp\6783b762-6bff-4ab3-b884-10b946eb8925.zip
Size 3.7MB
SHA256 af9706aaf2d0e4ca1f1e61133a874b82399bc07a3ca5c0989b282fc708550f22
MD5 6b3eed16a0429bc80002520153b11312
SHA1 2dfd5fbda201131485a8058fb554a0dca2ac7b0d
SHA512 959d6c1ef639c8bafc4be37090c3b5aabd016211a517e95f1f4be5ce05c8fc2ae66313f0902e40f0ceecc7556ac60d054d07c020550aa066d943049cfdf2af92
SSDEEP 49152:ykscKtlbXGjjTWP9eEsGYXvViBp5eKtPKulVAyXaAlWIiFFvMuGLuyJS+q16Twms:xscEPbKNiBfNQyXagWIYM094Twmjo
TLSH
T18306E0F5D65C1609C9FF83BA850C2FC2C8FC4B6E8054A55BEAEA95715CA31B21B448FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\AccessibleMarshal.dll
Size 30KB
SHA256 8760fc0cf5ada93e6344b915f879e9acfe4594630acf483ef4fbe716d9711ce2
MD5 fe71cd2abbfa9d52eb72cd2a05051743
SHA1 3f63be711466d93328bf9557cb776c5650899c4d
SHA512 be3236d2186e01bda4416dbdccd5efdbd1f7337378ea0c5c2b6553171b62507974f197219b33917a7fefa90ac97813235f8a0b8c9481bca62faccf4590a0d8ea
SSDEEP 384:k9MSlCaZ8nvlfiGeUMc25RkTHu46dWl2mNDsSofousJUKURFSxxw0vS5:ACaZ8vMGeq2EOVsheSoQuoaL0vM
TLSH
T16BD2E556FE0084A5E81D843088DF8AAA5E71FE419F9247C73295332D1E737C56F366A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\CoreMessagingXP.dll
Size 1018KB
SHA256 9e93191b9b1549e45bf3663c4097f3f38cd47d90ec8b8020c0456d5ff4410d19
MD5 4fcd91a7632707c52142a8f10abc9154
SHA1 055c8a973e09ac776f5ac824c5a142274988b1df
SHA512 1d78ce59f2cd1bd858fd48bcf9f3b7815245b78a111e7da5bd69b0d0a4de9cee2a58f56190370ddd6968bc73ac6239fc87282efd8aebb76d7387ef4059f185ad
SSDEEP 12288:Ntl2DdkYB2Zme5NY1RZq3SzFJeb8HzroHCpstWcLObI6DPsb8UsAfb:lgdP4meM1Rlwb839pwWrDlUs8b
TLSH
T1B2252C6F6FA84097D17AC27E85BB8A8AF2F1B8531B3187CB0451426D3F27BE45979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\InstallationDirLayout.dll
Size 19KB
SHA256 50b9a94c3cbab3e112798734b402504a79e41c53257a25651b77483035da8f3e
MD5 0225ff38302f26fe69d5af8ebb33346e
SHA1 1cd05a86635976792d850d5c46be826a44d416d1
SHA512 cd84e550ce2c0a1a78b9d1b570e1a644d79e5bede56cfe671f45aae5af05608e0bd4d6c86c9ece112ce6928c46a537c6b0fa73966b95c5d6d89cb26fc5a425b0
SSDEEP 384:fNmCCN3LNn2d9kvYu46dWl2mNDsSofousJUKURFcHOPSjS:FjwtPDVsheSoQuoaSOPH
TLSH
T1E3926B9BAF6454EAF51B8A30C5D94A1BAD71F7805B9146CB6218008D2F937F83F3932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\Microsoft.InputStateManager.dll
Size 446KB
SHA256 3bb936063a6b0b5c624b125ba4afb370e9f7f71655cb0180c17fd78d6470792e
MD5 6478e351b0f0e92f3d3b7bdf4e7ec2c5
SHA1 9eab54a470b0d31af21b3553fb4c33ed1cb98736
SHA512 6ddeedc4eebfaeaab78d1adfb1ec9757fed3a5856f87307d0109f3e39fb91cf1af1409a2cc10054b583eea239658fadeba817a29d26929d3d93fa357cafa712b
SSDEEP 12288:CCfOXk5FPwj04LiaHVnZWz10AmzdTVCKD:HBMLTVnZPD
TLSH
T11CA44A7BEBA844A0D536D23C85A78A07F2B2745907329BCB42A0926D1F37FE45D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\Microsoft.Internal.FrameworkUdk.dll
Size 910KB
SHA256 41ab3739674b51f3cb610fa7618515c33d708582b30045effc09e6ea307d472d
MD5 3568d848ac6af4172768aac59f59b72a
SHA1 9e8fa5f095186f80797e418b57025a758965bb79
SHA512 ab54314922115dc0e2b7dbdbaf7eef481f1022d29f6e736206a6601611442aee612d83aea149b7fa061aef2cd6be19b16b8c656481df8d4703059b61fdd17aee
SSDEEP 6144:uq2pdSEZxDjmUlfp04mtVkookZea4u2IUWB8Yi+c0p20GHs667I7IK/ECQ23YRgL:MWYdjm9VkookZ4TT+cHH6OIK1yeL
TLSH
T1DD15741BEE6991E0C4BAD03D9192622FF8B170A68B7057C3D6515A1F1F32FE4A93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\Microsoft.UI.Composition.OSSupport.dll
Size 66KB
SHA256 5abb5fdb08b3e7c293f8872222a7931903203b32ffb681bcdf9b152c1ae0878c
MD5 e3e86c9edf68713d7772892dbb510e8d
SHA1 00f4545035704948640fc8489eb1478a90edd4c1
SHA512 88dbb2edcaa5a5ef1b175d979936d957d26cfaa2812eadcd490b2735e26dbf155113ae911a7c629137ad829d9e08552853c56fff6d01250563451b828b60b11b
SSDEEP 1536:Ucum2n7hIpk5Bsshnj9gQFPS47L6kL7oO:UcuThIpkDfg+L6kfoO
TLSH
T145636C59AA8830FAF436423DC4964F19D9B1B16163405BEF0364C2BD2F83BD9763EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\Microsoft.UI.Input.dll
Size 1.5MB
SHA256 1f969eeeec1613036b9e3dde77b4c21152e3827090b5020ff78f7c5ded687371
MD5 0ca0dbe3a545b21036689d773d8db67d
SHA1 f730171cecb4878f72af8c3175c5a389a27cd648
SHA512 809f9f588df1bc1a57d1568ed4a00e0db6a0499065575a692c48b157c4a83097afa48ed4064e74b25710c9d8bfdfae3aaac257b1643509c0e81c6abc0075c5f4
SSDEEP 24576:oB6TePxZNKmKI9tp/jLNXoqWnbvxtXyp0:oAaMmFp//sndtXc0
TLSH
T11A752A2BAFE881A6D331A23DC0974E4AF2B174421B7166EB0165412E5F3BBF45D3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 937462bd02678af1a0faba7faaff8caec14e9decce1fbcf172aa57e937a3141c
MD5 c48f1e5b0f2c5863b88a1f6b56fe6b07
SHA1 2c7bd76cfcf7eadeaed981ab145f284acfcad0e2
SHA512 0e9179bd7a12fb935860767f80717c3c9427e3c5eb0c0780b038c8ff3a202326f352534846921acf210ef35b5661c89c5a384e87104f7fdf9c37c507b86d7764
SSDEEP 6144:zs4jY1PnSzURJG9m3+v6Vtcu5/gm0qV1OU4IkhNFSDm/RuZ2QlXgW:ASY1PSw+5CcuOm0q/OUhUNKm/RuuW
TLSH
T1EBB44D6F6BA84492E22AA13DD5978B0AF6F174125732CBCB0111D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\Microsoft.UI.Windowing.dll
Size 538KB
SHA256 94427ce65565e97136abb8d06ef88353d8b2f5b5c556da9118534c18a555d7e5
MD5 f85fd565de1a22efa96452c633dcc1e5
SHA1 7ed9305fbd159884b5e68496c2bbec7d05797590
SHA512 4201bad4b20e0ec8f897bc3fd5b414168d40a27fb916058311ca8d84cfa9fee9cab977d68ffa56116f571a87457ac89775248101d67362c22008ec5e63d6bd35
SSDEEP 6144:ElLJdDCMslOzqjXsvPueIP7mNq6CIRPDoxSTHXapklto2UInrMRAc6egd:WLJdDCrkqj3eIKFC6DokjaaBjcwd
TLSH
T1E0C43B7EBBA44696D12A813DC6AB4F06F3F0B8515731DBCB4161823D9F27BE8593A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\application.ini
Size 637B
SHA256 9b8524bcfe764f7173fac45705bc34117e69ad9e8f5399ad74d9771d59ca9b06
MD5 0c97e1526f8835498c06d713da3832e9
SHA1 2ee6aabffffb1d4b3641be53db0e9c198b96fef8
SHA512 cab9223040d8b19877ccef9d6017e580b7fe4dbfe9e32695e7182c6ecf053537930acdb84480b2285d1c8d43ae71ca6b7b9debbe7013d9f97af4e2f20cfe12cd
TLSH
T1D9F0D8D7430474EE4EF33ABAA1101AD89333085898EB382C2042510D162931F6A8EBE9
MD5 SHA1 SHA512 TLSH

Submit Download

blank.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\browser\blank.pdf
Size 8KB
SHA256 81a4b1da9df2cfe8f229abb939591b708e2a6ab7d4bc58d411ddb471d0dc3964
MD5 0a98a0712d09cec3945c0728b0c7c465
SHA1 f4e62cbdc0afd816e24929c2a6e71e63072c4b32
SHA512 02619d47e399fe4ccd8138d58f68acd9d692fa61a59d43ed5bd97f709916c4de781f83aa32c9404030887afd55467aa2fbf9ab086fa8ed858d3aeb562da6ee0b
SSDEEP 192:KCYALPEyUKCIoYxrfJeHrJhnAynX/fCQCwQwJsqYmMNVoDVoCow4YePa/TY61/:WUP8KCIXxrOjAynX3hCwTLbMNmZLPeiN
TLSH
T1B9027B34E99F5C5CFA94CA1BD276B70D8E99B10F6FD8349241310F52F080971EB6A2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

confused_fox.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\browser\confused_fox.pdf
Size 51KB
SHA256 e2916092e9764860829db21b78ab0fbfbb22f976687e65716ba7dbc16e954ce8
MD5 10aaade034c04af93ad3c805642e5b0e
SHA1 a6e98403bba37c9e87c632e4a8662284a9098e3b
SHA512 9b9621dcc753e8d7b545fa225b2c3504bb8606bcb4b5bc8dce4844cac7f82722bb3882ed8170adb7ef737460b07aa1b078c0ed820ed9d22e19b39038f3c157d1
SSDEEP 384:4c7vp5LOr9QrOjRzYOv06lPBP2R7uJS9lEWHEugiGB2LtlC:17XWRH1J5DSX/HEugr2O
TLSH
T1513363F291801999F401CD789F9F3D9C109E30ABEED98DDA74FCE711AF228A429E51C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\default-browser-agent.exe
Size 31KB
SHA256 6c57a4d1bef1af02e0299ce9a107c7bcae95354ecb6ea1be56da570934605ac3
MD5 ec1050c7e6c5290c9853044cb070244f
SHA1 71f9647e01882c240c7276b2ffdc4835d83f3368
SHA512 be959b97266400dc45ff012782928b5a6e623c875ed31602d593cac3db06a5b33cdc507a30654d4d681c5901646cf925f51785b4f69d71288b1a6139dc552587
SSDEEP 384:FfkMYA9ZhYIwn0QrNlZpgIBzkwKIOXuWXkviy2gMO20u46dWl2mNDsSofousJUKu:FEAStvZpxBwlHpUjAVsheSoQuoaa2gW
TLSH
T1F6E27C66DFA140F5FC15D13506A49627AE32FA425F6352CBBB82026D1F21BE05F3A3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-prefs.js

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
TLSH
T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
MD5 SHA1 SHA512 TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\dependentlibs.list
Size 67B
SHA256 c50ddbad2bb7ebdf2ec6643fc2e7744adf3870c5744e80ba3665cbdd3e9c559d
MD5 1992be27df8264e37bfe5ab87209000b
SHA1 8ac394c7b9193cbfdff35ea29d731d5481a0ac58
SHA512 0a8515b65e35396db0a3bea1b543aaa95c25b3228cadc66707d4c940b80158bda9c277753df22efcf50233fbaf2174cbadc152e0fd6d43175da0115222c7b272
TLSH
T19DA00292006F91236685EDE1684DC90C801D6156DC9101D05667260E16269C04BD45AD
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\dxcompiler.dll
Size 23.2MB
SHA256 0c6e13dab5f29166e59f42630aeb50599f3c54f7b72cab1918414e9a8d54b61c
MD5 01478715dc840c9994d829c975006a74
SHA1 4997ba5935c9e9c452bd25639c3220cf47db9b70
SHA512 4125314273c796891637e26a6e8bc33db3bea4345f4dfeb0b516036bb01c9732759cb07d050a6abacbcc4d941b4a0a794b2d0563e9ae0c22647c08fd32eb5249
SSDEEP 196608:rLn8gE6byTF5lWua5oiVfMn6puhDpn5yeKr0r:rL8v6+TFvWuanOXh1KU
TLSH
T15A374C123686946DC05AC878C3574B279A2870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 dded8c3942e2d8eca65838e55379b1da5765c2dd6183dd5c3530c9976cb25a86
MD5 613815852a622ff9e54d697b9b3d2862
SHA1 a49149260f4e6d09412ce09d5847f15be65f527b
SHA512 64993969eccb8f75496b11cecab6f351a3ac659d8d6906cda2bfec8684b2d0d253f4c1bc23eefbec388939dc9ad0e898bec0a8f3e03c78d1b9c73d714fa5feb3
TLSH
T112F0C0DCB158130016CA6A556113528FB10F11FB46D501DEB0ED80381B8AB4C491EBCC
MD5 SHA1 SHA512 TLSH

Submit Download

TwemojiMozilla.ttf

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\fonts\TwemojiMozilla.ttf
Size 1.4MB
SHA256 6d90152ee0d29e82fe2a87793af5aa4b7ad13e6538360889e141e81ed299ee8e
MD5 aac75d901445bc0419d56e56dbc18891
SHA1 3ada434f3a727167ce6dce3b865fa6bfb70ed86f
SHA512 83fd92ff444ab6de18d48997247f49845abb8420a07b74ebc8a65bda8da69d28f87b6abe0f607b2fd7da398dc0f8cbe7fbf655af6d25785ad8b2f1a3afca136a
SSDEEP 24576:jUx1tOjzy675RUa0cHib00er/4TMXvBo2IvyCPKsUxJug7WwObnkBl0Z1koEXdwV:CeIa3iurjIExYrdz
TLSH
T1EF656C3FA704CBEEF4951AF6C9640A27B5D08D8522021287F74DF87F8C9D3985897A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\freebl3.dll
Size 1.2MB
SHA256 76f7ea778bda2c5bff12a5c941e5798308f2f4536349c699e00c692df521960a
MD5 69464a56af99ba723e3c3a54d3996e42
SHA1 c949e03f39b1223dff6a6f918ac282a3818952fe
SHA512 6bf650e913644fc33a07a23028a605570bdbc2616c3f7a9c19e50d0a948023af36c0d10d8d8703a02b3007cfbe03f149e1e4fb31490b00d5ea47dd10d2f37777
SSDEEP 24576:/1m82H/nJ99XunnnZnnV8sBkfmRfUUxvfUI0vXJMMha59Z+UMo+hBQ+4:Nm82H/nJ99XunnnZnnVPafmuI0x9wLMm
TLSH
T106456D0BF2B647E0D067CD7C1396BA23FA253C5D4B5136D357C886213AA1BD4B21AF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\gkcodecs.dll
Size 10.4MB
SHA256 55d26b5f2ec8f6c7a4b85deb198055f56fd7b6d51f4aecd72b267ecf25eed2b6
MD5 74aabd1bb0eb6aa111f6848fd9fa4ba7
SHA1 980ca21a7c4c96d2fe5c91469a280f4237e4ff12
SHA512 4741a351b5632fc5bbf482ac617314adb7360c6efe9543bc8406883efc57d6cc7de50befcfffd62685d37320bde11c14c94a4b28d808c3152eed9798578365c7
SSDEEP 98304:J+LesjEk6GdCwxnjZ+kMhyjuCxJTNPuBNncTh9jE+O2h/rmuBp5NmOacv6+obQTP:Gesjew1jZtPxwIvO2h/qOp5cQKRR8om
TLSH
T1A0B67D4EF1A351A4D41BCCB4527DEB12BD18389EC71856EB77DA16243AB37C0AB29F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clearkey.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\gmp-clearkey\0.1\clearkey.dll
Size 111KB
SHA256 f8938fd67cc81e316e1d6441e29203183e29e853aa855865efbcf5b682a9d596
MD5 243393e31be8f3ced36e1f02ae6495c9
SHA1 1119a6ccaf4536afcf7d4055a46c3b8d3136c3da
SHA512 08f11db3de7aa2ec55d2810fb4496642237a9a9a2bae75cbd9538b367bf0b07c6e5f46ce9a37d69e98893cc1ddb3027bd15b91d77fa4428a7abdcb6be1f7265f
SSDEEP 1536:MYEs17lqERSJPBN4cHrea0HnIR2lTY0GKQwqo6kL7oQk:NjVKzlLeRIR2lYbKQwqo6kfoQk
TLSH
T1D9B33A13EA9A90BFC649D97896475802DF22BC864B5276CF53510EDA1FA6BF46F3C300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\gmp-clearkey\0.1\manifest.json
Size 229B
SHA256 ef47e83036753b53f59d079fef62bfedc749abdbcdb0fe16f448d9920f11114c
MD5 cffdadfaeeaaf0a5a78e7f9a299aa7f1
SHA1 7a8f06d7c91877484301ce8474dfbb1bde08a040
SHA512 5a11e448389326ddbd3be792d9a10ae746c66e4a41f9c96f4979ec71fde385fc4deb205a40f1b4f24415abd9d41c453ca1285f4b813005b1d12a2701f214db85
TLSH
T100D09214C812DEF33CECA2295D554D5867A9129B19823C847B08174EDF599BF92AAB0C
MD5 SHA1 SHA512 TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\installation_dir_layout\versioned\InstallationDirLayout.dll
Size 19KB
SHA256 01b5a63f0566e04553d081c331e5d4f13f983592d9dde5989a1519bbfaabb573
MD5 8d537d9c98b497b825b961728c32b0b6
SHA1 4753354cdbd069c304dd1ac0b61cc6f9fb6c923b
SHA512 51c7e502be5ab39ba030a0cff083f1f2f241ed3949016c1a1f119d5228806622b7d5db8aa037294b2e8e9e6621819f07bab85fadfcddb7a08dc877ecf2a048d6
SSDEEP 384:HNmCCN3LNn2d9kvju46dWl2mNDsSofousJUKURFlmwpHbSFf:tjwtP6VsheSoQuoaq6Hbqf
TLSH
T1CA927CAAAF6444E5F5279A30C9D94A1BAD71BB801B8145CF6218008C1F937E93F3536D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\lgpllibs.dll
Size 161KB
SHA256 082a8d51f7e044d91bc8750e2a1e307b55df3b5c7086fcc97b278dd03b8902a0
MD5 03b1a0ba27fce90b42468f4e54b1e57f
SHA1 571c507f8a1d625619e82023fff59efcac19a18b
SHA512 e5c734e8e614e9bd36ff2827cf50fd415351eb85c601077992518ba6cb43704bfb2609ab1509989c0104f88d1e60ff864b9f685286967a8dd52dff667fdadb3d
SSDEEP 3072:OtaNMj4r08U8SO2HegDHYvME5GabbNNV+urBnr3S6q93EduDoxWQna26kfofii:OtOMj4r0Id2He3T1NV+mBnr3S6q90du1
TLSH
T1EDF37D25DE44886AD43A8C748DA38A179B7E7C8107151ECB5BC45E9A1F1BBD06BFB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\libEGL.dll
Size 57KB
SHA256 08a8b95b5d7f6d15f8b9189ab6bfcbe0d60bab2b098d5491266238388399afb5
MD5 43eef757f63cc3dc43265cfa75514be1
SHA1 61f7724b63e11f0af0eabad8ad19b0013d0903ed
SHA512 8ea0df8d8976b2793e035297e4756922dfaf630544b84046037d2cb9a1a224ea788ccb58c1bcad9d6867c753fc52f729d6517e43b4825c5891e653483f2aa4f5
SSDEEP 768:ae6kczvPW2iggs5a5r8tsQWRalBTx56nvcERWp4gVsheSoQuoaAOM:96ze2igZ5a5ZfRavx56njRW6g6kL7o5
TLSH
T14843FA3BCD6AA237DA0D8EB4C9A30C06EDA1BDD58BA274CF67140DE10C55BD86B79314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\libGLESv2.dll
Size 4.9MB
SHA256 195e417b78b975be9953e12d69b8c038d44320d689b5adeeb7399222e67e1e60
MD5 40d15578f21747ed3a1c8de6096dee40
SHA1 30c29bb92ed285dc1c325c6dd79afa63f22d8c6e
SHA512 d5113c5d4548f226a9aebd3727eab7c8c885b12bd679a2d652f2e48f6e7aed828edb77df65a45d40f2325c7c724f530f0f3e479c251a5d9343074cc0ce0584b6
SSDEEP 49152:E14CtG9mD8h5c0xGggV/wDn2eZOOdtX+LgT/ABo7nEq8xK2Q/++CsgUmq8moqBlS:E1qdZLhDXjFlC/t
TLSH
T126365B07F6A140A9C40DD279975B9623F636B889072173CF269883363FA7BE06B7D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\maintenanceservice.exe
Size 267KB
SHA256 7dfcbddfd2c884f1ec52cf7c206060b387387ceba2dfa0ed8f76362440f0b884
MD5 03552a5faed8c661a580e6f8edec1c7b
SHA1 4ecdd48d36159e156ec96d15b6babc2c22c59b9a
SHA512 f75ca2e2bc099aa48cf6e1a6ea7bef7d130b624a99f202bb353fabe022df1d04ef12d24162155e1cbe3a3dfe90b41ca9a616154ed6e8326c3cf6af71452b5043
SSDEEP 6144:cmlBwlrSUV2TUaSlr9/U+SJZCPJYwj5CmfKxgH:7BwlrFV2+9/U+GZRUNfK+H
TLSH
T14F448D2973A40DF9ED67C23CCDB28516EA72B8514360EBDB03A489661F237D05E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\maintenanceservice_installer.exe
Size 181KB
SHA256 23348b6cabb03c7bb7c80876ba3997ea6b1c640f90e911b149386e74c484ca73
MD5 0db269e33e87351e695a9a449888f024
SHA1 77032bd2726508915e7dad4cdf04815f0425673e
SHA512 5bf7f044a77490563a5dfc5f4123ab1eb5d195f68fcdc1d9a021dbd7a12d459dbf653e9fb9d3960d5f0da2e62990e1799ba13bd3c9726ee9a005001388072ae4
SSDEEP 3072:lNRCywDw1DiJkuKUNRD5bVPETem7y6tuU/RDObU7y4jem7y6ti6kfovZ:lT4DteUjD5JI9oU5DOY7y4j9CgB
TLSH
T15D046D01BBE0D592F9B20A303CB6DB365F31FC666E90874B6350B35CED72391A92535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\marshal.dll
Size 498KB
SHA256 e54fc9d86fbd7f3eb002b92a1dce542525cd6f63cf5652c1a7567757f6579b9e
MD5 04bfea370aa9797fe4341d547bd316d5
SHA1 c068788988edede3109f027f3f31af493061d9fb
SHA512 2b52c529ffe4da843dd4da3e8b25beac2f7c74b208c3216e9d2016fb88129bac9edf9afbec2d67b363feb675b747d263bd5603dbf1229480ec5dfd6e68a1685f
SSDEEP 12288:fQFOnIXiS/m+7FpMenWosalm9r/0jX/L/yHF:ffIx/maFpMValm9wD/yl
TLSH
T1B9B4068F616104A3C57F5378B95F474EDBB1BA1103509BCF026072A99F5FBE42C7AA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\mozavcodec.dll
Size 3.8MB
SHA256 6f5b7b83316a514db0cae4e7693e54a6d0fd21ce438c2ef3474f7af406cf915b
MD5 9b550a4d0c5f4d1163859d59aed7d381
SHA1 8171cb3b4aed3e00170ead1defdf0eaee2297367
SHA512 cf62c0b4a720d444b67c049b39bf953d4b59d358e749da3245306030144e9001e2cd557fb46a3a3046a93f1133f9bf9690b81b6c6e0aa7c2ac46a0470ce9d35c
SSDEEP 49152:QfjgPUnOhYjyStoC26ags+B+WWO2skRaeSV6x0fY94S487mcohcIAZGf6ca6sd1G:QQzStJags+B+WN2skI16xj941cZ6AY
TLSH
T1F006AF4EF0A34195C50BC9B493BBE727F924345DA71475E71B8782247AA2BC0AF3AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\mozavutil.dll
Size 595KB
SHA256 20c5bea46383f02264bc2dcb76709b5c1f34f0325945634162d41c40dc09bd10
MD5 fa168e03228b523812889ba198051d3f
SHA1 c975306d44bb780e026e09a1b56ed5d14a1342c4
SHA512 b3e2659060809d5c99ac84bf7b9c76a12199c2928c26faf16326fbcc7d7df51fd6f5c630c04bbe841ab19ae2cbf7d91b98cf7a1b4ceffe38619f7dd0a867c0ea
SSDEEP 12288:LEEfAub0kdmFnc8D8ai59PQOab1UgJYqN:L/AE0kxg8aOPLayBqN
TLSH
T1E6D45C16D5C2082FC4068575839F5969F3763442CB94BAEF339205283F28BE17E7AE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\mozglue.dll
Size 726KB
SHA256 5a7069bb5ceae9dce7c52233121e03c4adfe802d8c443f85971bad727756dbce
MD5 26dd9c8b13814b8c22fba886ed5c64a4
SHA1 c538a436f607f0277631db04bcfd71118022f8a2
SHA512 bb0dec60306c3b4c599b4c71145675bcb1c4bf835848d17c2afb6774edc4b1924ff6750ca0d31a5e7759e84f7ecc787e4715a93ff2461f0235db6faf9dad915d
SSDEEP 12288:dUCkt3Elb+X1wVYdnqoMx88m6Aj7jCXqSFRTOd4Av9Lp:dUpWQX1w6dnqn88ml7jCXqSFRs4AvBp
TLSH
T1E9F48C03F68A40F9E058D5395B9BD523FA72B845072579CF0790562A2FAAFE0B73E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\mozinference.dll
Size 2.2MB
SHA256 55de8b21b3a7ae48b078c527f21eff27c86d9fa67e50aa3fe429cd25b98b36ae
MD5 64065bef134c150aa291365e6eff6428
SHA1 6633624679feed83c214cd400433272fcc75e10b
SHA512 812c86d7f4b1d4b91c7f5b88833dabc47615f899abe2f75a9c5d9df12f3f8c9a718a74345a01b5b18d819aa8ccc28627a5f6f12c396e387003465a11f663f313
SSDEEP 49152:hivp3ObeeYH58WcuHscsAhO0PcP5wvQAO+QfclnP1:he+uHfK0N4A00lnt
TLSH
T152B55927FAA081A8C09AD0794B49D673B635B84C872539DB2F544B513F76FE02E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\msvcp140.dll
Size 530KB
SHA256 e530ee5ad678f74a0c353b0ebd00ce2d8edfff1848bb7fba7c6f9c2ede4db594
MD5 99fe5bbb9e53659d75e8302875d7afd3
SHA1 6cf79c4cd6ae9ffaec35268da8fed5a7f263703f
SHA512 4734885974efae7917fd158741b604ba123758609f3147e5db51d52cdcae0dfa11de47b36115453caa9331f5fc66ea4f68fd772d83e82baead7a1e9804630cab
SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV779:K0p1F/IiQEKZm+jWodEEN79
TLSH
T183C41A23F75906B0E195E3B8A1838302D7F1BC598322E3C752EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\msvcp140_atomic_wait.dll
Size 37KB
SHA256 2ee72df20087fad3c88f66ae8d11fbc2f1d83e69ea699628b94eff4c7e69294b
MD5 517f17892817f40bd791ecc61f34f606
SHA1 a8609584b5f11d3c854c629e6331938710031bc5
SHA512 2d705b16cedabf9b9fc80d378639607b25a5b7338f2e0c793416005226d8ac17e2ac11b394cfa57b4c18505438d499eb5377b212d004f28f2c625ccccfe23021
SSDEEP 768:PPMo5RIqKYwIgMhpLDQl4wFbZVsheSoQuoamf+e4:cOR+tMhNQl4wxZ6kL7oPH4
TLSH
T116037D19BB5804E1F5568735C4EA122FE6B2B6E08710CBCF2225559E0F93BE17F35B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\nmhproxy.exe
Size 642KB
SHA256 986c0a673b46e99866acdd2fb984e5a9553f5dcca2ed4fc16736a3f025a42a24
MD5 a1673047fe3134bbcf48912ae216ae11
SHA1 a5752941ce5ce98be4e77170312a4e10b5f0e840
SHA512 d20adae149268b34d493101052d8be9430026df922b239829b5aeac92b04111ffc51d8a35c380a5537136677c74be176cca74f0c2a6216a9cf047c130c0d57be
SSDEEP 6144:kvu6aKkvdEuX3j+lxrXR6bCXpY4rxdZyjQA8QkxGQNE/c0Q8D2SIfzzpAQFZ1869:au6aKIHQ7Xj9WPkxhNOxQ8qffFJL
TLSH
T1FCE44B13F64685DCDA1AC07D871682326637B4894B316AFB21886F3C3E67ED61E7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\notificationserver.dll
Size 59KB
SHA256 b151ee5d36ed77805f743ebce7e1042fc5835b8a9dfaa71e2c24782c421c4f29
MD5 8d40c88dd1bcd887950f17e67e48a003
SHA1 57b9c57cbe332b179a80d9554cb308189871b1f5
SHA512 33afd798feb44d93abc5b81735324c69d46f07f1adf91aee0747ebb7bf326ef76e02e5fe6dd522ca6a7f263a6c99e14ff0f5100fcc344d86253434e07377b771
SSDEEP 768:XO5w+SWv1bWOFZz+Z3nna4elmTIlnErauiNVwdyDDJFbLSbmeXVsheSoQuoaFB6M:+5YWdWtnnel1lOaNV1Wbmy6kL7oW
TLSH
T1D3536C43EB9600A8F9E6C738D2AB49129A73FD5D073161CF0385816E3FA1BD09B36765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\nss3.dll
Size 3.1MB
SHA256 8c8bc4c4e67c3244e667e146f8086eec9c89db475871dcc6113f909baa4edeec
MD5 f81aca8105a942016a77728efa2c9417
SHA1 7f8482d570214859b9e641fa07af5b18f910d375
SHA512 1189f5764ea5f5077c11ed17cf27e3132722c27a675caa4a31a916c0f71320afeb8c64d38fcab7bee0d528b18743a35a9e7606a6b480f362461c389354677273
SSDEEP 98304:RSayyPv/gf7D38yTsVHEX6oB1sCxjsKpCSG3:QTP3CVHEXD/nsKpCSQ
TLSH
T179E58D13F6A510E8C029C279979B9323A6B2B4454F3876CB52945B153FE2FE03B3E758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\onnxruntime.dll
Size 9.3MB
SHA256 6f3c17f2e2b66d188b35c06e460bfb66ef0b256e1cc7b67bd64645c8af61b2d3
MD5 cf679b27138e00ad244a767724477335
SHA1 55ac96b2c1725c27218fde40f0a62e67bf65d4af
SHA512 fa4eae95148ec666fe1a670231c3d5939872301c833cfc208de8740a178952046a0fa491938edb4fdc476900396cce56760bc5378eaceb013cdc9a80dc6f5571
SSDEEP 98304:nsihXTtRrgHYsE1/0xYNAvFOyj1rYOCmelEwEuTB5Nnad04Fyd:nlhXTtRrgHDBxYNAgySOCme1EunN+Fq
TLSH
T148A67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB01E254912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\pingsender.exe
Size 77KB
SHA256 50a02603c6085e9156b65d3d1f44a8e1118e912661a11d00a2cdfa697525834c
MD5 102ccd54f690426476afbc061f09bce9
SHA1 7caab727773654ffe8b025fa0ed814ee94317a1f
SHA512 07e57a0ac0ee34bb996df1135ceb75a9a2e0ab7faf9765666ae4d006f91395d0274ea65c7d57c6a936ce553cdbec53b2d5e19286ed876c8170e647ce5fbecc15
SSDEEP 1536:GILDYRoDMwGZw+adBkxVyFQ3Rn6dhiVu6kL7oZBi:GILwZw+a0xnh2iVu6kfoy
TLSH
T16F736CEA5A6051FAE451C2F0D2EA1313EB7575892B2666CF938453623F037E01F7D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\platform.ini
Size 158B
SHA256 8a0bb109793f12c39193cc51177701a1749bad7f0596f932287f01fae5c6ebce
MD5 a7571da38a4bd14f9611f12e770cc61b
SHA1 39e2e5bee4efa505af5ed597a41036bf9fc9536f
SHA512 51185bc430d22c89ea361d33d53a312128506c0bc90329450fe8d8f934158b0924bc70a590aa59ac6ffc64d05fde739485d65a803fda5b08da14abf0f93ea332
TLSH
T19FC08CBB0010049A0EA63282D0B06D8D826F0EC14FCBA418B021038E1EF590B82AA46A
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\plugin-container.exe
Size 139KB
SHA256 82ebe3b205fe11f1cdc9b05c452d817fbaedd6272b0ad8f770bff83b417d3c19
MD5 4e3f6158864d8705df5d3d0e4a167d31
SHA1 3992e3e9d42c8299b2ecd8a75ed38446d41ab40f
SHA512 6278e66b14069ca5f2eb84ec3e5beeb4ffa970e0ae752e39cd2fadad16377b614e1f41092cc6b66379a38551399d82396739f44d5406689987a15e0cc374bedb
SSDEEP 3072:0Xza00GF6fR7Pzw1klAo6X9K2KgMPOlP+T/V5MbM4VFWW6kforSM:izMGwZ7z2klWNK2/MwWT/IV8sgrSM
TLSH
T1B8D36B13FA5950FAE559C9708A824612DF72B8860B30B7CF67940DA12FA5BE4BF3D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

precomplete

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\precomplete
Size 2KB
SHA256 22c96cbf4013bebc53b40513ab38df386f69e2f39755ccd85b3efb19699dd42b
MD5 e48e2c4a43825a2c9fb8709991165ead
SHA1 6325093334b65d628f9f217844d0dd4b3fc7b0ff
SHA512 7302dac2c8aaf8eb4317b3e0acbdc63523e5f4c1510cd886fafd11201cb0d791bc922c50bec05050f1348276dcc6f41fc6ea3d0fb6111a84ef42b04cc5085a8e
TLSH
T1BB41258CD02EEE6169D651C884D31D8F3DAB42A6DD9DEA781EC311447FE35EF010D62A
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\private_browsing.exe
Size 132KB
SHA256 af8495d7c8dd4192d90a17b6df2d01295d965221cc3e6a7aff7e6d9224507c11
MD5 b0a61cfbdfd210be235d7b1b55c7e932
SHA1 d825a895c07874d6124d18aa5ce2c014c7d6e455
SHA512 ca392d744e43d49a4c8cc10ca8b1dd5f8ea23515d5f9caec9b1427a8dee3d057e2e9503f5cbc109e368203a2cac81a044fd34125219c394da5f88ff429550da9
SSDEEP 3072:449i0HFNqFx6m6N3MbE/66TsnA7F9B6kfo8:4S/qH6m6N3Mbu66gngrg8
TLSH
T18DD33F8A9E858E57F07CF17E45B68D35D55AA60F230051C3BF3CAB83EF58B94282D606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\softokn3.dll
Size 355KB
SHA256 6fcfa7d0da09e1350b962f88a6403310d40f059b4ee744dafe0b0016fd009b8f
MD5 fa2e594a7a028239b18ff9895dc03f1d
SHA1 639d69cdfd0920b1a009d18dbd1634e71789cee2
SHA512 9a887d47c9a13a1d16e7ec42c88b78be30225b66d1a351e8bc7629a6fdd320dc614b984b2d674a0526a4a07c92989f568dc01fcead5a17431421094dd1d5b8ef
SSDEEP 6144:+80A2J4DmexNlUGyE3QovWJ5SCyVppCTca83eufTySJtoON0E9kWIxGgH:F2J4fxp96SCpcyymSJGs0E9kWqLH
TLSH
T155743B03FA9155FAD806C475A1678732B5B3B8940731ADDF93285B2A2F61BD0B73C788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\uninstall\helper.exe
Size 1.4MB
SHA256 0907febeeb5e417e1958c2b077b77b89e91de97371431ae8961110a5e3cdb064
MD5 f7c32d39e85e96345f76f6d016c0228f
SHA1 2b5556ab1be5f2ecdcbef849afc14466a8072cb5
SHA512 d7f3211418f6881fc4193198ccc017c182780d83db272394377d5d192bbc3c99c352de576e3ba969ffebcac35ac783b9099734c3102c8b4cf3ce8fc1511f097f
SSDEEP 12288:nTCUjD5dhTT9euP+bnEPsSjlSoTUJDJf95+B7a2SooEPl2:nT/hTRhmbEPsSjIoQ0BW1oZPl2
TLSH
T1B4651803A790A862D46E6D3064ABD7253B37FD812E7186473B1DB39C5F73340AA7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\update-settings.ini
Size 116B
SHA256 17224c6040c70203f9228f35c345ba7f72e3be84ddbada6fb8f971c701e87e30
MD5 68acb4ae209a1fe7910b85a3c43c5cf2
SHA1 c70a6335fc65b17453a88e59bdcec7a067c94cfe
SHA512 3bd99664ce6abd681bcf8c089c7db5759eafd165d6f00adaa8c900f7b988e98cb99342778e90658ffb17660ff95023f49f8efeac28bd7c366a208df6c3e1bece
TLSH
T191B092895A94A84C8113C462EA6D022305A2C529090521252748E441B3E77208ADADAA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\updater.exe
Size 984KB
SHA256 05a5388b6fa334d41d1f5a102cf81f77b06b0f94fc5c826a08e88d64626e6a2c
MD5 80627f36a7e91739f0d43b9c97765b26
SHA1 7bbfe8b1a36a3c8d2f0060737f03d9139a465630
SHA512 922aca36527f978ea8c70d2e7acce8036e2ff716ac8a95c26e4063158ff4ffa12669027cd4d96cea79a719c6983e218b8a77c345d12c8525f9a4310222c13c66
SSDEEP 24576:eHfh/Xn4boVk8yD45qxhbhth0lhSMXlWBJ+RAm:eHJ/Xn4sVk8yDBDhEZz
TLSH
T11525AD1BF7A041F8E469D9748BAA4513EA32B88A472166DF07D48B152F73AF01F3E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\updater.ini
Size 1KB
SHA256 a6d81b46188b52069c2582dfc6b4d682bb722c2436cf5f531fe6ed0c94952c9d
MD5 27a5a5f5ae9b41546c9b6c7a0eb6f026
SHA1 21dcaed4a05199f407230b60fbc554a23e195f33
SHA512 a6208e3819debb7a169adbfec9a426570acf5e8117258dbf8faea4d886c923007e52cdb3cc46028878c3aeb810a9f7b9482f92b1f77b5899319a1644156b11d4
TLSH
T1F62121562688B3F409D29B85BA4633D6D78381ED23513120A0ACC160434793547FEBE9
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\vcruntime140.dll
Size 110KB
SHA256 66117f754c026b1890726a72f6ceb3c56e3ba028d74a8428b1122983ddd8b771
MD5 191e66f02ceef743339abcea9a2f591e
SHA1 2756ddefa6485845f1a94f497d380e840a8b1f29
SHA512 1b6efbbd3bb10bccf4897a341be9f5a525496c96d66b7d23e45a7da3c1996712b441cbb000ebf2bf22bbeb4198ca541ff78d82ed9227f8bbc7a1158969fa194a
SSDEEP 1536:T9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lg6kL7oA:fyA+3EOfmpcGSdOecbeQ6Nxg6kfoA
TLSH
T18EB35A4272B802FBD16AD275C1939E6BE7B2F40587645BDF07AA46660F13BE02D3D381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\vcruntime140_1.dll
Size 36KB
SHA256 772990496ec3fa1ee8ac05b91979054328abdd4dcda0364d1caa3ba5fd6a117b
MD5 627a86c0eea7d7e45cbc9ba06e93ad71
SHA1 0f1a0e7fef4fc610680b3947467b69bd6adc69a3
SHA512 1e2136299e42a4f1a4561e9a020511a6bb894dc632e93a0657598c3c982da593fbbe8b9d739ec8c36c592a76c2c738a67fe91e3e111be7be2999ec127674aa36
SSDEEP 768:cezSkbhNfI4fWLZyS/dPWxuVsheSoQuoaK9JCRkF:/YZyuPWxu6kL7oLaRkF
TLSH
T195F26D1297A840E6E4A7CA70C4EB0E2BEE75F590576087CF2E68455D1F137E06B3D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\core\zen.exe
Size 862KB
SHA256 8338297aad8fadef9043b55e572584308e8a4fa343a9194ed0804d615cf0557e
MD5 a0fe5c5df1a3ab553462132176cbc97e
SHA1 2ad69f8278762c41379a27d8429bcaf5f4aa3f52
SHA512 5121f59ba32b76424b91234c0bd77e736cd98e2db4f46857038f1a1e2485519596bf4d2c6c76914198f09c6c06d61810340bcb5eacb7b9602d93502baba3f684
SSDEEP 12288:npDiH1Qjy28M3+w2XRr4XoIrQjwbGYbG65bvngdrXfV0:pDiVQoq+w2XYoIrQjwJUrXd0
TLSH
T1B615B312AB858CBBF078C0398676CAB5D5257C4E83D051C73EACBE633F75A9016F9606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E35FC58\setup.exe
Size 1.0MB
SHA256 db2c67be5f6e1315a1d63777bf99ec3826353c655386f3c2e629cc26e49bbec4
MD5 343601c2357ac876ca8537db3fb2be62
SHA1 e86ae3e825234b807b243cd7cf2971095e0000c1
SHA512 9894fb003c644f391f135895376dd4fa943d1c9ab2453fdb575be89383deae72c699761c4668427afa33681b0dc8f608bdcddd9e0b93848509a0f047a8a9b6ba
SSDEEP 6144:nT4Dt1UjD54JY/c9Is9es0mPH+WSnEP+rdlqSB9G3SoTg6:nTwUjD54ui9euP+bnEPeqSjwSok6
TLSH
T1CC35F603B790A462D46E6E3068B7D7553B37BD822E71826B3A1D739C4F733409A7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PinToTaskbar.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\PinToTaskbar.dll
Size 3KB
SHA256 6bec8a69845fe9012a0622e79b63328fb611151fd24f198a779d781a36dce5a3
MD5 70016ab449dd0034333b0df88193cb82
SHA1 add0b693b75f14e7f9a063d0de1921c3bc8d1a52
SHA512 1295dbe8596a37d0799b51c3be011b2aeb499d382bd860bba784dbe5a580f6d2e1116830c4c619ef32df9c5f7af0aceb600c2c7a29e321cf8e355c73627ffc71
TLSH
T1297162F3F3644076E22903B84847C42CBABCAB1213AE4697789B611E2E50CC579A3D92
MD5 SHA1 SHA512 TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\components.ini
Size 602B
SHA256 f1505640e352a1748d1cdbc6eafc0ab21b0de520c6ea6b750d6eeb41b868dfe3
MD5 637a9a06841221d166843d55316167c0
SHA1 0aaeb03991f6f828af3b90f37e6c73ee7b94e6ae
SHA512 7a3215326798d9682a8fc2eae643d47314c971f5acda4094d1e9daf59defcfb36e3ea86ccbeb3426160e0fe29fb6339c9bd70b52317fe8c1b42ddcf3b8f106eb
TLSH
T1F9F09A472AF80418F4F7B709FEB441718B393C45583DC50E91E1080E48E4A808877BEB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\extensions.ini
Size 608B
SHA256 720aa8b6f178388a59f15813316970a94f51e846757b15d580b1d509316bb5e2
MD5 547d15df652f9853ab4c66206a09b8e3
SHA1 29de0648ef4fa46d6d9bca2e64616931227ec72e
SHA512 b0251ef0fd660ba9d3157dfd6cd887a7804164dc4edd5dd67d8a0987dd59f8748d80181d4b7597b384fa94d21af0673879dbde3e1eff590a3c33dffcdb7ad101
TLSH
T149F030532EF9401495BABB14FAF581719B357C855C3DC50E92D0094E0CD5A818937FFB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\ioSpecial.ini
Size 1KB
SHA256 6de3884a9e1a16f7a8890e66a6db65dfcb571a9c0ab047d1ef7651a847e2e14b
MD5 bbeb431f1b414eba0afba5d3a5ca1cde
SHA1 8192884f109dbd19b89926003380be9b7c7df95a
SHA512 e6895a8d8f44859bf1c40fb62cb4e6acca9a5f17cbc15e793831c6e30b01c4a135186e479b92d0180aa0b65565801bf82cf31e76f289c1846c38b496b352b020
TLSH
T1F7218E132EFD5024E2BABB08EBF4903597397C55582DC51E91D14A4F48F57808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\ioSpecial.ini
Size 1KB
SHA256 fd3333f6e2051fef69cf2bdfd31dd2ff0f69122b78aaab07b10a2d903ed1d101
MD5 0232b36b998746b83c35ab6d6e7639e4
SHA1 a17255d1df1689f70fd8dbde85bd7941be27861d
SHA512 ad0ce0e08c99b44f06f8bdd49e2b5033bbcefed367ca4965fb2cdf81de9909a9ec2345d9f3b25b0b50383f74255082df5ba9834efe28c64bef0b10e1d1619dd8
TLSH
T16621B0133AFD4418E2BABB08EBF5553597397C55582DC51E91C10A0F49F6B808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\ioSpecial.ini
Size 1KB
SHA256 0f1d21e46eac4c4c9c8caa65f80ac5be4feb9d81a3958394fe12e3518a5c7c4e
MD5 4661888022873711db553ebebded6442
SHA1 01e9d4f79b33c5ded3e8eac7a505c85a15c9d63a
SHA512 db0e21c73abd567fec3f2c7c85221613fb00c527a78087e254033584fe0b9e6a93f1b979b23a09363bac426777410f6e307fb63a0be21b20e72921c22eab0eae
TLSH
T12D31AB437BFD4514F2BABB14FEB451748B3A7816A83CC61D91C1094E09F6A808923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\modern-header.bmp
Size 25KB
SHA256 689ea80105f4e61ffc73062516c7d7053f92bae0c700c0673c3a9b445345df1d
MD5 cb1c4da8daa79279041011b85f48c3e1
SHA1 40496c445e18eb28686ef1efdeacf39153a91062
SHA512 eaca5a8e4503c3b62a3b675de44698af80952708fc4ef19a1e0174e4dfd5d6d4af3a3a9f02c4c8ae2c8fb257ff15fd26798d5dc04cfbe727a2fe7050491ee5ae
SSDEEP 96:aCCLLsFslQUlQhMs32QcJYQ/KgGvpNgFtQXPFD2ak29SiD0bFSCxPw:aCMLsFSQOdINUMD2V29S40bkCxY
TLSH
T156C26A110F8E1647E922B2AA323235587DCACE0D56F34667FC0833CE8AF701C2A352E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\modern-wizard.bmp
Size 201KB
SHA256 c03931e6f022e29943d410030595712a29285c1130537d552a7804845a07eca7
MD5 faa41c5d172376cb31e0bbee19d332fd
SHA1 eef931a54b02588e2ee9b202bda14a612cc8f423
SHA512 b65514d05512cbcf27c5a06b97a2454f66a58a2edb081fb1949a0d91d3d9a47c9eabba6dc521566ec44b7fa7b7a863d4bcd6d5bb01a6633d978441b6bf624ee9
SSDEEP 384:sGiFLVfy3SqviWSlk75o3gDVxYi9eFQthspiapMjuqh8fLCG8YHwDT1bmJ:t/OiapMqB
TLSH
T156147F8751C424B9323C3E4292AFA80974575481BD3DBAB63E8DA3634F938E78B3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\options.ini
Size 1KB
SHA256 fba4cfe357d29168de21e4718f15f070d08fc0241bf771d5ac9f6373979de176
MD5 15ed0cec8a172e53230584b54b69f882
SHA1 f58239eb5b9693b4baccc836f901416c2bc776ca
SHA512 620e4b83a1d2d5eeca2cbbf47874a97889f035a0341bd38aa07be7aac41d283a5cf7b9b86f1da60df0ea0ebef64e14d5f6eb76da56c40fc36438e804068753e4
TLSH
T1AE216A632AF94116E5BABA08FBB581309B397C46583DC60E82E14D0E0DE57808477FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\options.ini
Size 1KB
SHA256 1c546b43c3b89ceb71e81802181175c4751860b56e03d1f57ab2ec97cbc2c09e
MD5 158533af1f2ca2ef926a23e6b4873a1c
SHA1 7bf1540d31d8c9e08bfc0f0299b3f9eb813cebc4
SHA512 5e3eb6d228aefe991fad6445a68cb7d6d65df6d159b20a45859a7b118e1e320541f4af74fcf8ac5e84e7d26dfae842aa8ced3ee89d2f93b5e1dd5ffd6b4af130
TLSH
T1972180532EFD451AE1BBB609FBF5403597343846583CC50E91D10E0F09E6A808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\shortcuts.ini
Size 866B
SHA256 d1f6b6b6fc20b84ce925e0925f9e180bc924c8f24c788edd90c3001ba15087bf
MD5 751525a3fd0e53134d4e178390655a67
SHA1 5ef73cda0e4677814a8a4ecfc4a112a563d430e3
SHA512 af4686c2db651d8c00c46f4800f2641f8870635b6a5b7961f2f1a4dfae64cfad0dfc485030488fcf2549a1b35748728c16ed1ed66ec441f672326ebccb4a1fbc
TLSH
T18A111E032EF94015E4AEBA4DEBF540769B397589182DC81ED1E14E0E48F96808577BDF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\summary.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\summary.ini
Size 812B
SHA256 c7e6c79a1b83b47eb5122331d0eb7c50320b0bea7468fc936a0a0aaefad88ad3
MD5 ecf5e5897edda77b9075b7c409838f3c
SHA1 a97bfb32acaa1783e1ba50b5a9fe68613d7acd5b
SHA512 cfa7a379f6ba6f1f7ac76ce083de86fa86c35e7127611d3c1d6f3c9bdec4f880b2d4c02fe899a728757fef5433813d2ccfcd8101f2e9b2bd67a5e91a191df59d
TLSH
T1CA018B132EFD4028E4BBBA09FFF14475A734B806182DC50ED1D14A4E88F66908927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq78A7.tmp\summary.ini
Size 654B
SHA256 f992973d4bd9c3a9313b56f75133df02a7bef20dcf0a72d8dd19717bdc08461e
MD5 fe47800b5174e74c796f8d0bfa4b9af8
SHA1 c420f33e2d5f5e1750a4fdc2842d19f9fb71535f
SHA512 8ddc435e96c4062f18462f02ac5e3a021c9d72b6160f9d9c4f1284420d29da3100493a743109bc0bcf7e7355dd482691a48eaf7a0487bd1379e376098d54f115
TLSH
T1B5F06D436AF84068E4AAB61CFFF5807597347806182DC90ED2D14A0E48E52908467FEF
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 565KB
SHA256 9e87ffa121c315ba1b0209ee2caa375d4d2a7c4ea89c69447c16a358db68579a
MD5 c9a38cfc9ad727ee466548de78b7d68c
SHA1 19c1d780f6bac9c7dba0ec24fe20aa719d56e325
SHA512 c429f6fa1b57ab6b96e86abf85d77954f309e42500290f2d606ca7123651282f2dca4410cca23d18c21b87e3fa603b00ca4a592345fb85d5faf8a7e61de04d3f
SSDEEP 12288:kVlg0iA5Gvois5HShMLjPEOTuMTbYIaW4neBrrHqN1XMgDjj2DjyrdE5yGuz:kVy0a3s6MLjPJTuIqjCr7q/MgDG2pEvu
TLSH
T188C402F5F7A038E377BE420B9DC66FAE1B565522C64BE0CC443B6BC24557729AFA5000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 23KB
SHA256 98d20fde58130fa34aadfdf731c7a3b7d63ee8472abe375516f69876f308c10e
MD5 d6b2437974a443d6dfa874396cc7235c
SHA1 c6e0862067c72dfe24d5a356b60737b67d1a4d12
SHA512 45de628c195ba9cd39a366169afef097a3bbcb8e194bb36cc3cf096d436cc08c77f778464104c16a4afa6e168eee2ab3ad79741812c8830ae2ca9e1cdd065a8e
SSDEEP 384:pNT5fDTJfmNlTlW1qeI/E3rPNVeU+Ph5n8tA82pWLp8ESYIzbZUm:D5fJiWAfYC5PfMzrLpMFzR
TLSH
T13AB2AEAB5E064626CB7B873500F2C141923C443DFB49B5166DA232991B1FAC83F17ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\zen\Profiles\jy0yfpum.Default (release)\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 21KB
SHA256 ab2d1d8a36cfce54c7f0312f590e5febf375e23a06999dba566eac966877444b
MD5 c7853e340aef0657c9a4c992b7f886b3
SHA1 94c7a0c232f68027a2f7b704e1099dfb482c1d00
SHA512 dc0913736da7caa29dae38f389dabdb22fc9f7f0cb989ce4aeacc262b6d8a1932ac982066004da6323b6be9287299f9659e845e35c29615359208c5ca75398c0
SSDEEP 384:HwCe7iO024YWDL84+KDL849B7SOEAd9KVRaAcP+AWRMAfTUKisj8wkac8Woh1B9b:QqZYWDL8ZKDL8CB7S/AmVAf+hRMSUKie
TLSH
T1CDA2B07A5F403CBC199790E4C8BD42E64C28BA67DFD6807D25683D0DCB94599B1F408F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\6wjxle1n.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\6wjxle1n.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\6wjxle1n.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\6wjxle1n.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\6wjxle1n.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\6wjxle1n.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\datareporting\glean\db\data.safe.tmp
Size 140B
SHA256 62acba2ba39b8494eaeb28c64613b7b6b5dae225aa76e1b205017ba1253b609d
MD5 6f0ce4e4f0fce530d981d48819cadfe6
SHA1 60c2f53e184f7cc4d128932b46928340e1c5ac8c
SHA512 d5aad6ef70202f97aae8a1f116cc54fa97a9c2027cf8197d137b160819963201bd60d10ebd48865cec735bbad6aa87c59a1c5dd0ededab683e1795b299b1b407
TLSH
T1F9C01280E7A19804E4455237000003120344581100E2E6039014520494779243C78C09
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 f0576424a06231b3b9bb464f7e32c1b374c4c9a9c158cf549ed5dbde8f4a7e90
MD5 81c582043585b58d72a1cc8c77e2ef13
SHA1 92b06473be13cb6186ef06d93a54d2ee7d6a2fa6
SHA512 5fbdd8de4d4a76a7082961225b4bbb23053c8a6dc6cede69d67221a7da7751c61ca372c220479986b90faa66567382b2e6ce4ddedf7f15b6baa6d4e5b136a3c6
TLSH
T1FB213798EA689436E089833AE8961F555F31B018E48E7F24702C611C5E4E76B33EF93D
MD5 SHA1 SHA512 TLSH

Submit Download

6b87e011-86c9-4f84-8fd5-cfb18d8311d5

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\datareporting\glean\pending_pings\6b87e011-86c9-4f84-8fd5-cfb18d8311d5
Size 712B
SHA256 faf020ae9335bc7f1080eca2787afb7847e7d30d38fe29bb63f574ac313f6e90
MD5 8d82d85979e4d03ada1cedffda3441f5
SHA1 506bc5dd7ed368adf445008f90bbb8fc9c61552f
SHA512 9592b3b6377c1386ee0b99cc1f021967e994fe29d47b67d397975cb49e7f601bce6761a682e0e3f783b513ed814e71e8baa770fc1e495934a0f7d2db5ff28cae
TLSH
T1C701FE4A29E8D41608D6830AF0E43F4564BA4037619AF309D0E4873C3DAF64F8773747
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\extensions.json
Size 13KB
SHA256 a990df4f54ff23b699d496a7d8de56b0473185c43c569e0e5c71a80c736d36da
MD5 e9707ff2c39af0f719a76a06647d39b4
SHA1 8424c11af00271be0bf930771c0c5aa119e4f406
SHA512 7b2147fee6466e954695c11267fd12ba4c0a747b6e68f19807afcd23db5991f85e43839ff70abb9401878880820badb9a71958bbad5d9f5e1579bf4cfe517da1
SSDEEP 384:s5T4ij/7TaT9uj/7t5hTYij/7dgTldij/71T4Cj/7VT6Ej/7uL4HJIL4HLNfL4Hx:s54x923YQKf+486P4pK4BD4F4i
TLSH
T14352FD1544155EB8298E63DAD9767E02C27C673B60445C7CB8ACCFCC42FB1BE06A361B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\prefs-1.js
Size 3KB
SHA256 81100a17f8f67d476d621a8c1b8f79bd195493a03bbee553cbc2b6d40a4b9f90
MD5 b677c8a54c29c88387c7bd77b20ced49
SHA1 5e283a43634c5198d4cce162c95c2c441e32a3ef
SHA512 9cd52316fe538d897932ac345570aa1657c10e6bc8372453551cca6b6398036a688b8fff6dbd9d6c531906ba2f1771bdb84b2ccda9cb202512e289796be3cb60
TLSH
T18C712E785604DF6F61B633BCBC148A7096B2017B77BF68C610B88089110CF3942FA5EB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\prefs-1.js
Size 7KB
SHA256 4f153428cede1eb325f48b70098e02270db7b7dc0057e2452591bff06b5c9ce4
MD5 b9ffd6752eef8bf84b8ba3c0ddde869e
SHA1 4a4de73f5fa145a092392851b8bb9577a1f9dcc7
SHA512 9f519fdfe0627f56e70abc1187b63b7b82adff92e90881fbe42701e3edac42c04bf6fc7048e750babbb10c00d030d7f5031573e56b37e85895a335446f971189
SSDEEP 96:xHNBmTeqGqIqPrqDgGpqzvzWzB0vgH2vyT6T1LTTjcWcwTGFOVChNl9Bw8CDv3Hr:dyRD+DgGpUvgH2vThcwaACh79Bw8CjMc
TLSH
T143F1DC6891049FBF35B2337CAC648A7156B2417B77BF58D610B94488110CF3946FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\prefs-1.js
Size 8KB
SHA256 0c294378974de04f174fcf8b1e44a57d961aa7495a88ee02a0d63a453137a0a9
MD5 eabd097c49d5cfd9412de0f4cb4723c8
SHA1 34a7b119c975d20e1726014a3e477ebbce5dd041
SHA512 d0de3f153a26cf47898ca3d3a1ff8d991db2ea698c2b6f11f0b5dc6f75f72abb358d974c7f61524a284ab47673c64923118b97846d0df98b57180ae5f0bd5ac3
SSDEEP 192:GyRD+DgGpUvgH2vThRzSiwaAnh79Bw8CmMc:sz8RzSiwaAhzwrc
TLSH
T13D12DD6891049F7F35B233BCAC648A7155B1027B77BF6CDA10B98488110CF7946FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\prefs.js
Size 4KB
SHA256 d70d323cbf0b4c82fb6405d54078eb586ab8acea2f1d42d8a2983276a31c6efb
MD5 2f717b67f0c188381ad697f045cf781f
SHA1 84ebdb1a0d1f3c73115d751044044872895ec2ef
SHA512 e4d37d978df2dba6971fe506bfcc9df0b7d8a36f6759b1d69603550d7b714c5ce2fcd09a5d9e76bcdf8469d412568a03b48434ca445aa6d1e684d23a837971d5
SSDEEP 96:xH1BmSrqB+zWz/6T1LTTeWcwTGFOVhhNl9Boav3O:5WBI3cwaAhh79Bo9
TLSH
T1D981FC785604DF6F75B633BCAC148A7096B2017B7BBF68C620B84098110CF3942FA5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\prefs.js
Size 1KB
SHA256 dee762a7b2446b4c674b12f9e5315b77849b8d9c30d5ff1f9d59f60a8e857dac
MD5 ea57570faf89be7c1e7534ed7eb099cc
SHA1 82e20e467ef3d4e1cdf22c9d7cf5e1c39ae423e5
SHA512 cfb31d810c3a780e1fa1d3f73178d25787c7fd1f22092e28b325d50a74117d2c689f78fe10a350c358fc2b14927ae87edfdcbd975e3b31ba2693f2583efa67d7
TLSH
T1BB31FF622905DF7EA1B4376CFC2A4E6093A34276B67F98C524A881854118F3447F69DB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\prefs.js
Size 3KB
SHA256 5f6c6eb7448a73f1f0a6a79d8d34149cdd575a4849644c4b3a196fcb8b0f9ac4
MD5 6548eeb7e7949f25f2a9dc34649c5fcc
SHA1 a385b09ce664a5ee0eec117ff3c4073a8debf919
SHA512 5dd6649345cc3fcc5d274d6f31bc4bb93babdc3fac0f9d5651f9e4e4a673b4d05edc8664d7fdbbdf7d3e2bc1b301d684c233e8861057273b4f58a8318a14b23c
TLSH
T1F1711F796604DF6F65B633BCBC158A7096B2017B77BF68C610B88589110CF3902FA5EB
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 beb6ce51e6730bf5b42ec69afb1d56564cd5734be6191261d9cf318f516427c7
MD5 a73d2432c3e80ff8fc24c494ecd4a263
SHA1 6862e52661ec5d06aab2dfdc94543ff78ac9be71
SHA512 205bbd6978ac473ba7577d718f2ccc397635506cff849ccc0d43462860719687fe63d38d7ac3d02947d3858ea02ebbf41954f5576d777c4bc67f5510e56765b5
TLSH
T1CA410C03F9794AE0E759E6D8464E9FBD2159391747FE1C90D90909240AB822F7D8758C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 15fb18eb2c139f7001f916d8c3b096c503750c9ff1bb372baf86bb311dffc1a7
MD5 2e34d367a77ea8ec252722c0a6b9f0cd
SHA1 bbb753ee9edccc6b0ba83a045b64dc4d9ac4e4be
SHA512 18d7f21dd3e5c8bb7bf1caac28f3c15eaee24a4665f9961c8d713901fb4d700352c00203fd6ad873ca50af765cfd8828c6c78afb8921e6052c108cdfb43af0af
TLSH
T18C713A53ACB15BE0E76D97F5244C59392756A86B02FF28C459AA15AE07F030EBCCE048
MD5 SHA1 SHA512 TLSH

Submit Download

2918063365piupsah.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Size 48KB
SHA256 85bc33e83573d90fd504b483c178fbf388031f8aee42335d538fb36f1c282f6c
MD5 e6ac18535db20c3c66fcaada8e4c37d7
SHA1 2040249596cf39473dc09465fc8ca907dc31ce20
SHA512 0740189d4e05e9f3ced27dc7a1ab0ca43100d7d30a4d3d2196afe29d463115c82ce32b417ad77d9dde448507932482f796d6fb324e13b3f85d989f060f0b0a64
SSDEEP 48:T+OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEb77:616S6CKnqlizbxV+2xVeU7X2B0b/
TLSH
T179235F8E3F07E511C53AF0B178A08D51FC5E321D07222AD57990DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 dcb628ff8d7453df4f9d0149f84bf7195511fcdb94051902ec5de6b219ae3bd2
MD5 1e2341234e3f38b41e5dcacdff2627e6
SHA1 9992ce4a20fc86bbd859bf3036c72cc6ec6efead
SHA512 163eab8016c31d6ea677562a704642dbc617099a20df5820fa6b2012bc4a17e64cfb207eefaa9b5ed93869d1a7594adbfcec80d65aa916712549736fcb14f2af
SSDEEP 384:G6S6CrAWNRBvOPv7hvKovVYvC6v1xbvAPvp0H7/NUeKN6eAs0eq8hetMRe9cLef4:G6S6CrAW60H7mCoefl
TLSH
T1C34385C87336EE4ACB02D87E04C683EF808D7E6900B64D893676D75C84654EBDB6FA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 858d45a0705a0b32cd3f97ff04247f1e237abcab408866ff3b2192d40e64c95c
MD5 7b03552a93d1030389ec95f04a789913
SHA1 fb26d4a0ffb62df7ec08b5344ca9f2040e0840e7
SHA512 001bdb026a9a02c4c8bd6d56069ba7cf434d0445f54126f88898ca355a6368572b1a9480ab9bf7b3a1ee7535f6afe5d2f42c10585df4a6ce6ad5ff21bb9371a6
SSDEEP 49152:iuwSRI8YWixOwGe0qfiX/fAmsNIO9KpLSNmW3eL+O6rxIixDQI1Adr:NtwGe0qqvfAmmNAx+p1BJVud
TLSH
T1E4666CF820D1A257F3814033658593EB21EFD00C6037DA485BD99AE9D4B4CEB9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 15.2MB
SHA256 c3b8f49c693ba89323d869f6612eae80f32c49919375f21a86aa18f335bcba8a
MD5 375b5220a4a148c76bc55197534e4432
SHA1 ef4beff7a6b8271df11d69bbe210139ddcb53a5e
SHA512 5032e05e25976ff68f31cc33b296628c8b3198f120b5cdbdc4586789adf2111512510e8c0f8d5871032e58a5d0d3b025e5cd9bbce0ffdccb3b3b5c2c189f8ad2
SSDEEP 49152:XwySR78Y7ivOOGe0qfML/A24tAFrzTvDzpLcNesbLrywL+O6rxIisJjVDQI6AdeF:UnOGe0qUzA24WFXe+p1B0VtdJn4
TLSH
T113F65B9271E0CA92DB0185F2F31F43DB316FC1DC20E585982678BA6C995329BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen-live-folders.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\zen-live-folders.jsonlz4
Size 15B
SHA256 0dd22af73bf7560a8bc72ee90aba611c1241c2054d488f75d90a4afc27309efb
MD5 e88094f8457c6fd244c2787c6524b125
SHA1 a5823f19d67c3b3d9cda80aa3acf20dd00a2d437
SHA512 769ffbd35a9c2a1be4ec91c60036f4a7d3925e15a947d909f9e4b14573ee9b993508917d0e28513c6fe13b4202d7f4c39173ba729ddbfd400a90a01812910ea1
MD5 SHA1 SHA512

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 588B
SHA256 2a037f0161332028f5c06aa4825fedf2f64195a15bba39e3c8c9792a33df01b6
MD5 e8c3b1a21b19cab5de8c4c6edc3acaea
SHA1 8e2a2e2be76de8f819c7231a414a62754b6ac11d
SHA512 b9245529d5fcca3958c46b4cd6320757cb0f619fa31068114ab45c74b338794c04a86a6ca6f90248ee87825024bdd734c0892fab90d0fc3d41df7559deacb135
TLSH
T1F4F0E120A980CFE46AC2E5E9D5D1529CF2427A2D9AF5FCA09807810641D70B77D62B8E
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 2KB
SHA256 2bf5f7ebb392a76f3b7e588f69dd59f6e1b368b2ee7db76ba4b73415575faf67
MD5 91004bd4555cb9620428439f7213ee8e
SHA1 42d5aed17f131f1a592b12e7a200853ddae11483
SHA512 09627a11d87e4a36fe5f932a4e97324bf04ad2c042e2798a733bfbd718db55ab5de43b761d084319eec8703a971411c9df08285da3bcb78f3daa1dc55126b166
TLSH
T125512B99B891C7EA966C576E0488512CBB92947727B83CC01CDA328F41F2B04A8E911A
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\zen-sessions.jsonlz4
Size 67B
SHA256 034ec67971a3b8f86b9675fdc7359b47c5fd6992e3a4eea8a552ce4b29bb3838
MD5 02baac5864eb558b803b63acdb84e1a1
SHA1 ee9fb94c99cc64cd84e959e01b798951effe3bd1
SHA512 14d302f9a72c9a2de8cef24bfcbc01a79f054d40753b218be03ad1bd7c8a6fa13d8d34e093f9c66d86d600a01069cf9975ee6acc0e334252a806d112fc95904a
TLSH
T105A0220080800B0002A0230080C208CF23822238203008C3280B008AC208A8308C30C2
MD5 SHA1 SHA512 TLSH

Submit Download

zen-themes.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\jy0yfpum.Default (release)\zen-themes.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 1008B
SHA256 7115055f888fccf09858cd964aeeabeffa372f1b68ec7daa1bd460530b2d6bb1
MD5 778496e08cb3e8f202be97387d62b7de
SHA1 ab4060391932db5cf6ea1102582c5405518e2ad0
SHA512 40242278d12a21b14aae0711eaee314fdbb69facbe60a4f0c0bd09caa2cfd9636e5efe95e06f722b13281dfc4cd3d0ff2a1d22e53a0e768d8c9b2b46fd4375b6
TLSH
T11811880057DBA679F1BA8A7155B23662863BFC01FB68032D82C8D28449F1110D56DBBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 910B
SHA256 6ae7529a6fc7d36dd39f1ad86a3ddae8b8bc8561dd192d8d8e5e55a4e20f1898
MD5 747d9625b6e017f1eacf468e467d5310
SHA1 b0004f3159c0f16a6836b73000d94c454b997a3b
SHA512 533d50f0f081fa7b5d4f109ed6ac4f1148ad5c5dc0f881959a7ef653f55ef94f593cf146dc0cbc7cd2507d00dfa0c2f06e0bc9f551fcc33d3e40fec8036de4fb
TLSH
T16611680053E7A769F1B78A71157237A18B3BFC01EB68472D82C8D28489F1110D56DBFB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/644-1893-0x0000016D23E80000-0x0000016D23E90000-memory.dmp

Download

memory/992-23-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/992-407-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3032-504-0x0000000074DB2000-0x0000000074DB4000-memory.dmp

Download

memory/3032-408-0x00000000019B0000-0x00000000019C0000-memory.dmp

Download

memory/3032-20-0x0000000074DB2000-0x0000000074DB4000-memory.dmp

Download

memory/3032-19-0x00000000019B0000-0x00000000019C0000-memory.dmp

Download