njrat | e32e0109a3850cb7e47aae741da28142eb0eaec16a8c5ac86faaa78637f9b52a

Analysis

max time kernel
151s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 92.1MB
Sample260806-d9tpraff43
SHA256 e32e0109a3850cb7e47aae741da28142eb0eaec16a8c5ac86faaa78637f9b52a
MD5 4cd42793079d71e1b86bd318b8d3c174
SHA1 d588f01259df3657258097e389af7e6948e6a4be
SHA512 f698ca679ebb06934f838c8b3714add431e720f57f4be38968983bf5076ed949523881c5a3424a81d4b1cc59bbcb0433380cd9efb0c9fb287f1d40d79387f2e0
SSDEEP 1572864:rCHw3qSUvBGYJR9XLMpWDbsmkcas8l5RiV3UA4vLwZzxaHC3cOCx9s+b/cAuaY9G:ubd9XLeusm8lGV4m0iTk9sy/cApY9Z3k
TLSH
T11B283349E28231BFD14A65FBC91EEEC29935FE85037049DB2272B5266E6F5C26C35303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan upx

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/4076-21-0x0000000000400000-0x0000000000446000-memory.dmp	UPX
behavioral2/memory/4076-403-0x0000000000400000-0x0000000000446000-memory.dmp	UPX

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3724	netsh.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 28 IoCs

pid	Process
3040	.exe
4076	zen.installer.exe
4104	setup.exe
3444	maintenanceservice_installer.exe
2912	maintenanceservice_tmp.exe
5348	default-browser-agent.exe
4316	zen.exe
5564	zen.exe
4252	zen.exe
1288	zen.exe
1444	zen.exe
4172	zen.exe
1828	zen.exe
2760	zen.exe
5564	zen.exe
3440	zen.exe
2608	zen.exe
1856	zen.exe
6044	zen.exe
1896	zen.exe
3396	zen.exe
5552	zen.exe
6968	zen.exe
7000	zen.exe
5000	zen.exe
3064	zen.exe
4920	zen.exe
6388	zen.exe

Loads dropped DLL 64 IoCs

pid	Process
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
5084	regsvr32.exe
5084	regsvr32.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
3444	maintenanceservice_installer.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
5348	default-browser-agent.exe
5348	default-browser-agent.exe
5348	default-browser-agent.exe
4316	zen.exe
4316	zen.exe
4316	zen.exe
4316	zen.exe
4316	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
5564	zen.exe
4252	zen.exe
4252	zen.exe
4252	zen.exe
4252	zen.exe
4252	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe
1288	zen.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4076-21-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4076-403-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png	setup.exe
File created	C:\Program Files\Zen Browser\application.ini	setup.exe
File created	C:\Program Files\Zen Browser\libEGL.dll	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice_installer.exe	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\helper.exe	setup.exe
File created	C:\Program Files\Zen Browser\fonts\TwemojiMozilla.ttf	setup.exe
File created	C:\Program Files\Zen Browser\onnxruntime.dll	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140_1.dll	setup.exe
File created	C:\Program Files\Zen Browser\dxcompiler.dll	setup.exe
File created	C:\Program Files\Zen Browser\marshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavcodec.dll	setup.exe
File created	C:\Program Files\Zen Browser\msvcp140_atomic_wait.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsg10CE.tmp	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.Internal.FrameworkUdk.dll	setup.exe
File created	C:\Program Files\Zen Browser\notificationserver.dll	setup.exe
File created	C:\Program Files\Zen Browser\precomplete	setup.exe
File created	C:\Program Files\Zen Browser\update-settings.ini	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\default-browser-agent.exe	setup.exe
File created	C:\Program Files\Zen Browser\gkcodecs.dll	setup.exe
File created	C:\Program Files\Zen Browser\platform.ini	setup.exe
File created	C:\Program Files\Zen Browser\updater.exe	setup.exe
File created	C:\Program Files\Zen Browser\updater.ini	setup.exe
File created	C:\Program Files\Zen Browser\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.dll	setup.exe
File created	C:\Program Files\Zen Browser\installation_telemetry.json	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice.exe	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Input.dll	setup.exe
File created	C:\Program Files\Zen Browser\softokn3.dll	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\manifest.json	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_150.png	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\uninstall.log	setup.exe
File created	C:\Program Files\Zen Browser\plugin-container.exe	setup.exe
File created	C:\Program Files\Zen Browser\xul.dll	setup.exe
File created	C:\Program Files\Zen Browser\defaults\pref\channel-prefs.js	setup.exe
File created	C:\Program Files\Zen Browser\browser\omni.ja	setup.exe
File created	C:\Program Files\Zen Browser\firefox.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\freebl3.dll	setup.exe
File created	C:\Program Files\Zen Browser\msvcp140.dll	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.exe	setup.exe
File created	C:\Program Files\Zen Browser\installation_dir_layout\versioned\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\clearkey.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\confused_fox.pdf	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	maintenanceservice_tmp.exe
File created	C:\Program Files\Zen Browser\private_browsing.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\removed-files	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsg10CD.tmp	setup.exe
File created	C:\Program Files\Zen Browser\CoreMessagingXP.dll	setup.exe
File created	C:\Program Files\Zen Browser\lgpllibs.dll	setup.exe
File created	C:\Program Files\Zen Browser\libGLESv2.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File opened for modification	C:\Program Files\Zen Browser\	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsg10CD.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.InputStateManager.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\install.log	setup.exe
File created	C:\Program Files\Zen Browser\dependentlibs.list	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozavutil.dll	setup.exe
File created	C:\Program Files\Zen Browser\pingsender.exe	setup.exe
File created	C:\Program Files\Zen Browser\AccessibleMarshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\nss3.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\blank.pdf	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zen.installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe

Checks processor information in registry 2 TTPs 33 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Colors	zen.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	zen.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\ = "Firefox HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\FriendlyTypeName = "Firefox URL"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\CustomActivator = "{788A2863-EF5B-4CA6-83DF-CFF5B81BAD63}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.shtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Program Files\\Zen Browser\\AccessibleMarshal.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ = "ISimpleDOMDocument"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xht	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.jfif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.ogg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{788A2863-EF5B-4CA6-83DF-CFF5B81BAD63}\DllSurrogate	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\ = "open"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\URL Protocol	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xhtml	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{788A2863-EF5B-4CA6-83DF-CFF5B81BAD63}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.m4a	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.pjp	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.webp	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.html	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xml	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.bmp	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.pdf	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{788A2863-EF5B-4CA6-83DF-CFF5B81BAD63}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{788A2863-EF5B-4CA6-83DF-CFF5B81BAD63}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods\ = "8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods\ = "18"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\EditFlags = "2"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.png	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{788A2863-EF5B-4CA6-83DF-CFF5B81BAD63}\AppID = "{788A2863-EF5B-4CA6-83DF-CFF5B81BAD63}"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,5"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\DisplayName = "Zen Browser"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppUserModelId\ZenToast-F0DC299D809B9700	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	maintenanceservice_tmp.exe
2912	maintenanceservice_tmp.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: SeDebugPrivilege	4172	zen.exe
Token: SeDebugPrivilege	4172	zen.exe
Token: SeDebugPrivilege	4172	zen.exe
Token: SeDebugPrivilege	4172	zen.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe
Token: 33	3040	.exe
Token: SeIncBasePriorityPrivilege	3040	.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4172	zen.exe
4172	zen.exe
4172	zen.exe
4172	zen.exe
4172	zen.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4172	zen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3040	4088	2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 3040 wrote to memory of 3724	3040	.exe	90
PID 4088 wrote to memory of 4076	4088	2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe	93
PID 4076 wrote to memory of 4104	4076	zen.installer.exe	94
PID 4104 wrote to memory of 5084	4104	setup.exe	96
PID 4104 wrote to memory of 3444	4104	setup.exe	97
PID 3444 wrote to memory of 2912	3444	maintenanceservice_installer.exe	98
PID 4104 wrote to memory of 5348	4104	setup.exe	100
PID 5348 wrote to memory of 4316	5348	default-browser-agent.exe	101
PID 4316 wrote to memory of 5564	4316	zen.exe	109
PID 4316 wrote to memory of 5564	4316	zen.exe	109
PID 4104 wrote to memory of 4252	4104	setup.exe	103
PID 4252 wrote to memory of 1288	4252	zen.exe	104
PID 4252 wrote to memory of 1288	4252	zen.exe	104
PID 4104 wrote to memory of 1444	4104	setup.exe	105
PID 1444 wrote to memory of 4172	1444	zen.exe	106
PID 1444 wrote to memory of 4172	1444	zen.exe	106
PID 4172 wrote to memory of 1828	4172	zen.exe	107
PID 4172 wrote to memory of 1828	4172	zen.exe	107
PID 4172 wrote to memory of 1828	4172	zen.exe	107
PID 4172 wrote to memory of 2760	4172	zen.exe	108
PID 4172 wrote to memory of 2760	4172	zen.exe	108
PID 4172 wrote to memory of 2760	4172	zen.exe	108
PID 4172 wrote to memory of 2760	4172	zen.exe	108
PID 4172 wrote to memory of 5564	4172	zen.exe	109
PID 4172 wrote to memory of 5564	4172	zen.exe	109
PID 4172 wrote to memory of 5564	4172	zen.exe	109
PID 4172 wrote to memory of 5564	4172	zen.exe	109
PID 4172 wrote to memory of 3440	4172	zen.exe	110
PID 4172 wrote to memory of 3440	4172	zen.exe	110
PID 4172 wrote to memory of 3440	4172	zen.exe	110
PID 4172 wrote to memory of 2608	4172	zen.exe	111
PID 4172 wrote to memory of 2608	4172	zen.exe	111
PID 4172 wrote to memory of 2608	4172	zen.exe	111
PID 4172 wrote to memory of 2608	4172	zen.exe	111
PID 4172 wrote to memory of 1856	4172	zen.exe	112
PID 4172 wrote to memory of 1856	4172	zen.exe	112
PID 4172 wrote to memory of 1856	4172	zen.exe	112
PID 4172 wrote to memory of 1856	4172	zen.exe	112
PID 4172 wrote to memory of 6044	4172	zen.exe	113
PID 4172 wrote to memory of 6044	4172	zen.exe	113
PID 4172 wrote to memory of 6044	4172	zen.exe	113
PID 4172 wrote to memory of 6044	4172	zen.exe	113
PID 4172 wrote to memory of 1896	4172	zen.exe	114
PID 4172 wrote to memory of 1896	4172	zen.exe	114
PID 4172 wrote to memory of 1896	4172	zen.exe	114
PID 4172 wrote to memory of 1896	4172	zen.exe	114
PID 4172 wrote to memory of 3396	4172	zen.exe	115
PID 4172 wrote to memory of 3396	4172	zen.exe	115
PID 4172 wrote to memory of 3396	4172	zen.exe	115
PID 4172 wrote to memory of 3396	4172	zen.exe	115
PID 4172 wrote to memory of 5552	4172	zen.exe	116
PID 4172 wrote to memory of 5552	4172	zen.exe	116
PID 4172 wrote to memory of 5552	4172	zen.exe	116
PID 4172 wrote to memory of 5552	4172	zen.exe	116
PID 6968 wrote to memory of 7000	6968	zen.exe	119
PID 6968 wrote to memory of 7000	6968	zen.exe	119
PID 4172 wrote to memory of 5000	4172	zen.exe	120
PID 4172 wrote to memory of 5000	4172	zen.exe	120
PID 4172 wrote to memory of 5000	4172	zen.exe	120
PID 4172 wrote to memory of 5000	4172	zen.exe	120
PID 4172 wrote to memory of 3064	4172	zen.exe	121
PID 4172 wrote to memory of 3064	4172	zen.exe	121
PID 4172 wrote to memory of 3064	4172	zen.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_4cd42793079d71e1b86bd318b8d3c174_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\.exe
  "C:\Users\Admin\AppData\Local\Temp\.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\.exe" ".exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3724
- C:\Users\Admin\AppData\Local\Temp\zen.installer.exe
  "C:\Users\Admin\AppData\Local\Temp\zen.installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\setup.exe
    .\setup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Zen Browser\AccessibleMarshal.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:5084
  - - C:\Program Files\Zen Browser\maintenanceservice_installer.exe
      "C:\Program Files\Zen Browser\maintenanceservice_installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2912
  - - C:\Program Files\Zen Browser\default-browser-agent.exe
      "C:\Program Files\Zen Browser\default-browser-agent.exe" register-task F0DC299D809B9700
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:5348
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4316
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:5564
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies Control Panel
        
        PID:1288
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" -first-startup
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1444
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -first-startup
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies Control Panel
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4172
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -prefsHandle 2648:26777 -prefMapHandle 2652:302867 -ipcHandle 2684 -initialChannelId {784a8f5d-d16e-488a-8622-ace06ba94d4b} -parentPid 4172 -appDir "C:\Program Files\Zen Browser\browser" - 1 gpu
        6⤵
        Executes dropped EXE
        
        PID:1828
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -prefsHandle 2892:26777 -prefMapHandle 2896:302867 -ipcHandle 2904 -initialChannelId {89422208-c4fb-461a-86d7-a3d185e5066d} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 2 socket
        6⤵
        Executes dropped EXE
        
        PID:2760
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 2216:26878 -prefMapHandle 2200:302867 -jsInitHandle 2204:156236 -parentBuildID 20260729085236 -ipcHandle 2032 -initialChannelId {3c64e0e5-4c66-4b09-bea9-9366e5cd8090} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 3 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5564
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -prefsHandle 2216:27485 -prefMapHandle 3736:302867 -ipcHandle 3744 -initialChannelId {fced13ba-7ee5-4462-8b6f-53f3403f15f2} -parentPid 4172 -appDir "C:\Program Files\Zen Browser\browser" - 4 rdd
        6⤵
        Executes dropped EXE
        
        PID:3440
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4072:27780 -prefMapHandle 4076:302867 -jsInitHandle 4080:156236 -parentBuildID 20260729085236 -ipcHandle 4088 -initialChannelId {52e3af9a-bc66-43eb-ae57-c79973cda3b4} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 5 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2608
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3656:27908 -prefMapHandle 3640:302867 -jsInitHandle 3644:156236 -parentBuildID 20260729085236 -ipcHandle 2556 -initialChannelId {46650b66-d7c6-4888-a472-378d0fec8b9e} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 6 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1856
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4760:27908 -prefMapHandle 4764:302867 -jsInitHandle 4768:156236 -parentBuildID 20260729085236 -ipcHandle 4776 -initialChannelId {5c600010-5bd5-4a65-8db5-6ac7fa2eac72} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 7 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6044
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4952:27908 -prefMapHandle 4956:302867 -jsInitHandle 4960:156236 -parentBuildID 20260729085236 -ipcHandle 4968 -initialChannelId {0eaf2ca5-6ba8-4565-9a53-fd21aafe341b} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 8 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1896
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5584:30856 -prefMapHandle 5588:302867 -jsInitHandle 5592:156236 -parentBuildID 20260729085236 -ipcHandle 5596 -initialChannelId {c82cba92-994c-4adf-84f4-88e70cb9bc1c} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 9 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3396
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260729085236 -sandboxingKind 0 -prefsHandle 6208:45583 -prefMapHandle 6212:302867 -ipcHandle 6252 -initialChannelId {b4efc147-fa4d-451b-b79e-18e24dd3cd40} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 10 utility
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5552
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5956:43754 -prefMapHandle 5964:302867 -jsInitHandle 6568:156236 -parentBuildID 20260729085236 -ipcHandle 6588 -initialChannelId {dd91f44e-0fac-4788-bc27-6d5baa8a1baa} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 11 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5000
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6788:43754 -prefMapHandle 6792:302867 -jsInitHandle 6796:156236 -parentBuildID 20260729085236 -ipcHandle 6812 -initialChannelId {7cf0d9cd-1437-4635-8bec-ef153cddd54e} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 12 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3064
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6820:43754 -prefMapHandle 6824:302867 -jsInitHandle 6828:156236 -parentBuildID 20260729085236 -ipcHandle 6836 -initialChannelId {bc8d35e3-5a83-4ad0-a061-2a6d865039d1} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 13 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4920
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 7128:43754 -prefMapHandle 7132:302867 -jsInitHandle 7136:156236 -parentBuildID 20260729085236 -ipcHandle 7108 -initialChannelId {9c1a1044-ffc6-4e03-a6d8-9211fe3992d8} -parentPid 4172 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 14 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6388

C:\Program Files\Zen Browser\zen.exe
"C:\Program Files\Zen Browser\zen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6968
- C:\Program Files\Zen Browser\zen.exe
  "C:\Program Files\Zen Browser\zen.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:7000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shortcuts_log.ini

Path C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini
Size 198B
SHA256 5fbda59442223c5d2fc4779c116f314fc4ee448ab786e102f570aa5de4336cbc
MD5 c18e70154afa4c346b4a5f28ca9a5664
SHA1 1c71628ac2c1609c57db351a2127e16834947173
SHA512 476971174289ce8dc076deb5bbfcdd21d0e55f3dd7ebe635702a2b9d5c4c671713e06c0185f157ab731f7b0c3400e866ad850d7c4990e70ec9624112c5cca3f6
TLSH
T1A6D0023206D60229AE465F81EDE84179DFA6F959609DCB0CF082161E1DF4440C9925F7
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 bb9bcb2b25adc229affa0d8e965e8a4ae6ac6b14b47c89d6b7e24608d928924b
MD5 f768e405c2ac8cd9eefcfa22abed0e40
SHA1 52270a54fadf22c1b6e7142a224024e19a95ecde
SHA512 aec9d403f13d65fc111ebca76f20ca51d36b9215f87786caacf75fa2ec33b8489aff54846ebf7ae1e2049ca5bf56c6cda49e01fa09b843da1fb01e0c7456c4f3
TLSH
T12541480447E65238F2B75E7696723A314273FD91A7B982AE438DC2C50971034C5ACBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 5e0e3dde9b1e17ad346ed760ca3fd36652950a92f427fe31aa3756549b73d425
MD5 3abfa52ae1cb4fb40bbd53a4f82bcb03
SHA1 f586cef1ff15999bd30889f18b9fa14892fd5438
SHA512 710fd946067b80ea0c03b47a721a3b0a52e1b7b5f1d22d89094ff4762a5a1061c9b1642bc8ceed2a3cba65f6c4965c5c071bbfa1872f687bbe6cb2bce2f33f2e
TLSH
T1C731350047E25238F2B35E7695727B308237FD81A7A982AF438DC2C54931034C6ACBBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 1020B
SHA256 e32505adbe93213b7c3e576a2c70171d85b4b9d7b63413c0eb32615b1a402401
MD5 e40491102fecbedbe74345bdb9f31404
SHA1 9f427e6a5148329fbcfa184955f3aba230f37503
SHA512 93de6eaad0fa730d467f8f223729243a09c73781894142ff4e2dab1c493d66ef8013eae833da36440d1c5b79d9b40868a29e61d879f2667339b371bef627657e
TLSH
T1F0119C0047E35735F27B8A7115B27B328327BD02E3B8072E428882840875010D96CFBA
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 922B
SHA256 2b6241962f56db15ad0c04b7c71c813563ec5bcb3d7fe460a0a9ad8b6e70be19
MD5 abfa23d5eb3aa99103f4e17773622177
SHA1 d1233c99ac46fca0a144b274b0d2ccc74c76c30d
SHA512 00dfcbb7e6739279bec8c119501ff93ba6467e492436da8e73f3910b8cb2c535c3ca74b9ad6fa3f8e64dfd08e4f28231fed8d2540009ed130b53864c33f2e42d
TLSH
T15611890043E32B25F2B79A7115737B32C737BD06D7B8472E4388528148B0014D9ACFBA
MD5 SHA1 SHA512 TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\F0DC299D809B9700\update-config.json
Size 78B
SHA256 3f7b3252ef3b6217ad78adb7007738601ce1eebca69f55990b64bf254bd4fc63
MD5 fe74f5c38f433736ee7015868cfb159e
SHA1 f723b0032565fb3007407201963f7bb762bdd981
SHA512 19fe20baff40c195955a921ee2fe1927d00da14e0ed3eb683e5f6f026353bfcd5322a1d2399b8977bdf97bb23dfd6cc811c9a9494f019b6e404aff477316cafd
TLSH
T1EBA011800000A2A8B0E888CC00302A3E02888028008B2A02800A30A0383A0020A0A8BA
MD5 SHA1 SHA512 TLSH

Submit Download

.exe

Path C:\Users\Admin\AppData\Local\Temp\.exe
Size 36KB
SHA256 0dc3df5a336edc1a680899c4d257a3a6e331a1e6769ac2e4d3a6be6deb220ec2
MD5 d897a1d213efab02e05ec222332bd456
SHA1 328b14e254fc821fcdded20c5500ab099bab5e7f
SHA512 5f12d12b94f2c4ccda9f38809f9a2de6dc47139cf93a55134ba2701576d6091b88fa7157deb17e53b15ab74669ea8a205dbe738ba109a149b1c9bae43fd4d6b5
SSDEEP 768:uUSq6sqEhKzBpJsSifUGepMfnJFXiT4chZFtbIjC:uUSqfwPJsSifUPpiDSTdhdF
TLSH
T16CF2194DBFE24590D3FC5A778A71E2230376E04B1922DB5D8EE844B61BA36C48F58ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\AccessibleMarshal.dll
Size 30KB
SHA256 8760fc0cf5ada93e6344b915f879e9acfe4594630acf483ef4fbe716d9711ce2
MD5 fe71cd2abbfa9d52eb72cd2a05051743
SHA1 3f63be711466d93328bf9557cb776c5650899c4d
SHA512 be3236d2186e01bda4416dbdccd5efdbd1f7337378ea0c5c2b6553171b62507974f197219b33917a7fefa90ac97813235f8a0b8c9481bca62faccf4590a0d8ea
SSDEEP 384:k9MSlCaZ8nvlfiGeUMc25RkTHu46dWl2mNDsSofousJUKURFSxxw0vS5:ACaZ8vMGeq2EOVsheSoQuoaL0vM
TLSH
T16BD2E556FE0084A5E81D843088DF8AAA5E71FE419F9247C73295332D1E737C56F366A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\CoreMessagingXP.dll
Size 1018KB
SHA256 9e93191b9b1549e45bf3663c4097f3f38cd47d90ec8b8020c0456d5ff4410d19
MD5 4fcd91a7632707c52142a8f10abc9154
SHA1 055c8a973e09ac776f5ac824c5a142274988b1df
SHA512 1d78ce59f2cd1bd858fd48bcf9f3b7815245b78a111e7da5bd69b0d0a4de9cee2a58f56190370ddd6968bc73ac6239fc87282efd8aebb76d7387ef4059f185ad
SSDEEP 12288:Ntl2DdkYB2Zme5NY1RZq3SzFJeb8HzroHCpstWcLObI6DPsb8UsAfb:lgdP4meM1Rlwb839pwWrDlUs8b
TLSH
T1B2252C6F6FA84097D17AC27E85BB8A8AF2F1B8531B3187CB0451426D3F27BE45979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\InstallationDirLayout.dll
Size 19KB
SHA256 50b9a94c3cbab3e112798734b402504a79e41c53257a25651b77483035da8f3e
MD5 0225ff38302f26fe69d5af8ebb33346e
SHA1 1cd05a86635976792d850d5c46be826a44d416d1
SHA512 cd84e550ce2c0a1a78b9d1b570e1a644d79e5bede56cfe671f45aae5af05608e0bd4d6c86c9ece112ce6928c46a537c6b0fa73966b95c5d6d89cb26fc5a425b0
SSDEEP 384:fNmCCN3LNn2d9kvYu46dWl2mNDsSofousJUKURFcHOPSjS:FjwtPDVsheSoQuoaSOPH
TLSH
T1E3926B9BAF6454EAF51B8A30C5D94A1BAD71F7805B9146CB6218008D2F937F83F3932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\Microsoft.InputStateManager.dll
Size 446KB
SHA256 3bb936063a6b0b5c624b125ba4afb370e9f7f71655cb0180c17fd78d6470792e
MD5 6478e351b0f0e92f3d3b7bdf4e7ec2c5
SHA1 9eab54a470b0d31af21b3553fb4c33ed1cb98736
SHA512 6ddeedc4eebfaeaab78d1adfb1ec9757fed3a5856f87307d0109f3e39fb91cf1af1409a2cc10054b583eea239658fadeba817a29d26929d3d93fa357cafa712b
SSDEEP 12288:CCfOXk5FPwj04LiaHVnZWz10AmzdTVCKD:HBMLTVnZPD
TLSH
T11CA44A7BEBA844A0D536D23C85A78A07F2B2745907329BCB42A0926D1F37FE45D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\Microsoft.Internal.FrameworkUdk.dll
Size 910KB
SHA256 41ab3739674b51f3cb610fa7618515c33d708582b30045effc09e6ea307d472d
MD5 3568d848ac6af4172768aac59f59b72a
SHA1 9e8fa5f095186f80797e418b57025a758965bb79
SHA512 ab54314922115dc0e2b7dbdbaf7eef481f1022d29f6e736206a6601611442aee612d83aea149b7fa061aef2cd6be19b16b8c656481df8d4703059b61fdd17aee
SSDEEP 6144:uq2pdSEZxDjmUlfp04mtVkookZea4u2IUWB8Yi+c0p20GHs667I7IK/ECQ23YRgL:MWYdjm9VkookZ4TT+cHH6OIK1yeL
TLSH
T1DD15741BEE6991E0C4BAD03D9192622FF8B170A68B7057C3D6515A1F1F32FE4A93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\Microsoft.UI.Composition.OSSupport.dll
Size 66KB
SHA256 5abb5fdb08b3e7c293f8872222a7931903203b32ffb681bcdf9b152c1ae0878c
MD5 e3e86c9edf68713d7772892dbb510e8d
SHA1 00f4545035704948640fc8489eb1478a90edd4c1
SHA512 88dbb2edcaa5a5ef1b175d979936d957d26cfaa2812eadcd490b2735e26dbf155113ae911a7c629137ad829d9e08552853c56fff6d01250563451b828b60b11b
SSDEEP 1536:Ucum2n7hIpk5Bsshnj9gQFPS47L6kL7oO:UcuThIpkDfg+L6kfoO
TLSH
T145636C59AA8830FAF436423DC4964F19D9B1B16163405BEF0364C2BD2F83BD9763EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\Microsoft.UI.Input.dll
Size 1.5MB
SHA256 1f969eeeec1613036b9e3dde77b4c21152e3827090b5020ff78f7c5ded687371
MD5 0ca0dbe3a545b21036689d773d8db67d
SHA1 f730171cecb4878f72af8c3175c5a389a27cd648
SHA512 809f9f588df1bc1a57d1568ed4a00e0db6a0499065575a692c48b157c4a83097afa48ed4064e74b25710c9d8bfdfae3aaac257b1643509c0e81c6abc0075c5f4
SSDEEP 24576:oB6TePxZNKmKI9tp/jLNXoqWnbvxtXyp0:oAaMmFp//sndtXc0
TLSH
T11A752A2BAFE881A6D331A23DC0974E4AF2B174421B7166EB0165412E5F3BBF45D3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 937462bd02678af1a0faba7faaff8caec14e9decce1fbcf172aa57e937a3141c
MD5 c48f1e5b0f2c5863b88a1f6b56fe6b07
SHA1 2c7bd76cfcf7eadeaed981ab145f284acfcad0e2
SHA512 0e9179bd7a12fb935860767f80717c3c9427e3c5eb0c0780b038c8ff3a202326f352534846921acf210ef35b5661c89c5a384e87104f7fdf9c37c507b86d7764
SSDEEP 6144:zs4jY1PnSzURJG9m3+v6Vtcu5/gm0qV1OU4IkhNFSDm/RuZ2QlXgW:ASY1PSw+5CcuOm0q/OUhUNKm/RuuW
TLSH
T1EBB44D6F6BA84492E22AA13DD5978B0AF6F174125732CBCB0111D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\Microsoft.UI.Windowing.dll
Size 538KB
SHA256 94427ce65565e97136abb8d06ef88353d8b2f5b5c556da9118534c18a555d7e5
MD5 f85fd565de1a22efa96452c633dcc1e5
SHA1 7ed9305fbd159884b5e68496c2bbec7d05797590
SHA512 4201bad4b20e0ec8f897bc3fd5b414168d40a27fb916058311ca8d84cfa9fee9cab977d68ffa56116f571a87457ac89775248101d67362c22008ec5e63d6bd35
SSDEEP 6144:ElLJdDCMslOzqjXsvPueIP7mNq6CIRPDoxSTHXapklto2UInrMRAc6egd:WLJdDCrkqj3eIKFC6DokjaaBjcwd
TLSH
T1E0C43B7EBBA44696D12A813DC6AB4F06F3F0B8515731DBCB4161823D9F27BE8593A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\application.ini
Size 637B
SHA256 9b8524bcfe764f7173fac45705bc34117e69ad9e8f5399ad74d9771d59ca9b06
MD5 0c97e1526f8835498c06d713da3832e9
SHA1 2ee6aabffffb1d4b3641be53db0e9c198b96fef8
SHA512 cab9223040d8b19877ccef9d6017e580b7fe4dbfe9e32695e7182c6ecf053537930acdb84480b2285d1c8d43ae71ca6b7b9debbe7013d9f97af4e2f20cfe12cd
TLSH
T1D9F0D8D7430474EE4EF33ABAA1101AD89333085898EB382C2042510D162931F6A8EBE9
MD5 SHA1 SHA512 TLSH

Submit Download

blank.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\browser\blank.pdf
Size 8KB
SHA256 81a4b1da9df2cfe8f229abb939591b708e2a6ab7d4bc58d411ddb471d0dc3964
MD5 0a98a0712d09cec3945c0728b0c7c465
SHA1 f4e62cbdc0afd816e24929c2a6e71e63072c4b32
SHA512 02619d47e399fe4ccd8138d58f68acd9d692fa61a59d43ed5bd97f709916c4de781f83aa32c9404030887afd55467aa2fbf9ab086fa8ed858d3aeb562da6ee0b
SSDEEP 192:KCYALPEyUKCIoYxrfJeHrJhnAynX/fCQCwQwJsqYmMNVoDVoCow4YePa/TY61/:WUP8KCIXxrOjAynX3hCwTLbMNmZLPeiN
TLSH
T1B9027B34E99F5C5CFA94CA1BD276B70D8E99B10F6FD8349241310F52F080971EB6A2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

confused_fox.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\browser\confused_fox.pdf
Size 51KB
SHA256 e2916092e9764860829db21b78ab0fbfbb22f976687e65716ba7dbc16e954ce8
MD5 10aaade034c04af93ad3c805642e5b0e
SHA1 a6e98403bba37c9e87c632e4a8662284a9098e3b
SHA512 9b9621dcc753e8d7b545fa225b2c3504bb8606bcb4b5bc8dce4844cac7f82722bb3882ed8170adb7ef737460b07aa1b078c0ed820ed9d22e19b39038f3c157d1
SSDEEP 384:4c7vp5LOr9QrOjRzYOv06lPBP2R7uJS9lEWHEugiGB2LtlC:17XWRH1J5DSX/HEugr2O
TLSH
T1513363F291801999F401CD789F9F3D9C109E30ABEED98DDA74FCE711AF228A429E51C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\default-browser-agent.exe
Size 31KB
SHA256 6c57a4d1bef1af02e0299ce9a107c7bcae95354ecb6ea1be56da570934605ac3
MD5 ec1050c7e6c5290c9853044cb070244f
SHA1 71f9647e01882c240c7276b2ffdc4835d83f3368
SHA512 be959b97266400dc45ff012782928b5a6e623c875ed31602d593cac3db06a5b33cdc507a30654d4d681c5901646cf925f51785b4f69d71288b1a6139dc552587
SSDEEP 384:FfkMYA9ZhYIwn0QrNlZpgIBzkwKIOXuWXkviy2gMO20u46dWl2mNDsSofousJUKu:FEAStvZpxBwlHpUjAVsheSoQuoaa2gW
TLSH
T1F6E27C66DFA140F5FC15D13506A49627AE32FA425F6352CBBB82026D1F21BE05F3A3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-prefs.js

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
TLSH
T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
MD5 SHA1 SHA512 TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\dependentlibs.list
Size 67B
SHA256 c50ddbad2bb7ebdf2ec6643fc2e7744adf3870c5744e80ba3665cbdd3e9c559d
MD5 1992be27df8264e37bfe5ab87209000b
SHA1 8ac394c7b9193cbfdff35ea29d731d5481a0ac58
SHA512 0a8515b65e35396db0a3bea1b543aaa95c25b3228cadc66707d4c940b80158bda9c277753df22efcf50233fbaf2174cbadc152e0fd6d43175da0115222c7b272
TLSH
T19DA00292006F91236685EDE1684DC90C801D6156DC9101D05667260E16269C04BD45AD
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\dxcompiler.dll
Size 23.2MB
SHA256 0c6e13dab5f29166e59f42630aeb50599f3c54f7b72cab1918414e9a8d54b61c
MD5 01478715dc840c9994d829c975006a74
SHA1 4997ba5935c9e9c452bd25639c3220cf47db9b70
SHA512 4125314273c796891637e26a6e8bc33db3bea4345f4dfeb0b516036bb01c9732759cb07d050a6abacbcc4d941b4a0a794b2d0563e9ae0c22647c08fd32eb5249
SSDEEP 196608:rLn8gE6byTF5lWua5oiVfMn6puhDpn5yeKr0r:rL8v6+TFvWuanOXh1KU
TLSH
T15A374C123686946DC05AC878C3574B279A2870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 dded8c3942e2d8eca65838e55379b1da5765c2dd6183dd5c3530c9976cb25a86
MD5 613815852a622ff9e54d697b9b3d2862
SHA1 a49149260f4e6d09412ce09d5847f15be65f527b
SHA512 64993969eccb8f75496b11cecab6f351a3ac659d8d6906cda2bfec8684b2d0d253f4c1bc23eefbec388939dc9ad0e898bec0a8f3e03c78d1b9c73d714fa5feb3
TLSH
T112F0C0DCB158130016CA6A556113528FB10F11FB46D501DEB0ED80381B8AB4C491EBCC
MD5 SHA1 SHA512 TLSH

Submit Download

TwemojiMozilla.ttf

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\fonts\TwemojiMozilla.ttf
Size 1.4MB
SHA256 6d90152ee0d29e82fe2a87793af5aa4b7ad13e6538360889e141e81ed299ee8e
MD5 aac75d901445bc0419d56e56dbc18891
SHA1 3ada434f3a727167ce6dce3b865fa6bfb70ed86f
SHA512 83fd92ff444ab6de18d48997247f49845abb8420a07b74ebc8a65bda8da69d28f87b6abe0f607b2fd7da398dc0f8cbe7fbf655af6d25785ad8b2f1a3afca136a
SSDEEP 24576:jUx1tOjzy675RUa0cHib00er/4TMXvBo2IvyCPKsUxJug7WwObnkBl0Z1koEXdwV:CeIa3iurjIExYrdz
TLSH
T1EF656C3FA704CBEEF4951AF6C9640A27B5D08D8522021287F74DF87F8C9D3985897A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\freebl3.dll
Size 1.2MB
SHA256 76f7ea778bda2c5bff12a5c941e5798308f2f4536349c699e00c692df521960a
MD5 69464a56af99ba723e3c3a54d3996e42
SHA1 c949e03f39b1223dff6a6f918ac282a3818952fe
SHA512 6bf650e913644fc33a07a23028a605570bdbc2616c3f7a9c19e50d0a948023af36c0d10d8d8703a02b3007cfbe03f149e1e4fb31490b00d5ea47dd10d2f37777
SSDEEP 24576:/1m82H/nJ99XunnnZnnV8sBkfmRfUUxvfUI0vXJMMha59Z+UMo+hBQ+4:Nm82H/nJ99XunnnZnnVPafmuI0x9wLMm
TLSH
T106456D0BF2B647E0D067CD7C1396BA23FA253C5D4B5136D357C886213AA1BD4B21AF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\gkcodecs.dll
Size 10.4MB
SHA256 55d26b5f2ec8f6c7a4b85deb198055f56fd7b6d51f4aecd72b267ecf25eed2b6
MD5 74aabd1bb0eb6aa111f6848fd9fa4ba7
SHA1 980ca21a7c4c96d2fe5c91469a280f4237e4ff12
SHA512 4741a351b5632fc5bbf482ac617314adb7360c6efe9543bc8406883efc57d6cc7de50befcfffd62685d37320bde11c14c94a4b28d808c3152eed9798578365c7
SSDEEP 98304:J+LesjEk6GdCwxnjZ+kMhyjuCxJTNPuBNncTh9jE+O2h/rmuBp5NmOacv6+obQTP:Gesjew1jZtPxwIvO2h/qOp5cQKRR8om
TLSH
T1A0B67D4EF1A351A4D41BCCB4527DEB12BD18389EC71856EB77DA16243AB37C0AB29F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clearkey.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\gmp-clearkey\0.1\clearkey.dll
Size 111KB
SHA256 f8938fd67cc81e316e1d6441e29203183e29e853aa855865efbcf5b682a9d596
MD5 243393e31be8f3ced36e1f02ae6495c9
SHA1 1119a6ccaf4536afcf7d4055a46c3b8d3136c3da
SHA512 08f11db3de7aa2ec55d2810fb4496642237a9a9a2bae75cbd9538b367bf0b07c6e5f46ce9a37d69e98893cc1ddb3027bd15b91d77fa4428a7abdcb6be1f7265f
SSDEEP 1536:MYEs17lqERSJPBN4cHrea0HnIR2lTY0GKQwqo6kL7oQk:NjVKzlLeRIR2lYbKQwqo6kfoQk
TLSH
T1D9B33A13EA9A90BFC649D97896475802DF22BC864B5276CF53510EDA1FA6BF46F3C300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\gmp-clearkey\0.1\manifest.json
Size 229B
SHA256 ef47e83036753b53f59d079fef62bfedc749abdbcdb0fe16f448d9920f11114c
MD5 cffdadfaeeaaf0a5a78e7f9a299aa7f1
SHA1 7a8f06d7c91877484301ce8474dfbb1bde08a040
SHA512 5a11e448389326ddbd3be792d9a10ae746c66e4a41f9c96f4979ec71fde385fc4deb205a40f1b4f24415abd9d41c453ca1285f4b813005b1d12a2701f214db85
TLSH
T100D09214C812DEF33CECA2295D554D5867A9129B19823C847B08174EDF599BF92AAB0C
MD5 SHA1 SHA512 TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\installation_dir_layout\versioned\InstallationDirLayout.dll
Size 19KB
SHA256 01b5a63f0566e04553d081c331e5d4f13f983592d9dde5989a1519bbfaabb573
MD5 8d537d9c98b497b825b961728c32b0b6
SHA1 4753354cdbd069c304dd1ac0b61cc6f9fb6c923b
SHA512 51c7e502be5ab39ba030a0cff083f1f2f241ed3949016c1a1f119d5228806622b7d5db8aa037294b2e8e9e6621819f07bab85fadfcddb7a08dc877ecf2a048d6
SSDEEP 384:HNmCCN3LNn2d9kvju46dWl2mNDsSofousJUKURFlmwpHbSFf:tjwtP6VsheSoQuoaq6Hbqf
TLSH
T1CA927CAAAF6444E5F5279A30C9D94A1BAD71BB801B8145CF6218008C1F937E93F3536D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\lgpllibs.dll
Size 161KB
SHA256 082a8d51f7e044d91bc8750e2a1e307b55df3b5c7086fcc97b278dd03b8902a0
MD5 03b1a0ba27fce90b42468f4e54b1e57f
SHA1 571c507f8a1d625619e82023fff59efcac19a18b
SHA512 e5c734e8e614e9bd36ff2827cf50fd415351eb85c601077992518ba6cb43704bfb2609ab1509989c0104f88d1e60ff864b9f685286967a8dd52dff667fdadb3d
SSDEEP 3072:OtaNMj4r08U8SO2HegDHYvME5GabbNNV+urBnr3S6q93EduDoxWQna26kfofii:OtOMj4r0Id2He3T1NV+mBnr3S6q90du1
TLSH
T1EDF37D25DE44886AD43A8C748DA38A179B7E7C8107151ECB5BC45E9A1F1BBD06BFB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\libEGL.dll
Size 57KB
SHA256 08a8b95b5d7f6d15f8b9189ab6bfcbe0d60bab2b098d5491266238388399afb5
MD5 43eef757f63cc3dc43265cfa75514be1
SHA1 61f7724b63e11f0af0eabad8ad19b0013d0903ed
SHA512 8ea0df8d8976b2793e035297e4756922dfaf630544b84046037d2cb9a1a224ea788ccb58c1bcad9d6867c753fc52f729d6517e43b4825c5891e653483f2aa4f5
SSDEEP 768:ae6kczvPW2iggs5a5r8tsQWRalBTx56nvcERWp4gVsheSoQuoaAOM:96ze2igZ5a5ZfRavx56njRW6g6kL7o5
TLSH
T14843FA3BCD6AA237DA0D8EB4C9A30C06EDA1BDD58BA274CF67140DE10C55BD86B79314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\libGLESv2.dll
Size 4.9MB
SHA256 195e417b78b975be9953e12d69b8c038d44320d689b5adeeb7399222e67e1e60
MD5 40d15578f21747ed3a1c8de6096dee40
SHA1 30c29bb92ed285dc1c325c6dd79afa63f22d8c6e
SHA512 d5113c5d4548f226a9aebd3727eab7c8c885b12bd679a2d652f2e48f6e7aed828edb77df65a45d40f2325c7c724f530f0f3e479c251a5d9343074cc0ce0584b6
SSDEEP 49152:E14CtG9mD8h5c0xGggV/wDn2eZOOdtX+LgT/ABo7nEq8xK2Q/++CsgUmq8moqBlS:E1qdZLhDXjFlC/t
TLSH
T126365B07F6A140A9C40DD279975B9623F636B889072173CF269883363FA7BE06B7D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\maintenanceservice.exe
Size 267KB
SHA256 7dfcbddfd2c884f1ec52cf7c206060b387387ceba2dfa0ed8f76362440f0b884
MD5 03552a5faed8c661a580e6f8edec1c7b
SHA1 4ecdd48d36159e156ec96d15b6babc2c22c59b9a
SHA512 f75ca2e2bc099aa48cf6e1a6ea7bef7d130b624a99f202bb353fabe022df1d04ef12d24162155e1cbe3a3dfe90b41ca9a616154ed6e8326c3cf6af71452b5043
SSDEEP 6144:cmlBwlrSUV2TUaSlr9/U+SJZCPJYwj5CmfKxgH:7BwlrFV2+9/U+GZRUNfK+H
TLSH
T14F448D2973A40DF9ED67C23CCDB28516EA72B8514360EBDB03A489661F237D05E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\maintenanceservice_installer.exe
Size 181KB
SHA256 23348b6cabb03c7bb7c80876ba3997ea6b1c640f90e911b149386e74c484ca73
MD5 0db269e33e87351e695a9a449888f024
SHA1 77032bd2726508915e7dad4cdf04815f0425673e
SHA512 5bf7f044a77490563a5dfc5f4123ab1eb5d195f68fcdc1d9a021dbd7a12d459dbf653e9fb9d3960d5f0da2e62990e1799ba13bd3c9726ee9a005001388072ae4
SSDEEP 3072:lNRCywDw1DiJkuKUNRD5bVPETem7y6tuU/RDObU7y4jem7y6ti6kfovZ:lT4DteUjD5JI9oU5DOY7y4j9CgB
TLSH
T15D046D01BBE0D592F9B20A303CB6DB365F31FC666E90874B6350B35CED72391A92535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\marshal.dll
Size 498KB
SHA256 e54fc9d86fbd7f3eb002b92a1dce542525cd6f63cf5652c1a7567757f6579b9e
MD5 04bfea370aa9797fe4341d547bd316d5
SHA1 c068788988edede3109f027f3f31af493061d9fb
SHA512 2b52c529ffe4da843dd4da3e8b25beac2f7c74b208c3216e9d2016fb88129bac9edf9afbec2d67b363feb675b747d263bd5603dbf1229480ec5dfd6e68a1685f
SSDEEP 12288:fQFOnIXiS/m+7FpMenWosalm9r/0jX/L/yHF:ffIx/maFpMValm9wD/yl
TLSH
T1B9B4068F616104A3C57F5378B95F474EDBB1BA1103509BCF026072A99F5FBE42C7AA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\mozavcodec.dll
Size 3.8MB
SHA256 6f5b7b83316a514db0cae4e7693e54a6d0fd21ce438c2ef3474f7af406cf915b
MD5 9b550a4d0c5f4d1163859d59aed7d381
SHA1 8171cb3b4aed3e00170ead1defdf0eaee2297367
SHA512 cf62c0b4a720d444b67c049b39bf953d4b59d358e749da3245306030144e9001e2cd557fb46a3a3046a93f1133f9bf9690b81b6c6e0aa7c2ac46a0470ce9d35c
SSDEEP 49152:QfjgPUnOhYjyStoC26ags+B+WWO2skRaeSV6x0fY94S487mcohcIAZGf6ca6sd1G:QQzStJags+B+WN2skI16xj941cZ6AY
TLSH
T1F006AF4EF0A34195C50BC9B493BBE727F924345DA71475E71B8782247AA2BC0AF3AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\mozavutil.dll
Size 595KB
SHA256 20c5bea46383f02264bc2dcb76709b5c1f34f0325945634162d41c40dc09bd10
MD5 fa168e03228b523812889ba198051d3f
SHA1 c975306d44bb780e026e09a1b56ed5d14a1342c4
SHA512 b3e2659060809d5c99ac84bf7b9c76a12199c2928c26faf16326fbcc7d7df51fd6f5c630c04bbe841ab19ae2cbf7d91b98cf7a1b4ceffe38619f7dd0a867c0ea
SSDEEP 12288:LEEfAub0kdmFnc8D8ai59PQOab1UgJYqN:L/AE0kxg8aOPLayBqN
TLSH
T1E6D45C16D5C2082FC4068575839F5969F3763442CB94BAEF339205283F28BE17E7AE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\mozglue.dll
Size 726KB
SHA256 5a7069bb5ceae9dce7c52233121e03c4adfe802d8c443f85971bad727756dbce
MD5 26dd9c8b13814b8c22fba886ed5c64a4
SHA1 c538a436f607f0277631db04bcfd71118022f8a2
SHA512 bb0dec60306c3b4c599b4c71145675bcb1c4bf835848d17c2afb6774edc4b1924ff6750ca0d31a5e7759e84f7ecc787e4715a93ff2461f0235db6faf9dad915d
SSDEEP 12288:dUCkt3Elb+X1wVYdnqoMx88m6Aj7jCXqSFRTOd4Av9Lp:dUpWQX1w6dnqn88ml7jCXqSFRs4AvBp
TLSH
T1E9F48C03F68A40F9E058D5395B9BD523FA72B845072579CF0790562A2FAAFE0B73E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\mozinference.dll
Size 2.2MB
SHA256 55de8b21b3a7ae48b078c527f21eff27c86d9fa67e50aa3fe429cd25b98b36ae
MD5 64065bef134c150aa291365e6eff6428
SHA1 6633624679feed83c214cd400433272fcc75e10b
SHA512 812c86d7f4b1d4b91c7f5b88833dabc47615f899abe2f75a9c5d9df12f3f8c9a718a74345a01b5b18d819aa8ccc28627a5f6f12c396e387003465a11f663f313
SSDEEP 49152:hivp3ObeeYH58WcuHscsAhO0PcP5wvQAO+QfclnP1:he+uHfK0N4A00lnt
TLSH
T152B55927FAA081A8C09AD0794B49D673B635B84C872539DB2F544B513F76FE02E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\msvcp140.dll
Size 530KB
SHA256 e530ee5ad678f74a0c353b0ebd00ce2d8edfff1848bb7fba7c6f9c2ede4db594
MD5 99fe5bbb9e53659d75e8302875d7afd3
SHA1 6cf79c4cd6ae9ffaec35268da8fed5a7f263703f
SHA512 4734885974efae7917fd158741b604ba123758609f3147e5db51d52cdcae0dfa11de47b36115453caa9331f5fc66ea4f68fd772d83e82baead7a1e9804630cab
SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV779:K0p1F/IiQEKZm+jWodEEN79
TLSH
T183C41A23F75906B0E195E3B8A1838302D7F1BC598322E3C752EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\msvcp140_atomic_wait.dll
Size 37KB
SHA256 2ee72df20087fad3c88f66ae8d11fbc2f1d83e69ea699628b94eff4c7e69294b
MD5 517f17892817f40bd791ecc61f34f606
SHA1 a8609584b5f11d3c854c629e6331938710031bc5
SHA512 2d705b16cedabf9b9fc80d378639607b25a5b7338f2e0c793416005226d8ac17e2ac11b394cfa57b4c18505438d499eb5377b212d004f28f2c625ccccfe23021
SSDEEP 768:PPMo5RIqKYwIgMhpLDQl4wFbZVsheSoQuoamf+e4:cOR+tMhNQl4wxZ6kL7oPH4
TLSH
T116037D19BB5804E1F5568735C4EA122FE6B2B6E08710CBCF2225559E0F93BE17F35B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\nmhproxy.exe
Size 642KB
SHA256 986c0a673b46e99866acdd2fb984e5a9553f5dcca2ed4fc16736a3f025a42a24
MD5 a1673047fe3134bbcf48912ae216ae11
SHA1 a5752941ce5ce98be4e77170312a4e10b5f0e840
SHA512 d20adae149268b34d493101052d8be9430026df922b239829b5aeac92b04111ffc51d8a35c380a5537136677c74be176cca74f0c2a6216a9cf047c130c0d57be
SSDEEP 6144:kvu6aKkvdEuX3j+lxrXR6bCXpY4rxdZyjQA8QkxGQNE/c0Q8D2SIfzzpAQFZ1869:au6aKIHQ7Xj9WPkxhNOxQ8qffFJL
TLSH
T1FCE44B13F64685DCDA1AC07D871682326637B4894B316AFB21886F3C3E67ED61E7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\notificationserver.dll
Size 59KB
SHA256 b151ee5d36ed77805f743ebce7e1042fc5835b8a9dfaa71e2c24782c421c4f29
MD5 8d40c88dd1bcd887950f17e67e48a003
SHA1 57b9c57cbe332b179a80d9554cb308189871b1f5
SHA512 33afd798feb44d93abc5b81735324c69d46f07f1adf91aee0747ebb7bf326ef76e02e5fe6dd522ca6a7f263a6c99e14ff0f5100fcc344d86253434e07377b771
SSDEEP 768:XO5w+SWv1bWOFZz+Z3nna4elmTIlnErauiNVwdyDDJFbLSbmeXVsheSoQuoaFB6M:+5YWdWtnnel1lOaNV1Wbmy6kL7oW
TLSH
T1D3536C43EB9600A8F9E6C738D2AB49129A73FD5D073161CF0385816E3FA1BD09B36765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\nss3.dll
Size 3.1MB
SHA256 8c8bc4c4e67c3244e667e146f8086eec9c89db475871dcc6113f909baa4edeec
MD5 f81aca8105a942016a77728efa2c9417
SHA1 7f8482d570214859b9e641fa07af5b18f910d375
SHA512 1189f5764ea5f5077c11ed17cf27e3132722c27a675caa4a31a916c0f71320afeb8c64d38fcab7bee0d528b18743a35a9e7606a6b480f362461c389354677273
SSDEEP 98304:RSayyPv/gf7D38yTsVHEX6oB1sCxjsKpCSG3:QTP3CVHEXD/nsKpCSQ
TLSH
T179E58D13F6A510E8C029C279979B9323A6B2B4454F3876CB52945B153FE2FE03B3E758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\onnxruntime.dll
Size 9.3MB
SHA256 6f3c17f2e2b66d188b35c06e460bfb66ef0b256e1cc7b67bd64645c8af61b2d3
MD5 cf679b27138e00ad244a767724477335
SHA1 55ac96b2c1725c27218fde40f0a62e67bf65d4af
SHA512 fa4eae95148ec666fe1a670231c3d5939872301c833cfc208de8740a178952046a0fa491938edb4fdc476900396cce56760bc5378eaceb013cdc9a80dc6f5571
SSDEEP 98304:nsihXTtRrgHYsE1/0xYNAvFOyj1rYOCmelEwEuTB5Nnad04Fyd:nlhXTtRrgHDBxYNAgySOCme1EunN+Fq
TLSH
T148A67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB01E254912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\pingsender.exe
Size 77KB
SHA256 50a02603c6085e9156b65d3d1f44a8e1118e912661a11d00a2cdfa697525834c
MD5 102ccd54f690426476afbc061f09bce9
SHA1 7caab727773654ffe8b025fa0ed814ee94317a1f
SHA512 07e57a0ac0ee34bb996df1135ceb75a9a2e0ab7faf9765666ae4d006f91395d0274ea65c7d57c6a936ce553cdbec53b2d5e19286ed876c8170e647ce5fbecc15
SSDEEP 1536:GILDYRoDMwGZw+adBkxVyFQ3Rn6dhiVu6kL7oZBi:GILwZw+a0xnh2iVu6kfoy
TLSH
T16F736CEA5A6051FAE451C2F0D2EA1313EB7575892B2666CF938453623F037E01F7D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\platform.ini
Size 158B
SHA256 8a0bb109793f12c39193cc51177701a1749bad7f0596f932287f01fae5c6ebce
MD5 a7571da38a4bd14f9611f12e770cc61b
SHA1 39e2e5bee4efa505af5ed597a41036bf9fc9536f
SHA512 51185bc430d22c89ea361d33d53a312128506c0bc90329450fe8d8f934158b0924bc70a590aa59ac6ffc64d05fde739485d65a803fda5b08da14abf0f93ea332
TLSH
T19FC08CBB0010049A0EA63282D0B06D8D826F0EC14FCBA418B021038E1EF590B82AA46A
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\plugin-container.exe
Size 139KB
SHA256 82ebe3b205fe11f1cdc9b05c452d817fbaedd6272b0ad8f770bff83b417d3c19
MD5 4e3f6158864d8705df5d3d0e4a167d31
SHA1 3992e3e9d42c8299b2ecd8a75ed38446d41ab40f
SHA512 6278e66b14069ca5f2eb84ec3e5beeb4ffa970e0ae752e39cd2fadad16377b614e1f41092cc6b66379a38551399d82396739f44d5406689987a15e0cc374bedb
SSDEEP 3072:0Xza00GF6fR7Pzw1klAo6X9K2KgMPOlP+T/V5MbM4VFWW6kforSM:izMGwZ7z2klWNK2/MwWT/IV8sgrSM
TLSH
T1B8D36B13FA5950FAE559C9708A824612DF72B8860B30B7CF67940DA12FA5BE4BF3D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

precomplete

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\precomplete
Size 2KB
SHA256 22c96cbf4013bebc53b40513ab38df386f69e2f39755ccd85b3efb19699dd42b
MD5 e48e2c4a43825a2c9fb8709991165ead
SHA1 6325093334b65d628f9f217844d0dd4b3fc7b0ff
SHA512 7302dac2c8aaf8eb4317b3e0acbdc63523e5f4c1510cd886fafd11201cb0d791bc922c50bec05050f1348276dcc6f41fc6ea3d0fb6111a84ef42b04cc5085a8e
TLSH
T1BB41258CD02EEE6169D651C884D31D8F3DAB42A6DD9DEA781EC311447FE35EF010D62A
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\private_browsing.exe
Size 132KB
SHA256 af8495d7c8dd4192d90a17b6df2d01295d965221cc3e6a7aff7e6d9224507c11
MD5 b0a61cfbdfd210be235d7b1b55c7e932
SHA1 d825a895c07874d6124d18aa5ce2c014c7d6e455
SHA512 ca392d744e43d49a4c8cc10ca8b1dd5f8ea23515d5f9caec9b1427a8dee3d057e2e9503f5cbc109e368203a2cac81a044fd34125219c394da5f88ff429550da9
SSDEEP 3072:449i0HFNqFx6m6N3MbE/66TsnA7F9B6kfo8:4S/qH6m6N3Mbu66gngrg8
TLSH
T18DD33F8A9E858E57F07CF17E45B68D35D55AA60F230051C3BF3CAB83EF58B94282D606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\softokn3.dll
Size 355KB
SHA256 6fcfa7d0da09e1350b962f88a6403310d40f059b4ee744dafe0b0016fd009b8f
MD5 fa2e594a7a028239b18ff9895dc03f1d
SHA1 639d69cdfd0920b1a009d18dbd1634e71789cee2
SHA512 9a887d47c9a13a1d16e7ec42c88b78be30225b66d1a351e8bc7629a6fdd320dc614b984b2d674a0526a4a07c92989f568dc01fcead5a17431421094dd1d5b8ef
SSDEEP 6144:+80A2J4DmexNlUGyE3QovWJ5SCyVppCTca83eufTySJtoON0E9kWIxGgH:F2J4fxp96SCpcyymSJGs0E9kWqLH
TLSH
T155743B03FA9155FAD806C475A1678732B5B3B8940731ADDF93285B2A2F61BD0B73C788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\uninstall\helper.exe
Size 1.4MB
SHA256 0907febeeb5e417e1958c2b077b77b89e91de97371431ae8961110a5e3cdb064
MD5 f7c32d39e85e96345f76f6d016c0228f
SHA1 2b5556ab1be5f2ecdcbef849afc14466a8072cb5
SHA512 d7f3211418f6881fc4193198ccc017c182780d83db272394377d5d192bbc3c99c352de576e3ba969ffebcac35ac783b9099734c3102c8b4cf3ce8fc1511f097f
SSDEEP 12288:nTCUjD5dhTT9euP+bnEPsSjlSoTUJDJf95+B7a2SooEPl2:nT/hTRhmbEPsSjIoQ0BW1oZPl2
TLSH
T1B4651803A790A862D46E6D3064ABD7253B37FD812E7186473B1DB39C5F73340AA7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\update-settings.ini
Size 116B
SHA256 17224c6040c70203f9228f35c345ba7f72e3be84ddbada6fb8f971c701e87e30
MD5 68acb4ae209a1fe7910b85a3c43c5cf2
SHA1 c70a6335fc65b17453a88e59bdcec7a067c94cfe
SHA512 3bd99664ce6abd681bcf8c089c7db5759eafd165d6f00adaa8c900f7b988e98cb99342778e90658ffb17660ff95023f49f8efeac28bd7c366a208df6c3e1bece
TLSH
T191B092895A94A84C8113C462EA6D022305A2C529090521252748E441B3E77208ADADAA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\updater.exe
Size 984KB
SHA256 05a5388b6fa334d41d1f5a102cf81f77b06b0f94fc5c826a08e88d64626e6a2c
MD5 80627f36a7e91739f0d43b9c97765b26
SHA1 7bbfe8b1a36a3c8d2f0060737f03d9139a465630
SHA512 922aca36527f978ea8c70d2e7acce8036e2ff716ac8a95c26e4063158ff4ffa12669027cd4d96cea79a719c6983e218b8a77c345d12c8525f9a4310222c13c66
SSDEEP 24576:eHfh/Xn4boVk8yD45qxhbhth0lhSMXlWBJ+RAm:eHJ/Xn4sVk8yDBDhEZz
TLSH
T11525AD1BF7A041F8E469D9748BAA4513EA32B88A472166DF07D48B152F73AF01F3E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\updater.ini
Size 1KB
SHA256 a6d81b46188b52069c2582dfc6b4d682bb722c2436cf5f531fe6ed0c94952c9d
MD5 27a5a5f5ae9b41546c9b6c7a0eb6f026
SHA1 21dcaed4a05199f407230b60fbc554a23e195f33
SHA512 a6208e3819debb7a169adbfec9a426570acf5e8117258dbf8faea4d886c923007e52cdb3cc46028878c3aeb810a9f7b9482f92b1f77b5899319a1644156b11d4
TLSH
T1F62121562688B3F409D29B85BA4633D6D78381ED23513120A0ACC160434793547FEBE9
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\vcruntime140.dll
Size 110KB
SHA256 66117f754c026b1890726a72f6ceb3c56e3ba028d74a8428b1122983ddd8b771
MD5 191e66f02ceef743339abcea9a2f591e
SHA1 2756ddefa6485845f1a94f497d380e840a8b1f29
SHA512 1b6efbbd3bb10bccf4897a341be9f5a525496c96d66b7d23e45a7da3c1996712b441cbb000ebf2bf22bbeb4198ca541ff78d82ed9227f8bbc7a1158969fa194a
SSDEEP 1536:T9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lg6kL7oA:fyA+3EOfmpcGSdOecbeQ6Nxg6kfoA
TLSH
T18EB35A4272B802FBD16AD275C1939E6BE7B2F40587645BDF07AA46660F13BE02D3D381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\vcruntime140_1.dll
Size 36KB
SHA256 772990496ec3fa1ee8ac05b91979054328abdd4dcda0364d1caa3ba5fd6a117b
MD5 627a86c0eea7d7e45cbc9ba06e93ad71
SHA1 0f1a0e7fef4fc610680b3947467b69bd6adc69a3
SHA512 1e2136299e42a4f1a4561e9a020511a6bb894dc632e93a0657598c3c982da593fbbe8b9d739ec8c36c592a76c2c738a67fe91e3e111be7be2999ec127674aa36
SSDEEP 768:cezSkbhNfI4fWLZyS/dPWxuVsheSoQuoaK9JCRkF:/YZyuPWxu6kL7oLaRkF
TLSH
T195F26D1297A840E6E4A7CA70C4EB0E2BEE75F590576087CF2E68455D1F137E06B3D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\core\zen.exe
Size 862KB
SHA256 8338297aad8fadef9043b55e572584308e8a4fa343a9194ed0804d615cf0557e
MD5 a0fe5c5df1a3ab553462132176cbc97e
SHA1 2ad69f8278762c41379a27d8429bcaf5f4aa3f52
SHA512 5121f59ba32b76424b91234c0bd77e736cd98e2db4f46857038f1a1e2485519596bf4d2c6c76914198f09c6c06d61810340bcb5eacb7b9602d93502baba3f684
SSDEEP 12288:npDiH1Qjy28M3+w2XRr4XoIrQjwbGYbG65bvngdrXfV0:pDiVQoq+w2XYoIrQjwJUrXd0
TLSH
T1B615B312AB858CBBF078C0398676CAB5D5257C4E83D051C73EACBE633F75A9016F9606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCEFDF489\setup.exe
Size 1.0MB
SHA256 db2c67be5f6e1315a1d63777bf99ec3826353c655386f3c2e629cc26e49bbec4
MD5 343601c2357ac876ca8537db3fb2be62
SHA1 e86ae3e825234b807b243cd7cf2971095e0000c1
SHA512 9894fb003c644f391f135895376dd4fa943d1c9ab2453fdb575be89383deae72c699761c4668427afa33681b0dc8f608bdcddd9e0b93848509a0f047a8a9b6ba
SSDEEP 6144:nT4Dt1UjD54JY/c9Is9es0mPH+WSnEP+rdlqSB9G3SoTg6:nTwUjD54ui9euP+bnEPeqSjwSok6
TLSH
T1CC35F603B790A462D46E6E3068B7D7553B37BD822E71826B3A1D739C4F733409A7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91b2401a-10e3-420e-b601-6de37ee83282.zip

Path C:\Users\Admin\AppData\Local\Temp\91b2401a-10e3-420e-b601-6de37ee83282.zip
Size 3.7MB
SHA256 af9706aaf2d0e4ca1f1e61133a874b82399bc07a3ca5c0989b282fc708550f22
MD5 6b3eed16a0429bc80002520153b11312
SHA1 2dfd5fbda201131485a8058fb554a0dca2ac7b0d
SHA512 959d6c1ef639c8bafc4be37090c3b5aabd016211a517e95f1f4be5ce05c8fc2ae66313f0902e40f0ceecc7556ac60d054d07c020550aa066d943049cfdf2af92
SSDEEP 49152:ykscKtlbXGjjTWP9eEsGYXvViBp5eKtPKulVAyXaAlWIiFFvMuGLuyJS+q16Twms:xscEPbKNiBfNQyXagWIYM094Twmjo
TLSH
T18306E0F5D65C1609C9FF83BA850C2FC2C8FC4B6E8054A55BEAEA95715CA31B21B448FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\components.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\components.ini
Size 602B
SHA256 f1505640e352a1748d1cdbc6eafc0ab21b0de520c6ea6b750d6eeb41b868dfe3
MD5 637a9a06841221d166843d55316167c0
SHA1 0aaeb03991f6f828af3b90f37e6c73ee7b94e6ae
SHA512 7a3215326798d9682a8fc2eae643d47314c971f5acda4094d1e9daf59defcfb36e3ea86ccbeb3426160e0fe29fb6339c9bd70b52317fe8c1b42ddcf3b8f106eb
TLSH
T1F9F09A472AF80418F4F7B709FEB441718B393C45583DC50E91E1080E48E4A808877BEB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\extensions.ini
Size 630B
SHA256 0723b5d0c55354754b2084b712854c39ca089b1d883de067ac3c20935808397d
MD5 940e15a3691292c513f015e351f33072
SHA1 0545d9d43b188182988195db8a01fcd3ff43afc4
SHA512 cab225845a6ad929b643f3c6f8e9f1b8d0e7f0b19ca7ddaeb6350c508e9d21294749077ab3d041facca1d41578b2434f0faa37a5bb64f1ab1ddadda0edce4b75
TLSH
T14CF06D532AF9000495BABB04FAF581718B357C855C3DC90E92D0094E0CE5A818927FFB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\ioSpecial.ini
Size 1KB
SHA256 2095166a9e607dc8f209e9f164dce3c52a819665c09de344dd312769f94bb482
MD5 c5470432d39b9dc7492c7afcb5b9e615
SHA1 b0e21318d48b3500171a91c50e8fda1535538d41
SHA512 bde6d4717fc3016928ca3de331068fb9013d0e8e171f3be6c32a791a02fa0a9637e6953306eeb5cd708545a0b10ee3cd13ee5a88759b66bd8f2836ca219a7881
TLSH
T189218E032EFD4024E2BABB08EBF491359B397C95582DC51E91D10A0F49F5A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\ioSpecial.ini
Size 1KB
SHA256 fe854465c97363bb2a43c68b26dd5c0307cb9923898f76bc55eaad97be45b4b3
MD5 eaabc67e063d7247ff9c25483e4d6fa0
SHA1 f933b8012a7ad1f110ba3f328608f288e680fab8
SHA512 39a522f0ca90afbecba2278929fce3249bfc9d4b95a842180ff9431de678c3a4a80fd999cae013685b4fcd7c7d0724b0fac75362006766d118bceb73b2ede326
TLSH
T18D216A032EFD4424E2BABA08EBF491359B397855582DC50E91D14A0F49F6A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\ioSpecial.ini
Size 1KB
SHA256 d0129b80c367376142445af4f828e1e5a3b2675b39587e29405d95768c957dbc
MD5 dc207e84d2defa1e4230a107e528d888
SHA1 a876e9335d5ef5c821dfbbfc572d9ce2b79cc014
SHA512 cd1131435ce03d172aaa6cd40218e50e5931bf476ed0e1af7c8935a5355dc9014bda1f4d7d87b36a0e9470353e5afdbdf76669722f0e9bc5b2b7c188fd2cd45e
TLSH
T12D318D437AFD0514F2BABB54FEB451748B3A7856A83CC51D91C0090E09F6A508963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\modern-header.bmp
Size 25KB
SHA256 689ea80105f4e61ffc73062516c7d7053f92bae0c700c0673c3a9b445345df1d
MD5 cb1c4da8daa79279041011b85f48c3e1
SHA1 40496c445e18eb28686ef1efdeacf39153a91062
SHA512 eaca5a8e4503c3b62a3b675de44698af80952708fc4ef19a1e0174e4dfd5d6d4af3a3a9f02c4c8ae2c8fb257ff15fd26798d5dc04cfbe727a2fe7050491ee5ae
SSDEEP 96:aCCLLsFslQUlQhMs32QcJYQ/KgGvpNgFtQXPFD2ak29SiD0bFSCxPw:aCMLsFSQOdINUMD2V29S40bkCxY
TLSH
T156C26A110F8E1647E922B2AA323235587DCACE0D56F34667FC0833CE8AF701C2A352E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\modern-wizard.bmp
Size 201KB
SHA256 c03931e6f022e29943d410030595712a29285c1130537d552a7804845a07eca7
MD5 faa41c5d172376cb31e0bbee19d332fd
SHA1 eef931a54b02588e2ee9b202bda14a612cc8f423
SHA512 b65514d05512cbcf27c5a06b97a2454f66a58a2edb081fb1949a0d91d3d9a47c9eabba6dc521566ec44b7fa7b7a863d4bcd6d5bb01a6633d978441b6bf624ee9
SSDEEP 384:sGiFLVfy3SqviWSlk75o3gDVxYi9eFQthspiapMjuqh8fLCG8YHwDT1bmJ:t/OiapMqB
TLSH
T156147F8751C424B9323C3E4292AFA80974575481BD3DBAB63E8DA3634F938E78B3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\options.ini
Size 1KB
SHA256 fba4cfe357d29168de21e4718f15f070d08fc0241bf771d5ac9f6373979de176
MD5 15ed0cec8a172e53230584b54b69f882
SHA1 f58239eb5b9693b4baccc836f901416c2bc776ca
SHA512 620e4b83a1d2d5eeca2cbbf47874a97889f035a0341bd38aa07be7aac41d283a5cf7b9b86f1da60df0ea0ebef64e14d5f6eb76da56c40fc36438e804068753e4
TLSH
T1AE216A632AF94116E5BABA08FBB581309B397C46583DC60E82E14D0E0DE57808477FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\options.ini
Size 1KB
SHA256 70823b7971046bf14b502d81e1ce88552499c14a3b308ad18795aa1f8c7c45bf
MD5 3ff3c18cb6475908d084dcc2e1d8c0b2
SHA1 9fe877c901fef355698a13d70c30b727bcb3fa64
SHA512 e383e9366128b65a62881b76f79663737fbddf714a4a77baedc6fe819fbae6e28bc6ad6177a763e777eed9e2e2b7af926655751370f0c2b949297b3960ba1173
TLSH
T1712180532EFD4516E1BAB609FBF540349B387846583CC50E91D10A0E09E67808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\options.ini
Size 1KB
SHA256 2c7994b3cc7a390ef1834123a518c0009d0a9fa341ae908c52c9cd3726bdbd09
MD5 5b02b27b2ddb600ecabc3dfa5edbb708
SHA1 fd60a3f654a494c92dcb16a9120e900c75096e1d
SHA512 5e3ce3b3f520e5a9a27df0a89189b2691f6402983a04c3c5461fe0c668790bb6d0dc000b7bbbd61daefc83d43cc8c5a884ab64fb40c052904d81c916f7e9090b
TLSH
T1812180532EFD4516E1BBB609FBF540349B387846583CC50E91D10A0E49E67808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\shortcuts.ini
Size 680B
SHA256 d0f7b8c2c29636f98462eebb68d639b0d6f93b015f9e8d117553d87ae684cc7d
MD5 f828bb93e67c944c12be61a9f703fbf4
SHA1 b206a620547fcde0e284f4c8284a0f3a1d99c819
SHA512 ffeb09a9963b6a79f561e0cd79e3bba96632cd636e40ea4237c42973eed9cf0f512707c3cc4d94e0519079e8d84156063d2524c991d53de0843f4d86f3781ab0
TLSH
T131014F032AF94014E0AAB64CEBF540769B397585182DC80ED1E14E0E48F56804537BDF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvDD28.tmp\summary.ini
Size 732B
SHA256 f394fbd1b76fd6019f0511bcbe4e469cf95cf7742ae889c039614db0ef89c35e
MD5 da129b7e31b2d40eb5b1340d7d3b79f6
SHA1 f01191e2a8e1e3fe431f9d977ff39dbdd2fb39cd
SHA512 4834252e32c255130761c3e5570971cf69572f32244ba7c7ad98e2a95a9e0d6bf130e658c30007f4a943f8bb3c22e9b6267bc87140df5a4775a7b9da4ac5e8ca
TLSH
T1D301A4032EFD4428E4BAB60CFFF5407697347806582DC90ED5D14A0E48E6A818923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 565KB
SHA256 9e87ffa121c315ba1b0209ee2caa375d4d2a7c4ea89c69447c16a358db68579a
MD5 c9a38cfc9ad727ee466548de78b7d68c
SHA1 19c1d780f6bac9c7dba0ec24fe20aa719d56e325
SHA512 c429f6fa1b57ab6b96e86abf85d77954f309e42500290f2d606ca7123651282f2dca4410cca23d18c21b87e3fa603b00ca4a592345fb85d5faf8a7e61de04d3f
SSDEEP 12288:kVlg0iA5Gvois5HShMLjPEOTuMTbYIaW4neBrrHqN1XMgDjj2DjyrdE5yGuz:kVy0a3s6MLjPJTuIqjCr7q/MgDG2pEvu
TLSH
T188C402F5F7A038E377BE420B9DC66FAE1B565522C64BE0CC443B6BC24557729AFA5000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 23KB
SHA256 98d20fde58130fa34aadfdf731c7a3b7d63ee8472abe375516f69876f308c10e
MD5 d6b2437974a443d6dfa874396cc7235c
SHA1 c6e0862067c72dfe24d5a356b60737b67d1a4d12
SHA512 45de628c195ba9cd39a366169afef097a3bbcb8e194bb36cc3cf096d436cc08c77f778464104c16a4afa6e168eee2ab3ad79741812c8830ae2ca9e1cdd065a8e
SSDEEP 384:pNT5fDTJfmNlTlW1qeI/E3rPNVeU+Ph5n8tA82pWLp8ESYIzbZUm:D5fJiWAfYC5PfMzrLpMFzR
TLSH
T13AB2AEAB5E064626CB7B873500F2C141923C443DFB49B5166DA232991B1FAC83F17ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\zen\Profiles\m7cyqspu.Default (release)\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 21KB
SHA256 086a2f5ee3ab1a137058f587f7158945d9ca90eef966f1cd734314286d7edc6d
MD5 73a1f4aaa027aca175db6791dc8c2f6a
SHA1 642006c6af6deacd9921093574d0edea775181a9
SHA512 55f9fb9f701923488ff3b3db30af69c33c675f0fed216d6ee360bc6ebf377ca5a1258e79c853b32191a7eaee66a54900c0437fd3a8f5d9d4154131cc8fd7e67c
SSDEEP 384:HwCe7iO024Y1DL84+KDL849B7SOEAd9KVRaAcP+AWRMAfTUKisj8wkac8Woh1B9k:QqZY1DL8ZKDL8CB7S/AmVAf+hRMSUKi9
TLSH
T1E2A2BF7A5F403CBC199790E8C8BD42EA4C28BA67DFD6807D25683D09CB94599B1F448F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\zwn3khqt.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\zwn3khqt.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\zwn3khqt.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\zwn3khqt.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\zwn3khqt.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\zwn3khqt.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 694b1ce4b738029d91d8ae37704cca4459f64601b6493a9c2e214c5a3631debf
MD5 59e8445cb4b96aec88b1be449a10e5b1
SHA1 c7aa5f3fdeef9b48c890899c1008568f5d183238
SHA512 29c142a875d20d141ae22183bdcb61231dbc7ca19fd0c4551fc2a7b0be088112f8cdc36a9dd04c983437531cfd9935563f04e2a19db4ca663e4cbd775be93009
TLSH
T1A041AD84D6E85535E0C8427BB8956F401A307116F44E7F11F4AC62A82E4F2BB32AFA3D
MD5 SHA1 SHA512 TLSH

Submit Download

56f2dd28-c3cf-4b71-9f92-f67f698443a0

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\datareporting\glean\pending_pings\56f2dd28-c3cf-4b71-9f92-f67f698443a0
Size 712B
SHA256 15a9a0f6cf84b4d55f841518c3e29f2cc1b2c0d879448589b3a2e8f38a9de59b
MD5 fd0bd295dd2bfee740107cb77e4cc798
SHA1 5c7b84fc377da342dbf2d7454734e24c49e4c860
SHA512 7dc60f67f9bce1da8d16309650425c368b4b5cd16231a710bfffc8359d82db6b1e2dd51443cacbfc58190231080097c3d61b5bf4aa8051a05ce7375bff0fde32
TLSH
T18D01FE8659D8D0560CB0574AF0C83F404879183760AAF348D4E08B3C79DF69B5737B06
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\extensions.json
Size 13KB
SHA256 d806ef6e2cdd0cd2e4098801038fec1b23970cfed5e742d646d1fcc42c40b439
MD5 84547e2b2a0950cf9d26391c2ab5c1c2
SHA1 c98aea9638be0fad571ffb053d0d442bc8ae1252
SHA512 9705b8d0072eb041e116f1cbf1934268bb89a5fee3c9d9ee285b846f57f0088b695122bf5f74a6ea0f86fa480253b0e9157e8513a31ed9d65e998b8d4d815b01
SSDEEP 384:8T4ij/7T4T9uj/71TYij/7LgTldij/7KT4Cj/7MT6Ej/7ZL4H28L4HL3L4H3L4HC:O4r9cYSKf34b6S4WW4r74b4i
TLSH
T1CB52FE1554159EB8298EA3DAD9767E02C37C563B70445C7CB8ADCFCC42FA0BE06A361B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\prefs-1.js
Size 7KB
SHA256 00fa812c9305dcc0bcbb126ea6f098540c8491bb49af9715962106c93ab65af9
MD5 eb99c9888474296b0e01204852e1ebfc
SHA1 60ea6d7acd5c0152b16dbb96aaf48e904b7971d9
SHA512 9b90a3aa29da3491bcaad3cc7f6015a390db50731160ff1d1a50afa0cd6012323ccd5af9ee829baea5a2e6cbb76df2fc2cdd94965cf58238565907cab0b7d95b
SSDEEP 192:jyRDgRgJpdvgH2vfCXxPkyph7Bw8CAMW5Q:fkOXSeVwQQ
TLSH
T19CF10E6890048FBF25B2377CAC648A7196B2413B7BBF58D610B944C4060CF7985FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\prefs.js
Size 1KB
SHA256 e989485b7359829334b718c4dde71190699aeeaa1aebcd97b3074254b58bfcbf
MD5 2d488a1a432867a31af628e781b863d8
SHA1 47070fd41e3b053a43294be1d3924cd777afee60
SHA512 fff50ee4fc539fdf2815a154d76128c7319d0d6226250a40903022961a9259c62d30ae5c9f4a7e7af09747d713d0e9dc11eb8727ad64e8eb248fe48d82ff9c79
TLSH
T1D231DC622905CF6EA1B536ACFC294DA0C3B34136B67F6CC925B884864219F3546F35DB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\prefs.js
Size 7KB
SHA256 68b4f0bac2f06ab78bc8c339e026aaafc25707de4514dfb6b79ed612f75f3512
MD5 ff94684573ce3872a1f037bf4c9bea3a
SHA1 2f2a0309dd5be6aa239a63506d88f77dfce5f462
SHA512 0dce48ce5e1436e6d54fe20ea07c63cdada0d73de4b8be15803a34408a3fe065c1fc9b7e3c6f10eb9b66e4479894f4bcf048d54429042cb40df5900838f1b13c
SSDEEP 192:gyRDgRgJpjvgH2vfYXxPkyph7Bw8YAMW5Q:2kWXSeVwwQ
TLSH
T184F10E6890048FBF25B2377CBC648A7196B2017B7BBF58D620B944C4060CF7945FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\prefs.js
Size 8KB
SHA256 9e96b19c5460c82c18275474593638c3726556d86ea84f6842f99379f03450f1
MD5 479467aed569ae15ebe3bced8729513f
SHA1 c24fdfd55643ee76c39c2960162c8bad110a8f46
SHA512 c1ed45e9f5950e1ca515d5392e5eb2699653e31fc6725207405175a7c56c9018279dae2381a12aff065952cc60e6d05d590e21bdc68c7b29a4c65f4e686c759f
SSDEEP 192:DyRDgRgJpdvgH2vfCRX9xPkyph7Bw8CKMW5Q:/kORX9SeVw2Q
TLSH
T1D302EC6890048F7F74B233BCAC648A7056B1413B7BBF6CDA10B98485560CF7945FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\prefs.js
Size 3KB
SHA256 70ec3b5906707fedd81cd3be0aa67200dbcfc0d244e42884d6c10064012e5d6d
MD5 840caa4ad001531322104c5d949b64ff
SHA1 f605d9c66e8bdd19a2aae452a989f6af95647a67
SHA512 1d4a66fb7b757a3a05f1c6362a0ffab1714d2d7cddae3834aa7f012687e1ae435332ec5dbe37f5419bf1291783d48d767f6a03b99d2799f56617ad8b004f3b83
TLSH
T16571007555048F6F65B633BCBC148A7086B2417B77BF2CD620B84089521CF3946FA5E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\prefs.js
Size 6KB
SHA256 18180a1db858bd7328aba676a1566c40ae5186e4104f2d0f7759533876830c67
MD5 ce67a1cbad05156b5e5509b627f612ec
SHA1 70bee0b7e36c82a43b365910b4a8b26260ba6870
SHA512 e9b437a1364db03f39abf7f8bdce5bf0a4b9f709f1e897514676dd0b59b81b372ea304ad5eabd830b6b34db274bde78c68c73ab1bc039088663396d2f984c99b
SSDEEP 96:xHKLmxFqLMHzvzWzhTgHx8y26fxPTAWXxPkjD6uXhN5BHAMLDG7Q:MPLMkTgHx8upXxPkyGh7BHAMW7Q
TLSH
T115D1136894048F7F64B2377CAC648A7096B1417B77BF6CCA20B84485120CF7955FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ba5efea0038ab9bca3b4af5a6362ecef5531b1faba3424b42eaab3c4b96bd22b
MD5 acd060bf6ca4572afac3c23a74391f19
SHA1 2443ca2590d11b5277791f0a532229aff55c0623
SHA512 14ab9183cf876c9871824fea02e9192efbb6f94aabc859fd6ed09410c48d93d7f96e7c69c57dd0acd5feb48bcb28f5aa3c9b5aacbaed6c74daa5c339164ab45b
TLSH
T127410A42F5A90AF0E799D78D43CEEBBD1689291687FE0981D58E0934093C36E7906A48
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 139064d20c82feab84634d54b47d3adf259e3ab0f6ccb0a7df6f23340ebc054d
MD5 08ed8f2770d2b26e4784f012b4539554
SHA1 2fa40846ffc4f05e082093204c0a463eec8ef7e0
SHA512 5b0d061305a36eff5d150921bbe3ff66d0a55934752b107d2c69dae12082b5fe14f56f2de3d9027b1346368a4c503d3c9a1822835d0d541273588ef8c598b3ca
TLSH
T152817D83BDF147F0F965CBA6094C6A3553072C2A00FF58808ADE2AB88A7470F7DCA584
MD5 SHA1 SHA512 TLSH

Submit Download

2918063365piupsah.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Size 48KB
SHA256 dde1fd571e662764eb429d579d7bf88323a31b60d0562bd7e23ac750bdf55379
MD5 d9cef52f42b23e6dd431ac88147b96de
SHA1 7c02ac8ee12c881034620a1db759d7eda236a17c
SHA512 5a3594f093588f959338a8aaf3c82510fe05819f7ba2322d614574070eab99e22894f80283f21324be89d887edf820f316892e5bb5ea3219e1b4044a5be65602
SSDEEP 48:T+OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEb78:616S6CKnqlizbxV+2xVeU7X2B0bA
TLSH
T1C4235F8E3F07E511C53AF0B178A08D51FC5E321D07222AD57990DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 c8f4d76671a107f69163745561cd349001958c181387a6cfcf6191638aeaf056
MD5 c02651d46a279a01109277a4d6e6f498
SHA1 1f6bf16f1414ea6ba8e309f3a3f879d3fc93a6cc
SHA512 96b8a12b544ee3e68c0ccadc76a3d27825fa15169c20ac727b9e0bd1d30567ac5a2db8d6840a601f37a8f9fb8e4bbd1ac0e755fb649367a8af5668ba7e697a4d
SSDEEP 384:G6S6CrAWOhaRBvOPv7hvKovVYvC6v1xbvyove730QNUeKN6eAs0eq8hetMRe9cL8:G6S6CrAWO97301yqIf
TLSH
T12E4385C87376EE49CB02C87B08C683EF808D7E6900B64D893676D75C84614EBDB6FA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 3.8MB
SHA256 62b3b6c7b1b711cc53940ca0ca424bb274a346b54e65737f75ea96d36279e32b
MD5 583ccec879908b9e69212b0d793e3710
SHA1 657b28200b4c85983e03c29c852516f966af9a79
SHA512 6f86219539caff595f880dd07eefcd826058642eba89b8d6bb2a8a7d90ae208d59002ebc32a6c3dc63091677e0a663df08b09dbb23f23a56bfa0fcc61139b70e
SSDEEP 24576:XrKUX1o4Zepa25j+BlYCq1ybIHpuJirt84ScLROrO0tT5iYcRTugSC:r+a2xalYsIJHLsrO0tT5iYe61
TLSH
T1FF0608F854D09587F3418036358183EF22DFE049A437EA885FA15BE985B4CF78A17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen-live-folders.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\zen-live-folders.jsonlz4
Size 15B
SHA256 0dd22af73bf7560a8bc72ee90aba611c1241c2054d488f75d90a4afc27309efb
MD5 e88094f8457c6fd244c2787c6524b125
SHA1 a5823f19d67c3b3d9cda80aa3acf20dd00a2d437
SHA512 769ffbd35a9c2a1be4ec91c60036f4a7d3925e15a947d909f9e4b14573ee9b993508917d0e28513c6fe13b4202d7f4c39173ba729ddbfd400a90a01812910ea1
MD5 SHA1 SHA512

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\zen-sessions.jsonlz4
Size 586B
SHA256 631a90b805f76ec880bf07d6bf77b28424c1bbe6589176163ec8589e988d6d9d
MD5 57caed5cae775c44825315bb63d3658a
SHA1 49955a2b485e698f722fc26bad2e301b63bfa837
SHA512 56baba5972bae6e3a77d7b06b27725d645e3f675699d3fc12d8348c67517f6fc554f6d797fdecc9f7bc86ca480d1bb88d19f259ed5a32ac8c6028476f4d28e1f
TLSH
T14FF04100B9008FF067D6C1A8C4C18618FA06273C8AFBBCA18801810982C30A77E3168A
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\zen-sessions.jsonlz4
Size 67B
SHA256 82363d65b693e6e6b788a83831eaf725cb2654f2cbabe60fe7301b1e02e91971
MD5 2a7ca09ec81499bba41848302ead3f25
SHA1 d3feb0baf657b262a03ddbb5c2c250700deeef50
SHA512 74ed1832ef22f902e92b717aa71197a92b716860edfc7e7900b6ccf2422b188d580ba14ead2fa2503316e77c105e22507ef2b615edafe77d315b830d252bd7bc
TLSH
T129A0228280A00B2002B0B30080E288CF0382203A003008C0380B00828208A8308C30C3
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\zen-sessions.jsonlz4
Size 2KB
SHA256 97b5b611d9104023d164f22021d9eb340191dfc4570cfeecd0910cbc5b99ced5
MD5 93191b3c5b6492b8f726d96de7d37255
SHA1 0bf2cabe5e99ef3efde941c792657bb96ac1f90b
SHA512 ef4609cb6f16ec79e9a55d03731aa45d6f931e931185ae27a8c5ea82e0c9f31d00ca57de08998926ca18062bc0e1bf0eff3a7454135d09b64701b243d1ef4928
TLSH
T1F8513CD279E183FEA038475E09CC3A14FB53657621BE989054CDA38D8531B01A9F9027
MD5 SHA1 SHA512 TLSH

Submit Download

zen-themes.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\m7cyqspu.Default (release)\zen-themes.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 1008B
SHA256 fbab2a8954b8aa8b0bd86a2131cc0045aa333aca82cd08e6ce59746bbc80af5c
MD5 0b7a7854ceb3a3bb3635bb7381fe9947
SHA1 458c5b7bc3f7c6327a791008a34e8d767d99f9bd
SHA512 8d28606f51a76f4fca23d910229369c925bd527aee8fc3b5cc3e73b3b75c0eeaf93be271d48ea4bb7a637205e789f132ad733c0307192a2c860cf8e467d73323
TLSH
T1AE11AF0047E75635F17B8A7159B37B32C727BD42D3B8472E438992944CB1024D9ACBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 910B
SHA256 f1a7fb51d18550febe527950f9772a705c3f6be3a836c867ac30d8c92e26eba8
MD5 266687a57fea50a2083c4001c3687137
SHA1 0f46b4360ff854218d81d1601711a0f06d9250b1
SHA512 f3728b8867ec71efc7dd3d82032feab1b4cb84503fadb6adceb4e6d2bb731e1a218df6f1daebfdc12c193d05f9c197013c275dc519ab82569c0b9e239d4f93ce
TLSH
T12311890043E31625F1A79A7115737B31C737BD0287A8471E4388528048B0014D9ACBBA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3040-18-0x0000000074732000-0x0000000074734000-memory.dmp

Download

memory/3040-17-0x0000000000B70000-0x0000000000B80000-memory.dmp

Download

memory/3040-16-0x0000000074732000-0x0000000074734000-memory.dmp

Download

memory/3040-15-0x0000000000B70000-0x0000000000B80000-memory.dmp

Download

memory/4076-21-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4076-403-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4172-2889-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-2596-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-1835-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-5795-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-6690-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-2558-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-6700-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-6703-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download

memory/4172-6708-0x000001FA2A030000-0x000001FA2A0EC000-memory.dmp

Download