367a99183e604bf6cbc10c51bf050fd7be4e82a750e2e640ab7c7c71c84c9664

Resubmissions

11/08/2026, 01:17

260811-bnjxbax1gz5

11/08/2026, 01:15

260811-bmeafadl5t5

Analysis

max time kernel
57s
max time network
60s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/08/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zen.installer.exe
Size 91.6MB
Sample260811-bmeafadl5t
SHA256 367a99183e604bf6cbc10c51bf050fd7be4e82a750e2e640ab7c7c71c84c9664
MD5 d3beb8ff51f39eb95fc376d0e7e47b25
SHA1 6311b77473474cebbc5bdb8fc9bcb618f82806f6
SHA512 7aaebffb8bb1caf7128e1f7a7b5b964831541723ad561a834e7d312cb2c6ddd84e76529883ed260e68738377e4c64493caaa4342fdc2f8a550a1325e8e5b52f8
SSDEEP 1572864:uTaFrxU39SSX3itnlwBSVKd4ZFMj0qMIHnBFXFvmG1aJpRv+6hHbtOpLJJbz8aD9:a9SdniSUQMj0VIHk2klhHbtORJBzzzzF
TLSH
T1212833C701B146F8C524EA76D5EE9AE718F4011256AB6194D2BB04322F8F66EC4CF1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3592-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3592-483-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\updater.ini	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140_1.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsyA594.tmp	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsyA594.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\application.ini	setup.exe
File created	C:\Program Files\Zen Browser\default-browser-agent.exe	setup.exe
File created	C:\Program Files\Zen Browser\lgpllibs.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Input.dll	setup.exe
File created	C:\Program Files\Zen Browser\pingsender.exe	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\uninstall.log	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\update-settings.ini	setup.exe
File created	C:\Program Files\Zen Browser\defaults\pref\channel-prefs.js	setup.exe
File created	C:\Program Files\Zen Browser\browser\omni.ja	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsnA5A4.tmp	setup.exe
File created	C:\Program Files\Zen Browser\plugin-container.exe	setup.exe
File created	C:\Program Files\Zen Browser\precomplete	setup.exe
File created	C:\Program Files\Zen Browser\fonts\TwemojiMozilla.ttf	setup.exe
File created	C:\Program Files\Zen Browser\dependentlibs.list	setup.exe
File created	C:\Program Files\Zen Browser\libEGL.dll	setup.exe
File created	C:\Program Files\Zen Browser\libGLESv2.dll	setup.exe
File created	C:\Program Files\Zen Browser\marshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\notificationserver.dll	setup.exe
File created	C:\Program Files\Zen Browser\onnxruntime.dll	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\manifest.json	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\browser\confused_fox.pdf	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\install.log	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsnA5A5.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.InputStateManager.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Composition.OSSupport.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozglue.dll	setup.exe
File created	C:\Program Files\Zen Browser\softokn3.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png	setup.exe
File opened for modification	C:\Program Files\Zen Browser\AccessibleMarshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\gkcodecs.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.exe	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\helper.exe	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_70.png	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	maintenanceservice_tmp.exe
File created	C:\Program Files\Zen Browser\mozavutil.dll	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\clearkey.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\	setup.exe
File created	C:\Program Files\Zen Browser\msvcp140_atomic_wait.dll	setup.exe
File created	C:\Program Files\Zen Browser\omni.ja	setup.exe
File created	C:\Program Files\Zen Browser\platform.ini	setup.exe
File created	C:\Program Files\Zen Browser\installation_dir_layout\versioned\InstallationDirLayout.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	maintenanceservice_tmp.exe
File created	C:\Program Files\Zen Browser\CoreMessagingXP.dll	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice.exe	setup.exe
File created	C:\Program Files\Zen Browser\nmhproxy.exe	setup.exe
File created	C:\Program Files\Zen Browser\removed-files	setup.exe
File created	C:\Program Files\Zen Browser\browser\blank.pdf	setup.exe
File created	C:\Program Files\Zen Browser\installation_telemetry.json	setup.exe
File created	C:\Program Files\Zen Browser\mozavcodec.dll	setup.exe
File created	C:\Program Files\Zen Browser\zen.exe	setup.exe
File created	C:\Program Files\Zen Browser\dxcompiler.dll	setup.exe
File created	C:\Program Files\Zen Browser\firefox.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.Internal.FrameworkUdk.dll	setup.exe

Executes dropped EXE 23 IoCs

pid	Process
3608	setup.exe
4932	maintenanceservice_installer.exe
2332	maintenanceservice_tmp.exe
3536	default-browser-agent.exe
4648	zen.exe
4444	zen.exe
3140	zen.exe
2092	zen.exe
4208	zen.exe
1412	zen.exe
4356	zen.exe
636	zen.exe
4788	zen.exe
2184	zen.exe
2200	zen.exe
2440	zen.exe
1496	zen.exe
1556	zen.exe
3328	zen.exe
1748	zen.exe
5364	zen.exe
5388	zen.exe
5412	zen.exe

Loads dropped DLL 64 IoCs

pid	Process
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
4948	regsvr32.exe
4948	regsvr32.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
4932	maintenanceservice_installer.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3608	setup.exe
3536	default-browser-agent.exe
3536	default-browser-agent.exe
3536	default-browser-agent.exe
4648	zen.exe
4648	zen.exe
4648	zen.exe
4648	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
4444	zen.exe
3140	zen.exe
3140	zen.exe
3140	zen.exe
3140	zen.exe
2092	zen.exe
2092	zen.exe
2092	zen.exe
2092	zen.exe
2092	zen.exe
2092	zen.exe
2092	zen.exe
2092	zen.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zen.installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Colors	zen.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	zen.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.oga	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.ogv	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.ogg	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ = "ISimpleDOMDocument"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,5"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\SupportedTypes	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.avif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods\ = "8"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.jfif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D89C4372-49A4-4C29-A1B0-481567C4590F}\AppID = "{D89C4372-49A4-4C29-A1B0-481567C4590F}"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\zen.exe\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D89C4372-49A4-4C29-A1B0-481567C4590F}\InProcServer32\ = "C:\\Program Files\\Zen Browser\\notificationserver.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.gif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\CustomActivator = "{D89C4372-49A4-4C29-A1B0-481567C4590F}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.flac	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D89C4372-49A4-4C29-A1B0-481567C4590F}\DllSurrogate	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.shtml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.webm	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\DisplayName = "Zen Browser"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.jpg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.pjp	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\ = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D89C4372-49A4-4C29-A1B0-481567C4590F}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xhtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Interface	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\EditFlags = "2"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\FriendlyTypeName = "Firefox URL"	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2332	maintenanceservice_tmp.exe
2332	maintenanceservice_tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	zen.exe
Token: SeDebugPrivilege	1412	zen.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3608	setup.exe
1412	zen.exe
1412	zen.exe
1412	zen.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	zen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3608	3592	zen.installer.exe	81
PID 3608 wrote to memory of 4948	3608	setup.exe	82
PID 3608 wrote to memory of 4932	3608	setup.exe	84
PID 4932 wrote to memory of 2332	4932	maintenanceservice_installer.exe	85
PID 3608 wrote to memory of 3536	3608	setup.exe	86
PID 3536 wrote to memory of 4648	3536	default-browser-agent.exe	87
PID 4648 wrote to memory of 4444	4648	zen.exe	88
PID 4648 wrote to memory of 4444	4648	zen.exe	88
PID 3608 wrote to memory of 3140	3608	setup.exe	89
PID 3140 wrote to memory of 2092	3140	zen.exe	90
PID 3140 wrote to memory of 2092	3140	zen.exe	90
PID 3608 wrote to memory of 4208	3608	setup.exe	91
PID 4208 wrote to memory of 1412	4208	zen.exe	92
PID 4208 wrote to memory of 1412	4208	zen.exe	92
PID 1412 wrote to memory of 4356	1412	zen.exe	93
PID 1412 wrote to memory of 4356	1412	zen.exe	93
PID 1412 wrote to memory of 4356	1412	zen.exe	93
PID 1412 wrote to memory of 636	1412	zen.exe	94
PID 1412 wrote to memory of 636	1412	zen.exe	94
PID 1412 wrote to memory of 636	1412	zen.exe	94
PID 1412 wrote to memory of 636	1412	zen.exe	94
PID 1412 wrote to memory of 4788	1412	zen.exe	95
PID 1412 wrote to memory of 4788	1412	zen.exe	95
PID 1412 wrote to memory of 4788	1412	zen.exe	95
PID 1412 wrote to memory of 4788	1412	zen.exe	95
PID 1412 wrote to memory of 2184	1412	zen.exe	96
PID 1412 wrote to memory of 2184	1412	zen.exe	96
PID 1412 wrote to memory of 2184	1412	zen.exe	96
PID 1412 wrote to memory of 2200	1412	zen.exe	97
PID 1412 wrote to memory of 2200	1412	zen.exe	97
PID 1412 wrote to memory of 2200	1412	zen.exe	97
PID 1412 wrote to memory of 2200	1412	zen.exe	97
PID 1412 wrote to memory of 2440	1412	zen.exe	98
PID 1412 wrote to memory of 2440	1412	zen.exe	98
PID 1412 wrote to memory of 2440	1412	zen.exe	98
PID 1412 wrote to memory of 2440	1412	zen.exe	98
PID 1412 wrote to memory of 1496	1412	zen.exe	99
PID 1412 wrote to memory of 1496	1412	zen.exe	99
PID 1412 wrote to memory of 1496	1412	zen.exe	99
PID 1412 wrote to memory of 1496	1412	zen.exe	99
PID 1412 wrote to memory of 1556	1412	zen.exe	100
PID 1412 wrote to memory of 1556	1412	zen.exe	100
PID 1412 wrote to memory of 1556	1412	zen.exe	100
PID 1412 wrote to memory of 1556	1412	zen.exe	100
PID 1412 wrote to memory of 3328	1412	zen.exe	101
PID 1412 wrote to memory of 3328	1412	zen.exe	101
PID 1412 wrote to memory of 3328	1412	zen.exe	101
PID 1412 wrote to memory of 3328	1412	zen.exe	101
PID 1412 wrote to memory of 1748	1412	zen.exe	102
PID 1412 wrote to memory of 1748	1412	zen.exe	102
PID 1412 wrote to memory of 1748	1412	zen.exe	102
PID 1412 wrote to memory of 1748	1412	zen.exe	102
PID 1412 wrote to memory of 5364	1412	zen.exe	103
PID 1412 wrote to memory of 5364	1412	zen.exe	103
PID 1412 wrote to memory of 5364	1412	zen.exe	103
PID 1412 wrote to memory of 5364	1412	zen.exe	103
PID 1412 wrote to memory of 5388	1412	zen.exe	104
PID 1412 wrote to memory of 5388	1412	zen.exe	104
PID 1412 wrote to memory of 5388	1412	zen.exe	104
PID 1412 wrote to memory of 5388	1412	zen.exe	104
PID 1412 wrote to memory of 5412	1412	zen.exe	105
PID 1412 wrote to memory of 5412	1412	zen.exe	105
PID 1412 wrote to memory of 5412	1412	zen.exe	105
PID 1412 wrote to memory of 5412	1412	zen.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\zen.installer.exe
"C:\Users\Admin\AppData\Local\Temp\zen.installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\7zS80E42148\setup.exe
  .\setup.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Zen Browser\AccessibleMarshal.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:4948
- - C:\Program Files\Zen Browser\maintenanceservice_installer.exe
    "C:\Program Files\Zen Browser\maintenanceservice_installer.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2332
- - C:\Program Files\Zen Browser\default-browser-agent.exe
    "C:\Program Files\Zen Browser\default-browser-agent.exe" register-task F0DC299D809B9700
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:4444
- - C:\Program Files\Zen Browser\zen.exe
    "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies Control Panel
      PID:2092
- - C:\Program Files\Zen Browser\zen.exe
    "C:\Program Files\Zen Browser\zen.exe" -first-startup
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" -first-startup
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies Control Panel
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260809044209 -prefsHandle 2568:27039 -prefMapHandle 2572:303398 -ipcHandle 2604 -initialChannelId {5a0894d2-0178-4c16-97bb-3d308fb145ae} -parentPid 1412 -appDir "C:\Program Files\Zen Browser\browser" - 1 gpu
        5⤵
        Executes dropped EXE
        
        PID:4356
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260809044209 -prefsHandle 2852:27039 -prefMapHandle 2856:303398 -ipcHandle 2864 -initialChannelId {f7096731-be38-46b8-80c2-1650176f3199} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 2 socket
        5⤵
        Executes dropped EXE
        
        PID:636
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 1816:27139 -prefMapHandle 2040:303398 -jsInitHandle 2044:156236 -parentBuildID 20260809044209 -ipcHandle 2084 -initialChannelId {cb28f4a0-fcfa-4a22-aa5c-5695cac4c925} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 3 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4788
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260809044209 -prefsHandle 3920:27746 -prefMapHandle 3924:303398 -ipcHandle 2044 -initialChannelId {ff4da6e3-32b3-4f40-96ad-21034478f59e} -parentPid 1412 -appDir "C:\Program Files\Zen Browser\browser" - 4 rdd
        5⤵
        Executes dropped EXE
        
        PID:2184
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 2168:27857 -prefMapHandle 1968:303398 -jsInitHandle 2148:156236 -parentBuildID 20260809044209 -ipcHandle 2144 -initialChannelId {89cbbe06-464f-44c8-b31a-cd1a805c9e6a} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 5 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2200
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3796:28207 -prefMapHandle 3800:303398 -jsInitHandle 3784:156236 -parentBuildID 20260809044209 -ipcHandle 3772 -initialChannelId {ff64bc75-000f-42bb-a72b-3beecdb946d3} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 6 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2440
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4656:28207 -prefMapHandle 4660:303398 -jsInitHandle 4664:156236 -parentBuildID 20260809044209 -ipcHandle 4672 -initialChannelId {3b8ffd07-c394-496d-937e-d2a58ad87023} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 7 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1496
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4820:28207 -prefMapHandle 4824:303398 -jsInitHandle 4828:156236 -parentBuildID 20260809044209 -ipcHandle 4836 -initialChannelId {e57aeb39-1512-4fe0-86e0-b8dfc019cb8b} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 8 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1556
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5236:31155 -prefMapHandle 5240:303398 -jsInitHandle 5244:156236 -parentBuildID 20260809044209 -ipcHandle 5252 -initialChannelId {922d4c3c-f1db-4297-8121-b06f678f9a7b} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 9 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3328
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260809044209 -sandboxingKind 0 -prefsHandle 6108:45580 -prefMapHandle 6112:303398 -ipcHandle 6092 -initialChannelId {b6c0a75b-886c-4c9d-88f0-7d5dcc81f1ed} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 10 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1748
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5868:43996 -prefMapHandle 5640:303398 -jsInitHandle 6404:156236 -parentBuildID 20260809044209 -ipcHandle 5984 -initialChannelId {5f15eca9-a91c-4623-8767-1129cfe5536d} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 11 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5364
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 2196:43996 -prefMapHandle 5572:303398 -jsInitHandle 2276:156236 -parentBuildID 20260809044209 -ipcHandle 6072 -initialChannelId {a66de0ef-33a3-41ae-aed1-cdcef6e30142} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 12 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5388
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6596:43996 -prefMapHandle 6600:303398 -jsInitHandle 6604:156236 -parentBuildID 20260809044209 -ipcHandle 5572 -initialChannelId {822dbb8a-cc53-49d6-a8e8-77bd0a81b3f3} -parentPid 1412 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 13 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shortcuts_log.ini

Path C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini
Size 198B
SHA256 5fbda59442223c5d2fc4779c116f314fc4ee448ab786e102f570aa5de4336cbc
MD5 c18e70154afa4c346b4a5f28ca9a5664
SHA1 1c71628ac2c1609c57db351a2127e16834947173
SHA512 476971174289ce8dc076deb5bbfcdd21d0e55f3dd7ebe635702a2b9d5c4c671713e06c0185f157ab731f7b0c3400e866ad850d7c4990e70ec9624112c5cca3f6
TLSH
T1A6D0023206D60229AE465F81EDE84179DFA6F959609DCB0CF082161E1DF4440C9925F7
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 ad2419408eeef5f6b02bc304cdf8755e9cc94052b8459fc5022c3e972772c7bb
MD5 1e60bb8bedd33906e832340f78187be7
SHA1 f80c8e98667f5d2a435d1a575c7d10b1c44b2c7f
SHA512 2676984897b0bb34e3247ba24931ce862e44e6e944997c264cfd6d35c198dcbc20d525f22e2f99c12495dbca6b3d2879db50736797d18f3f855cc63520c4a920
TLSH
T187416D1147E69239F2B75E3282B23E314277FCC1A778C66E828DC2D80575130C5ADBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 d0ecd967665c804ca1eaf60022bc54d8c0e1bcdba8b0725fde61c7c17392310b
MD5 0d8d98968f01ea0b61b95bbcdb08acd1
SHA1 36b6f0c2bb2856615d94c316f7828e416a293edf
SHA512 7e534674d95e5ab794c05bc68c760614e74be209ecaa1e6d1c36b00e86d5c680cae3294d91d08c89833a31067a7cab195e3b5478525d7c844704078667b17dd2
TLSH
T1C5312B1143E69335F2B35E3281723E304277FC819B69866E828D81D54575124C5ADBBF
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 922B
SHA256 bc140a7d44f3fed35284806254196712671ad6af85f21b7c222077cfd7b87663
MD5 4a3ef1e5bc73952e276c19111b0f73f8
SHA1 ed14902ea63872522badf5455498bf80fab59c6f
SHA512 fea0a8c9c37edba9e6ea4a0d6e747a3069b4a88c6a5874f415d70e20bd64eb43d2f6e9972fe492ce25011946951c2d4c8c3133d8eccb48c45477c3c6972f39df
TLSH
T165116D1147E35736F6778B7245B22A31833BFC46CBBC5B2E928851A449B5110C86DFBE
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 1020B
SHA256 e3024a6189daacab4df5c5ee142009039d6109c6a7db8ce59468a31f29c2669c
MD5 e699399b9750fa67ee58620527b84a01
SHA1 d74fd1d3d6da4c316f5c92a5ac4ad1f76b034614
SHA512 5eb24aafd146a3d7b50a947ef3e77241f991475bff09b520f8092f0b7c5d7f9f8ab9158cfb40bffaca10678246e6cbe93fb83d508c9eebc149c48b29d1401429
TLSH
T153118C1147E79736F2778A7245F12A32823BBC42D7BC5B3D828852A449B5110C86DFBE
MD5 SHA1 SHA512 TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\F0DC299D809B9700\update-config.json
Size 78B
SHA256 3f7b3252ef3b6217ad78adb7007738601ce1eebca69f55990b64bf254bd4fc63
MD5 fe74f5c38f433736ee7015868cfb159e
SHA1 f723b0032565fb3007407201963f7bb762bdd981
SHA512 19fe20baff40c195955a921ee2fe1927d00da14e0ed3eb683e5f6f026353bfcd5322a1d2399b8977bdf97bb23dfd6cc811c9a9494f019b6e404aff477316cafd
TLSH
T1EBA011800000A2A8B0E888CC00302A3E02888028008B2A02800A30A0383A0020A0A8BA
MD5 SHA1 SHA512 TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\AccessibleMarshal.dll
Size 30KB
SHA256 e961924ffa127cf30a68cfa09581588e5f36d731c5a8cfbec498e5fff79931cc
MD5 73403e620388d709766ef29ad9a1c3fa
SHA1 62b9ad410ae9ac6c608c0b7ed9d01e02751c532b
SHA512 ae7aa8985311cd71cd5edb815d952bd00f28ab9c64f89f0d716a63edce7c66d469ebea547ffb899c77074426b6e3cdd5e3f81d2929c165351264632270ad07ee
SSDEEP 384:i9MSlCaZ8nvlfiGeUMc25VY7u46dWl2mNDsSofousJUKURFshE/MSI64:eCaZ8vMGeq2wiVsheSoQuoa20Mv
TLSH
T1EBD2D555FE00C4A6E81D853088DF8AAA5E71FE019F9247C73255332E1E737C52F366A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\CoreMessagingXP.dll
Size 1018KB
SHA256 f1975d1c470027b070abfaa9f518ee3257ef63b5bc47e99dfe91e8f02d63e48a
MD5 a8440d3afd091996b9791c4e6ded9a9a
SHA1 fa733233780a8ce9920cea80644bc5a208f47235
SHA512 e5f51c9ef7c4f9eb7cf7d32fa740401c622b24afdfc91a0c49448197ffd45ef2203dc0c04dda37eb848d59cf8ab207c7e64ef1933dbe54692812da35c412c920
SSDEEP 12288:Ptl2DdkYB2Zme5NY1RZq3SzFJeb8HzroHCpstWcLObI6DPsb8UsAf+:bgdP4meM1Rlwb839pwWrDlUs8+
TLSH
T1FC252C6F6FA84097D17AC27E85BB8A8AF2F1B8531B3187CB0451426D3F27BE45979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\InstallationDirLayout.dll
Size 19KB
SHA256 24736b9cb5d40f61aaeef8233b54f1f38eb1901b75109f3483f2d3e5b9376fbe
MD5 e74fbe0488d41e96642e142612954458
SHA1 c11d9134c5cea265be4c8bf3fefe049ac2fbd72d
SHA512 19050c54845010d9c99ccc8d5c10f8db9419bf4a1fd6d8558551788daa5e744709908fac44638bb60487e865e71b06c49bc11a279637611829e4c86549e29d8e
SSDEEP 384:KNmCCN3LNn2dxkEvu46dWl2mNDsSofousJUKURFcgnelASMHY7xw:ojwtzFVsheSoQuoadelAnYtw
TLSH
T157928E9AAF6054DAF9178A7089E94A1BAD72FB405B8145CF6218008D1F937F93F3933C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\Microsoft.InputStateManager.dll
Size 446KB
SHA256 975593db6650bd8e83047c02e5f2ff7b5b84a1fb64660048034aa275b3d68d9c
MD5 45e8e89e72d898a6928ebfc7882005ac
SHA1 e186ccfc0cd49edffd6cff558041a3217f95ae38
SHA512 1b4d75a4bcd75225b29dadc8b226a5c65f7273944520d68fdeacfd970b31f212169fa0b49eaef15fe58fcbd606ef3f1d2438e4c325496bdf7a0ee36fc052566c
SSDEEP 12288:mCfOXk5FPwj04LiaHVnZWz10AmzdTVCKG:rBMLTVnZPG
TLSH
T11AA44A7BEBA844A0D136D23C85A78A07F6B2745507329BCB42A0926D1F37FE46D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\Microsoft.Internal.FrameworkUdk.dll
Size 910KB
SHA256 0e3557a6e38dd09e535b8d8d62c010bb003d5d1597a9cac4c36c88eea053302a
MD5 fb4c5baf85e4585506fd738c3a75be1a
SHA1 5bb559bf52c682dd2e5cb882f16d6f8c365f80c6
SHA512 71c50f51fc235dad390c5b8899e10dc842c2e96597f846364c2c0646fe39dba4074746203ba2d46fe1676d3d76ac3228d9a2725a01cbb87e10cafe257229d5c3
SSDEEP 6144:jq2pdSEZxDjmUlfp04mtVkookZea4u2IUWB8Yi+c0p20GHs667I7IK/ECQ23YRgZ:dWYdjm9VkookZ4TT+cHH6OIK1yeZ
TLSH
T16215741BEE6991E0C4BAD03D9192622FF8B170A68B7057C3D6515A1F1F32FE4A93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\Microsoft.UI.Composition.OSSupport.dll
Size 66KB
SHA256 d9c923ff481364f89ece8597dee7b223e1dc7b1fbe768a0ab8150f16acc5820b
MD5 b041ee2b18f46f3b8b3e625004b4424c
SHA1 ef2e79e721ce36b62263deeea0a85eeea4ca73fe
SHA512 06a989aac989f7229a02ae1cee2554e40e8976c2c1d9dc7c6f4748b92f7b8612a9d0247920c7a6a26f059664128804b1bf8b2f708a5bffd3c9444ef5c6908935
SSDEEP 1536:vcum2n7hIpk5Bsshnj9gQFPS47L6kL7oh:vcuThIpkDfg+L6kfoh
TLSH
T151636C596A8830FAF536413CC4964E18D9B1B26163405BEF0364C2BE2F93BD9763EBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\Microsoft.UI.Input.dll
Size 1.5MB
SHA256 a260b08b8ae757cd4088d4147e892ca425e0ab05ba190f69c1885b3c81e53ed7
MD5 6f54adb0bd0a84d7c7fcfc943870309a
SHA1 37a92dd1933a99eb63b38ec1d1a87928f7a25e4a
SHA512 196aac79078bcc27dfdda10057fba0058ff9f648bebf1880de9279143bae8e3be69a028a6d069321bf1e97e885a29d0ea1a7ef3693203b78454fda3949e758cf
SSDEEP 24576:uB6TePxZNKmKI9tp/jLNXoqWnbvxtXypL:uAaMmFp//sndtXcL
TLSH
T111752A2BAFE881A6D331A23DC0974E4AF2B174421B7166EB0165412E5F3BBF45D3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 0f6d7a8ec1daa489bc133c38aa7e86d04c94715a655faa5fc48fcc9bf898655c
MD5 dfc7d52c9927e655cbbf96de81de0ab4
SHA1 9236437a92c13833525994ff482e5f2aaccace72
SHA512 d80f5fb6890462d07256b6a6dac61a08b84fc25953e535f377fa9c9923d2b5f7778c66d577108af6ece64dfefa33014268785fccf09eb6de9b6350e0e7918917
SSDEEP 6144:ds4jY1PnSzURJG9m3+v6Vtcu5/gm0qV1OU4IkhNFSDm/RuZ2QlXgS:eSY1PSw+5CcuOm0q/OUhUNKm/RuuS
TLSH
T120B44D6F6BA84492E22AA13DD5978B0AF6F174125732CBCB0111D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\Microsoft.UI.Windowing.dll
Size 538KB
SHA256 346893a6cfd45be633c42cafc848b6877d4249c01743678abb3d430f72d93c4f
MD5 27e79d93b000a4c263764865a29d1406
SHA1 1db4a7ec40641d55993ae39b1e98ee567f37e049
SHA512 2dc85d4463b7cfda1fde274370c63fb6047f11ebecd97e1c7ee1f61f2cd96dc93baa84a6c025f1036e8edb5d139ed48055749ed3fe28a7f703c96e75174f19c5
SSDEEP 6144:IlLJdDCMslOzqjXsvPueIP7mNq6CIRPDoxSTHXapklto2UInrMRAc6egI:6LJdDCrkqj3eIKFC6DokjaaBjcwI
TLSH
T11FC43B7EBBA44696D12A813DC6AB4F06F3F0B8515731DBCB4161823D9F27BE8593A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\application.ini
Size 637B
SHA256 e433fd4a76fa7c0cda7b9b6a6f4a56b56835f0252dae55cc9e686924e8c59c23
MD5 f455e847f2c21c2fcd868a16c42e912c
SHA1 6eb2ecc8b5cf1e7fd88664266f8e52277354e3cc
SHA512 2ffd7bb929edcda962fb0cd8b67b45d9af48ef160099189ca3c7f37e688c2440a7a754a592fc50fd4868fcbb53b021aec478b7c67b6010f89af1038f72907f61
TLSH
T1A9F0DDD70308B4FD8EF335BA60009AD143330918A8D7342C205A5008161A32F2B9DBA9
MD5 SHA1 SHA512 TLSH

Submit Download

PrivateBrowsing_150.png

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\browser\VisualElements\PrivateBrowsing_150.png
Size 9KB
SHA256 2ee22aa49d12fa9146274dc5a03793fc45bb632bb341799542516fb17c142371
MD5 2b47f5fa099f97fb4b7d1a88aa494541
SHA1 eaaf09c44abcf6f7495224a3a3d8e651afe59403
SHA512 4e4e03b804c64085e701055f9b741f99b4715807682a7141eca184a6ad03fb7626c9ae6e9f74a6dd54d717330b154a68193e52cb97f66bd232f788c77ad01e9f
SSDEEP 192:379hCymCdj+pGzVoFkPc8Y1F266DMQdcv+mwI4NNR92uITz5s:r9sojPHQFVJ3wLH92uITz5s
TLSH
T19412BF20F215CF2E91743884A4CAC6C5D23B7217F7C02074482FA4FB1C2EF152AB5AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateBrowsing_70.png

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\browser\VisualElements\PrivateBrowsing_70.png
Size 4KB
SHA256 c348fb831e245763f6c1ca74e769599daf4b88d6b2487144a5a8a58c7172d9e5
MD5 f938a334dac97a3b99e020a4fd45e39c
SHA1 b476456542430be300a48bed22dd0b3c496b9920
SHA512 d2f490a4bae244ded37dd6270f01a24e461cc2df2852834133b7a38db7b3f46221fbccc8d66b33eb2237803174f7e68a7b65d28eaea759f990ead3a203674b67
SSDEEP 96:fqPxsxciKQQsIBEzEZXhaOec0AGHL5lYRTBXWAhh3+KW789+q5:fqJsxXQsIK+XhYc0AGHLSWArBSc+q5
TLSH
T1EB919EF983A10CEFBB40289FBB26A67DDC470D7590063234BEC155E32675A9E09E5251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VisualElements_150.png

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\browser\VisualElements\VisualElements_150.png
Size 102KB
SHA256 68e5025e6835c0142272276dba9a3f2ad8cbe6f6ad8c425882befd3146a9f7f7
MD5 a0ce9ccbf2dbdb3a3d2e044e0f74bc7a
SHA1 88cbe63c90dcbb5c9abdb48a983c4f153513f8b1
SHA512 6f7556d3622868599dd8f3dccbbef21fcd3c9a71349327f2474159a7131d563b176f940882a1c19d3cdbede983bcc436a7f61b50a7495a0a553c6d95e77ee10a
SSDEEP 1536:XqShEeITCdH1Xxi+BmgdUMhh3le4HQtOfRuWaGOaOK3Yf8QKaqaZAtyaiWNy:as5ITAVhXBHTaOVFOaOKjQrqaoyau
TLSH
T16FA3129A941BC481CC5E19B2486EE06865BF95C752264AB4D03C7CEAFCB917CC186D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\browser\blank.pdf
Size 8KB
SHA256 81a4b1da9df2cfe8f229abb939591b708e2a6ab7d4bc58d411ddb471d0dc3964
MD5 0a98a0712d09cec3945c0728b0c7c465
SHA1 f4e62cbdc0afd816e24929c2a6e71e63072c4b32
SHA512 02619d47e399fe4ccd8138d58f68acd9d692fa61a59d43ed5bd97f709916c4de781f83aa32c9404030887afd55467aa2fbf9ab086fa8ed858d3aeb562da6ee0b
SSDEEP 192:KCYALPEyUKCIoYxrfJeHrJhnAynX/fCQCwQwJsqYmMNVoDVoCow4YePa/TY61/:WUP8KCIXxrOjAynX3hCwTLbMNmZLPeiN
TLSH
T1B9027B34E99F5C5CFA94CA1BD276B70D8E99B10F6FD8349241310F52F080971EB6A2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

confused_fox.pdf

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\browser\confused_fox.pdf
Size 51KB
SHA256 e2916092e9764860829db21b78ab0fbfbb22f976687e65716ba7dbc16e954ce8
MD5 10aaade034c04af93ad3c805642e5b0e
SHA1 a6e98403bba37c9e87c632e4a8662284a9098e3b
SHA512 9b9621dcc753e8d7b545fa225b2c3504bb8606bcb4b5bc8dce4844cac7f82722bb3882ed8170adb7ef737460b07aa1b078c0ed820ed9d22e19b39038f3c157d1
SSDEEP 384:4c7vp5LOr9QrOjRzYOv06lPBP2R7uJS9lEWHEugiGB2LtlC:17XWRH1J5DSX/HEugr2O
TLSH
T1513363F291801999F401CD789F9F3D9C109E30ABEED98DDA74FCE711AF228A429E51C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\default-browser-agent.exe
Size 31KB
SHA256 5482b0861176bb51b08c8fae9453ef2505215bcc7bdd5838a3b3b35df8cd6312
MD5 068bc0f092d53dd921dd5ec007b258f7
SHA1 e37e5f6f1c902f92b5eb22c1a4722d8f266d363c
SHA512 9c82966e561e3069f3a91e3744dc1ad81edecf3db2176f840b3834c403de0fd264ac5f183be5e47e34cea6ab694e493212588453fd2aec0bf9db61f12622710e
SSDEEP 384:5XkMYYD/cYIwnMQrNlZpggBzkwKIOXuWTkWy2gMO2Qu46dWl2mNDsSofousJUKUt:5skVVvZpZBwlHpIHYVsheSoQuoaVU1I
TLSH
T167E27C66DF9040F5FC16D13502A49227AE72FB415F6352CBBB96026C2F21BE05F3A399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-prefs.js

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
TLSH
T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
MD5 SHA1 SHA512 TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\dependentlibs.list
Size 67B
SHA256 c50ddbad2bb7ebdf2ec6643fc2e7744adf3870c5744e80ba3665cbdd3e9c559d
MD5 1992be27df8264e37bfe5ab87209000b
SHA1 8ac394c7b9193cbfdff35ea29d731d5481a0ac58
SHA512 0a8515b65e35396db0a3bea1b543aaa95c25b3228cadc66707d4c940b80158bda9c277753df22efcf50233fbaf2174cbadc152e0fd6d43175da0115222c7b272
TLSH
T19DA00292006F91236685EDE1684DC90C801D6156DC9101D05667260E16269C04BD45AD
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\dxcompiler.dll
Size 23.2MB
SHA256 cae3599da18d32fc905363f5679abbd214f71943e5ebaff1adde062461c5d10d
MD5 16cd23ebffa55eaa0c7d70eddd5009b1
SHA1 5e55cf349ed0c48637bd72007ff334f2b85a4642
SHA512 8ba652a560ca0f64ab2ef606f4366ab1ad925fff9de003bbf0673d1f999b32ad550263a7d8da010f32799edfdf07392e7063f57e73c2c2009f34858281930341
SSDEEP 196608:ZLn8gE6byTF5lWua5oiVfMn6puhDpn5yeKr0+:ZL8v6+TFvWuanOXh1KZ
TLSH
T1EB374C123686946DC05AC878C3574B279A2870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 dded8c3942e2d8eca65838e55379b1da5765c2dd6183dd5c3530c9976cb25a86
MD5 613815852a622ff9e54d697b9b3d2862
SHA1 a49149260f4e6d09412ce09d5847f15be65f527b
SHA512 64993969eccb8f75496b11cecab6f351a3ac659d8d6906cda2bfec8684b2d0d253f4c1bc23eefbec388939dc9ad0e898bec0a8f3e03c78d1b9c73d714fa5feb3
TLSH
T112F0C0DCB158130016CA6A556113528FB10F11FB46D501DEB0ED80381B8AB4C491EBCC
MD5 SHA1 SHA512 TLSH

Submit Download

TwemojiMozilla.ttf

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\fonts\TwemojiMozilla.ttf
Size 1.4MB
SHA256 6d90152ee0d29e82fe2a87793af5aa4b7ad13e6538360889e141e81ed299ee8e
MD5 aac75d901445bc0419d56e56dbc18891
SHA1 3ada434f3a727167ce6dce3b865fa6bfb70ed86f
SHA512 83fd92ff444ab6de18d48997247f49845abb8420a07b74ebc8a65bda8da69d28f87b6abe0f607b2fd7da398dc0f8cbe7fbf655af6d25785ad8b2f1a3afca136a
SSDEEP 24576:jUx1tOjzy675RUa0cHib00er/4TMXvBo2IvyCPKsUxJug7WwObnkBl0Z1koEXdwV:CeIa3iurjIExYrdz
TLSH
T1EF656C3FA704CBEEF4951AF6C9640A27B5D08D8522021287F74DF87F8C9D3985897A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\freebl3.dll
Size 1.2MB
SHA256 03b77c414f27e94925310a0f7a1b06cbcb02e4bb40a79c401f01cc46b9ff2378
MD5 e74e5000e6ae98ffe0e0df96727da5f6
SHA1 8c385c235babd5ad7443804aebd32b807b0c8969
SHA512 c7783c1b3fe0ee8609b0082626c1a5442fba2cae2a8ec8b4c87cddef38dcf656418a39eec995f026ba451ac04b4346bf5679f366204656da8f94025630c6505d
SSDEEP 24576:H1m82H/nJ99XunnnZnnV8sBkfmRfUUxvfUI0vXJMMha59Z+UMo+hBA6:Vm82H/nJ99XunnnZnnVPafmuI0x9wLMj
TLSH
T132456D0BF2B647E0D067CD7C1396B623FA253C5D4B5136D357C886213AA1BD4B21AF8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\gkcodecs.dll
Size 10.4MB
SHA256 fc39239db06f03e5bfe84fec2a782274db6522710aaa6b57a81af9be30b7cfca
MD5 3b15b93241a2caca3cd4c5bc19aa8e0d
SHA1 20a1217cb48f0a752145169d9d27acde3116e5c6
SHA512 16b0cfc69c50eb02ffe105ef6b4873028dd1d0203b1f53937d8ee1dc5f5a19c90ca34a19a59b2d7064493baf1379788d8f6f22c0c45bf30f2c5a5abd265cf147
SSDEEP 98304:X+resjEk6GdCwxnjZ+kMhyjuCxJTNPuBNncTh9jE+O2h/rmuBp5tmOacv6+obQT0:gesjew1jZtPxwIvO2h/qOp58QKRR8oN
TLSH
T106B67D4EF1A351A4D41BCCB4527DEB12BD18389EC71856EB77DA16243AB37C0AB29F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clearkey.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\gmp-clearkey\0.1\clearkey.dll
Size 111KB
SHA256 cf005613585f47c2abdeb09310cc0ec7b901692687efc8b9d39b0dc314df9cab
MD5 568ed6bc02fde425ab9f58d6f5a46e71
SHA1 e525a173d5601d524e2358f86701af78288e0730
SHA512 2cfc1b8f954e292ee5a290705569891c88617f49b9757c1d11e5a07628eeaacc5255a62a3e30b331b0251ee98d72852e5eb5e64d78658f836a363e1080b9c83a
SSDEEP 1536:4WJrMVylNEDcSt6UpbMud6R/7+64Y8JwGwQxMQ6kL7oD:4CAXcI4H/iTYC3wQxMQ6kfoD
TLSH
T1DCB33A13EA9A90BFD649D97882475812DF23BC864B5276CF53510EDA1FA6BE46F3C300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\gmp-clearkey\0.1\manifest.json
Size 229B
SHA256 ef47e83036753b53f59d079fef62bfedc749abdbcdb0fe16f448d9920f11114c
MD5 cffdadfaeeaaf0a5a78e7f9a299aa7f1
SHA1 7a8f06d7c91877484301ce8474dfbb1bde08a040
SHA512 5a11e448389326ddbd3be792d9a10ae746c66e4a41f9c96f4979ec71fde385fc4deb205a40f1b4f24415abd9d41c453ca1285f4b813005b1d12a2701f214db85
TLSH
T100D09214C812DEF33CECA2295D554D5867A9129B19823C847B08174EDF599BF92AAB0C
MD5 SHA1 SHA512 TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\installation_dir_layout\versioned\InstallationDirLayout.dll
Size 19KB
SHA256 840009ae6c493123f7759e126c3c9843f3710697628b48b58178fb596ecd1f9f
MD5 360167708287d8daa8c14c76b58c3b05
SHA1 644e0f93fffdfb1aac9863b8cc9504bfd715f6f6
SHA512 980e7805e6020491cc11ab903b07369f248bf4d4037025ea30e83589a152c70675859e31167ab65374bb51fafbe470a3a01bfdddd3f83c00b4377d9cfba72ab8
SSDEEP 384:+NmCCN3LNn2dxk9u46dWl2mNDsSofousJUKURFglZysIS6o:0jwtzoVsheSoQuoaSZysIs
TLSH
T1E9927DAAAF2054EAF9178A30C5ED491B6D72FB905B9141CB6219009D1F933F83F3936D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\lgpllibs.dll
Size 161KB
SHA256 c3b6846b89ba7c80ec061423038b402c8020a0b0ea273b1766ef696c1518e1ab
MD5 8125de04d840ad9a126f2eab2d445f75
SHA1 0f7653b5f0569196a690a1ff00b4105c0957790d
SHA512 5ff8bd23dff89bcd9a9bebddb9f0b254891cc6495b61fd9cdd05ff5bbb534617ec2c74f0595ff4cfdf9db6f27d5f72bcf770fc32bf63c4be3d07fd04e16eed84
SSDEEP 3072:6taNMj4r08U8SO2HegDHYvME5GabbNNV+urBnr3S6q93EduDoxWQnmR6kfoz:6tOMj4r0Id2He3T1NV+mBnr3S6q90dus
TLSH
T189F37D25DE44886AD43A8C748DA38A179B7E7C8007551ECB5BC45E9A1F1BBD06BFB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\libEGL.dll
Size 57KB
SHA256 af912f8b21b8e9220a236e9ba4d7ee3af69a787e41bc8c14b4a78e0f0e49372d
MD5 b4d715893dc0cf5fc94c45632bd545ba
SHA1 5772fd4f1e6933d6cb3395a3109be668d438633c
SHA512 2f5c0491d88d8d87d46bd47e419cba523c106a842d58e06aea4c8237d2246fcc9330d5552aba9d7891f246cd5401b0adaaa96a98c9f1ef69b0532b73fafa9234
SSDEEP 768:3eZczvPW2iggs5a5r8tsQWRalBTx56nvcERWp4zVsheSoQuoal8mfF:uIe2igZ5a5ZfRavx56njRW6z6kL7oQF
TLSH
T15B430A3ACD6AA237DA0D8EB4C9A30C16EDA1BDD58BA274CF67140DE50C54BD86B7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\libGLESv2.dll
Size 4.9MB
SHA256 5b6d5e5a175256ee8e2d78307b870d57cbdb3088950336bce7653f3edf8e49ba
MD5 0fa71f8f29e9bb75ad6a0ebf82707b2c
SHA1 6d849dba5f636f2301480a20a895ca0ff19f7f53
SHA512 ecafb511774ab088de7d32daf8c192d4a57bc70ae9d18530025f7f14d699f197f1d58b02bf496b1d609ebe1b65ed1671fa016bbc25e8663dce848adf1ebf82de
SSDEEP 49152:mI7SJUFFnb8xIuuUOlcrGS3x+wqkNz+xfnxNTgrkMgjPEbCWYCkgrb2Mekq8msqk:mI5ecRF6A5TAbCabhHsu
TLSH
T130365B07F6A140A9C40DD279975B9623F636B889071173CF269883363FA7BE06BBD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\maintenanceservice.exe
Size 267KB
SHA256 7dedaf9d905b33c86c9671e1367207bbed020d9cea469f6991de674c87995814
MD5 3bb298a02fa7e38e55f03bed6f418b58
SHA1 b2ad2cfc0bb928b5e7b695125b238d4d849da469
SHA512 cff5bb84909f5785b9bfecb2b0c31c80b085c3cb2153d089d1dd5f42f91ad3273157bc74fdb8e379c99d320a7c082becef5ec3fddf113a8d02cfe69f27011cc6
SSDEEP 6144:SEA62mlrSUV2TUaSlr9/U+SJZCfJ4wj5CLfqFgR:HT2mlrFV2+9/U+GZBUofq6R
TLSH
T102448E2977A409F9ED67C23CCDF28516EA72B8514360EBDB03A489261F237D05E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\maintenanceservice_installer.exe
Size 181KB
SHA256 f7d1796f66c7eaa75401b98f35af0077e1a94ff02925639188dee9995e166693
MD5 a71ef0953d4f132481122912cd4dd0db
SHA1 21940e92290c87f42a06bd085f033c489dd356c8
SHA512 d0766b26f0ea013b591281feb49013dff20437178f523357428178c3297caf55b204bdd6112898e80b33280112c6f6b44be4842a669d0cf3a0d073e4957629bd
SSDEEP 3072:ANRCywDw1DiJkuKUNRD5bkm3Tem7y6tuU/RDObU7y4jem7y6tT6kfoE:AT4DteUjD55j9oU5DOY7y4j9JgE
TLSH
T1A5046D01BBE0D5A2F9B20A303CB6DB365F31FC666E90874B6350735CED72391A92535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\marshal.dll
Size 498KB
SHA256 6f45e7486aacdec02a54f0598071fe74802d1091d2db9230818c11e433932e1d
MD5 1ab9e56d6488e030a846f4a8780c7ef5
SHA1 5de5089764f72d342ef3accb9c339b1e313b4a6a
SHA512 b577ae7f524ab297946518123671ac7cf3893531144d04c2c890b525dff4ee8704f09ce8690d4fa4ff95b690f9d4c7f4223264bd3bdbfb0583c5f40c5a23fb57
SSDEEP 12288:KQFOnIXiS/m+7FpMenWosalm9r/0jX/L/yHA:KfIx/maFpMValm9wD/yg
TLSH
T166B4068F616104A3C57F5378B95F474EDBB1BA1103509BCF026072A99F5FBE42C7AA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\mozavcodec.dll
Size 3.8MB
SHA256 7f83064c46c66fbb3bbf1f65f199cc158529a4b66f4a242439db1ac4ca6df457
MD5 2f09d190e8fb26771b23a8b8ad8861e9
SHA1 8e7b1a5a3726c6be85bb9704a7e1893d39a11c6c
SHA512 f0ee8438adbcbe9eebe499cab45677864549a2bce5fa253bbda01f609dcae6e8ac4f995cea57e008c04fa27612acce37425582084a6c02b77ef8653a52ca8de9
SSDEEP 49152:pfjgPUnOhYjyStoC26ags+B+WWO2sARtvSV6x0fY94S487HWYScIAZGf6ca6sd1M:pQzStJags+B+WN2sAX46xj94wWQ6gW
TLSH
T1B106AF4EF0A34195C50BC9B493BBE727F924345DA71475E71B8782247AA2BC0AF3AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\mozavutil.dll
Size 595KB
SHA256 5be6a0f387d2fee639166ae17029046c2f315bbec9336a031f72796c9404cdf0
MD5 3f13b1b3f92f3b76279a2e26a8df7e8b
SHA1 91115ee6540487953cb977ed9705aa2f9d39aae8
SHA512 7af36dec48d3cd4bb9c882e36935b43c05e3be75b28bd3bfc2070516ad8c32d4adc7cd5847762ac9864b05dbd62f2416072883b8ad27c276674900461331b7fd
SSDEEP 12288:K8EJrdb0Ud2Fnc82jcI+t38VvzUs2NJgWH:KBrd0UhBjju3Uvp2EU
TLSH
T17DD45B16D5C2082FC4068575839F5969F3763442CB94BAEF379205283F28BE17E7AE36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\mozglue.dll
Size 726KB
SHA256 7cead02a0671edaf58d3d356c602670e465246cf63339401fc70fa524a53e4fb
MD5 b8b8673e181f10ca102530e071f78e44
SHA1 05e4d72f73c20009a07d8b7058b1d16601e4c22f
SHA512 2228cab2fdb17f572c2c6225751366ed603461543ad47165d5ed242b93f6b1d221d034b66a58162915157527d782f8c608437ba09df8993a5da1c6d41f40e0de
SSDEEP 12288:ma9rE830fmFpdm3KK/6aehjK//B7T7EQQXqSFRmOd4AvTYVL:p9w85pdm3Kw6aAK//BjEQQXqSFRp4AvO
TLSH
T118F48B13F68A41F9E058D539979BD523FA7278450724B9CF0790162A2FAAFE0B73E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\mozinference.dll
Size 2.2MB
SHA256 f7940bb3b25775abc2ea49973ffe4922fae1bc33fe1a2d59399efbbb0ff4ba59
MD5 960a8b43963d65a32470291dad1bdbd4
SHA1 29538eb1c9f58c6ff42d3a6be5162275f039bcd0
SHA512 4de4ad4fb613894df174523065c122b11ee7b8241ecd639fd2c0fcb1ea45a4545ad7d04d95e07ed93daed431cfde0903f5ee5d31752b4c45051e4009b3d0f7ab
SSDEEP 49152:pseL+D+gnzxJOUUTr/P6LM00b6Cyy/clAEj:OP1UTTQymfyUlj
TLSH
T1F8B55927FAA081A8C09AD0794B49D673B635B88C872539DB2F544B513F75FE02E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\msvcp140.dll
Size 530KB
SHA256 2692d179645d402827482fb23c0d45330c81a506d8ae82a8e3d778d74bb52e85
MD5 64ad4dec5aa3b17888840475fdd4a100
SHA1 cb0f1dced1146f6ffec922d9a366642323271d88
SHA512 e54dc38ed6d60aee816e3b199d39dce4ceff1464cef3f1cc85dc660dbf7cab516df24ac5a795cf99347bc242eccb677a82474d367802daee12e7aed4b4078a7a
SSDEEP 12288:+0MrE03u1mHWV/I3z+bQEKZm+jWodEEV770:+0p1F/IiQEKZm+jWodEEN70
TLSH
T160C41A23F75906B0E195E3B8A1838302D7F1BC598322E3C752EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\msvcp140_atomic_wait.dll
Size 37KB
SHA256 13fd1aaa83960efdb409f319e0b8aac53620d045fee3708cf080486f923268de
MD5 00789e9de8866ff450f14454e78f3b35
SHA1 ea6037bd3177a13c813ee7f031c75cd770b21d95
SHA512 edbe6a7bc80fda89da39ede188162a2e991a146e002167662b73f875067b1af3ab02466c71ec8e39af888de701ca77c7f85642c479b632e03ae4a4649200ef21
SSDEEP 768:5PMo5RIqKYwIgMhpLDQl4wFbZVsheSoQuoamfks5b:GOR+tMhNQl4wxZ6kL7oPJ
TLSH
T13A037D19BB5814E1F5568735C4EA122FD6B2B6E08760CBCF2225458E0F93BE17F34B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\nmhproxy.exe
Size 642KB
SHA256 49827b3cd3aa6cbe9145836085496a13437c469c31c967dcf3225f55753ffd90
MD5 bc048f27850da9842874a069cb8f63f7
SHA1 ceb0e56e42b0c39f44c56eea231def15a1a42c15
SHA512 2a424f227102bc5d949b2cf84ad3d8b088a39f29c06fdd087facb597ee4fcc32e63f243f8618e9cd146771d7617dbba3b9bbb891353412668376bf4f62ab4bd7
SSDEEP 6144:IflV66kwdUe/3jePmnh6OCZI4qb1t5STcA8QkxGQNEZcfQRD25ANzzpAQFZ1868q:mlV66Xvr4DgmrkxhNQ+QRTNfFH7
TLSH
T14DE44B13F64689DCDA1AC07D871682326633B4994B3169FB21886F3C3E67ED61E7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\notificationserver.dll
Size 59KB
SHA256 a089ba9f89d1a0ae1a3bab326e9977d32cb05a2fa2586731c327d87b9c9b7a48
MD5 7e6f7263373d0ef3cc970f1e5eeaa188
SHA1 f589680e5f4bfc0d68a03d8895bf2d54b8e65782
SHA512 52b8b5f7f1977f244a7721a8f2ec257440b8da9349a02dc16ad441b1d4056f8251affe98e479f11e7376439d2cd66bcb533166d41da4ea78b3c318f4f4d1a083
SSDEEP 768:A05g6Scl1JYOyhztyYgTKSCqGEmrIOvvEraGirPvtyDDJFbLSb0zVsheSoQuoail:J5YcPsxgTKMGENOvGaTPiWb0z6kL7obJ
TLSH
T12E535C43FB9600A8F9E6D738D2AB49129A73FD49073161CF0780416E3FA1BD49B3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\nss3.dll
Size 3.1MB
SHA256 a3bb88e798f02d03f2097365029794231d8f5d2420b21960cfb60318cc8b4a63
MD5 2a1255d6826e2b18c835e2f691e8f8f3
SHA1 f79910575279bf4929876dbea7563ec6a30e2467
SHA512 6f63d14e3dad6d6d259d45d3e8d7b8913e7577a5f2214ad66cdf03d0c2ce5f77c178a5ad3ceab6a3daf0d71500e4400a0d01b76e31d14367cf5edc9a62899aef
SSDEEP 98304:U6ouKqKlYFqgUNSZWs2k59p5t1WeNNqrNCSwo:3KUUKb2k59pFqrNCSF
TLSH
T1B5E58D13F6A510F8C029C279979B9323A6B2B4455F3876CB42945A153FE2FE03B3E758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\onnxruntime.dll
Size 9.3MB
SHA256 729bdda675a848408c0e8f359ea3d49a2c7b211c417a807516da3516f74e353a
MD5 5142982086560cd6831ff73d10d71f90
SHA1 742bb1ca8e896efb357a7f512235e71d8dc6009b
SHA512 b5326ba25731775cc1cb646cf8b9adbbf4c7632d76c86d6703fcb2a5b6e0800108fc5edb758da1b4c95d4aeb33b9d60b02dae97273cac383246c463e660b68fd
SSDEEP 98304:gsihXTtRrgHYsE1/0xYNAvFOyj1rYOCmelEwEuTB5Nnad04Fyc:glhXTtRrgHDBxYNAgySOCme1EunN+FP
TLSH
T1D3A67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB01E254912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\pingsender.exe
Size 77KB
SHA256 1ccd5ef44b7048ed6529fb1d5ed8357b530538e6dd70895514552d8632e165ed
MD5 5191e68b96acd4bc1f153e5d4bbe71ef
SHA1 ab41279cb1d3c66b23a8162b3565359ad2791ea8
SHA512 a336427ef106ebadee18d8efa309aac133719b3b5929f6c98581d3466bfeea007aec6dd9ee258de55b1ec84241aa1a3981fbbb4efb10f85a03c4f90016e1bebb
SSDEEP 1536:tMqDYRoDMwGZw+adBkQVybQ3Rn6dhi5l6kL7ow:tM+wZw+a0Qph2i5l6kfow
TLSH
T12D735CEA5A6051FAE451C2F0D2EB5213EB7575892B2666CF938453623F037E00F7D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\platform.ini
Size 158B
SHA256 b6fbde697b0d96597e5e411dd80e54090c3a97aa79157a8af6ddd9ab585f902c
MD5 e58485803abe1e624cfaf081dca376e0
SHA1 09aa8fe71d447adfbe1139b4a9cc051cb6a34a5e
SHA512 d3f7086e21589393857cfc4cdda8f460d50ea3b4b22d1a4ae4b3726d0f90fe6132e7c32fdda206a51dd5fc6cce1242ed83987ed32e78a944979ab9ae41deae6e
TLSH
T135C08CFB181480EC4F1072D390A5E9869B2A0F81AECB8024703920900EB280F8BAA926
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\plugin-container.exe
Size 139KB
SHA256 0f84827cec35977f39597eb1a41ea401ae678e1c621f4df889db3837eaeb9e3d
MD5 c182caca68468d8e41e1bf3b4bf7ac6f
SHA1 b225988baa8d1421638fa3e7d4d923a170362a94
SHA512 dff7bee46fee57dec694681149a98b81b0ebe45d95752789e27e24e33f4dd5d5eff1957a095dce48204f80c7d29cd2712c11cb6d107e30383e8b72befaacd4f5
SSDEEP 3072:30t6idq8p+kH9VBgZjWE3FD8TFAzfeV5MbM45yOCj6kfol:3Q6p4NH9VBPCD8TFofeImTgl
TLSH
T1A1D36C13FA5950FAE548C974DA824612DF72BC860B60A7CF27940DA12FA5BE4BF3D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

precomplete

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\precomplete
Size 2KB
SHA256 22c96cbf4013bebc53b40513ab38df386f69e2f39755ccd85b3efb19699dd42b
MD5 e48e2c4a43825a2c9fb8709991165ead
SHA1 6325093334b65d628f9f217844d0dd4b3fc7b0ff
SHA512 7302dac2c8aaf8eb4317b3e0acbdc63523e5f4c1510cd886fafd11201cb0d791bc922c50bec05050f1348276dcc6f41fc6ea3d0fb6111a84ef42b04cc5085a8e
TLSH
T1BB41258CD02EEE6169D651C884D31D8F3DAB42A6DD9DEA781EC311447FE35EF010D62A
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\private_browsing.exe
Size 132KB
SHA256 a9d19529fc2ecd6743e1bed5f9d79768f0a5ab6a5f421103d288e0beb866ade8
MD5 f46badc50a8105d8abbd096ce43e0398
SHA1 8a2e37ab643280ba5a7b36f6ef9414bbb6f3279b
SHA512 37a04e995c8cf987bfb9ec2d8b0ae6d64543f9721078e3d61ddaf0e2b04db066130783ea39c94e1c5bab48fdb97d4d4c0b91b505903dd84b7ec842d9a1467b31
SSDEEP 3072:049i0HFNqFx6m6N3MbE/66TsnA7FZn6kfoUm:0S/qH6m6N3Mbu66gngBgUm
TLSH
T1BBD33E8A9E858E57F07CF17E45BA4D35D55AA60F230051C3BF3CAB83EF58B94282D606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\softokn3.dll
Size 355KB
SHA256 0244d636ddf1fb9481ec92d01640458497d98eda7532759214f95bfb97320407
MD5 26bb1783c74ccf6e5143ad5b4bd2dc5b
SHA1 02fa01198fb79a524641aae572d4362e462fc327
SHA512 a800c3452090d9a56da16d8960870a8276acc996c278bb7e3ab29e4a53c95c8c5b40fdefb438c071047ff84ff755f7855b2de3f0fc2e69086933bd74a063935c
SSDEEP 6144:380A2J4DmexNlUGyE3QovWJ5SCyVppCTca83eufTySJtoON0E9kWIxrg3:o2J4fxp96SCpcyymSJGs0E9kWqc3
TLSH
T1C4743B03FA9155FAD806C475A1678732B5B3B8940731ADDF93285B2A2F61BD0B73C788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\uninstall\helper.exe
Size 1.4MB
SHA256 988f3f8f82d837d95d106fd9e4b198d5cf1b204616563b01be560f5f42b9cbe4
MD5 4c4c3cedfef1689727d802e63d292cf2
SHA1 400b2af2b7e16484f618b3555b939aaa580967f0
SHA512 3994257bdd8bd6bbe6832a992533afa7c46d67978cd8b82fe8f4607c565c45727497e3eeca192a6e7aa44550de41dbfa51c9965c55409d607f124b99439f154c
SSDEEP 12288:uTCUjD5thTk9euP+bnEPsSjlSoTUJDJY95+B7a2SooEPql3:uTPhT8hmbEPsSjIoV0BW1oZPqN
TLSH
T138651803A790A822D46E6D3064ABD7253B37FD812E7186473B1DB39C5F73340AA7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\update-settings.ini
Size 116B
SHA256 17224c6040c70203f9228f35c345ba7f72e3be84ddbada6fb8f971c701e87e30
MD5 68acb4ae209a1fe7910b85a3c43c5cf2
SHA1 c70a6335fc65b17453a88e59bdcec7a067c94cfe
SHA512 3bd99664ce6abd681bcf8c089c7db5759eafd165d6f00adaa8c900f7b988e98cb99342778e90658ffb17660ff95023f49f8efeac28bd7c366a208df6c3e1bece
TLSH
T191B092895A94A84C8113C462EA6D022305A2C529090521252748E441B3E77208ADADAA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\updater.exe
Size 984KB
SHA256 3094aa7ed652eb01a4900fc37fd82c32f2724b8d4f49a595feca8452e457ab21
MD5 b60100ccf2ee4980fe792413482fa74c
SHA1 42f67d372dd44f41fb27bebc0513f8932e5b0f34
SHA512 8e567c40f5ab0282b1c2bd073a63d94b17caf969e7809a95dd5ab010df8ecd1838cbdd05249bd1366a1159e80bc57e73af07affe58f5e6e9bd6fc33e1bd1f153
SSDEEP 24576:aHX857KQ5cxf9DkwEJt+ST3duLh0lhSMXlau2TTJ+Ruj:uXg7KQ5w9DkwhShu632O8
TLSH
T1CF25AE1BF79041F8E459D9748BAA4513EA32B88A4721A6DF07D48B152FB3AF01F3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\updater.ini
Size 1KB
SHA256 a6d81b46188b52069c2582dfc6b4d682bb722c2436cf5f531fe6ed0c94952c9d
MD5 27a5a5f5ae9b41546c9b6c7a0eb6f026
SHA1 21dcaed4a05199f407230b60fbc554a23e195f33
SHA512 a6208e3819debb7a169adbfec9a426570acf5e8117258dbf8faea4d886c923007e52cdb3cc46028878c3aeb810a9f7b9482f92b1f77b5899319a1644156b11d4
TLSH
T1F62121562688B3F409D29B85BA4633D6D78381ED23513120A0ACC160434793547FEBE9
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\vcruntime140.dll
Size 110KB
SHA256 b7f8aa9dd8f5d2cc72aa36d028b3a4e6ed141cb5d071a085d2195b78134acbad
MD5 6e3fafcfbcb2ad4767cfb3d44a723a7c
SHA1 8fd7593e48694635bf05b5eb386344be06a5fb4d
SHA512 ba7aedde4c5c922faddcec811a898e19060418c1565c45c6ab70db792f7d1082f0b4e47433e6c583f3c8ed68283db58cfe4481279b02f7b171a3c7cb50eeab68
SSDEEP 1536:69pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lg6kL7oB:KyA+3EOfmpcGSdOecbeQ6Nxg6kfoB
TLSH
T1CDB35A4272B402FBD16AD275C1939E6BE7B2F40587649BCF07AA46660F13BE02D3D391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\vcruntime140_1.dll
Size 36KB
SHA256 576a2fd35ec8f441593519a503dcb5397ea31a594a0745ec2a3fc742e0b06a46
MD5 9dfd04de2bc0a84bf857ee1f9dd41669
SHA1 96124a93e0d64cde1e9a9b31c8e664c1093d1af4
SHA512 84e84830a79209db41d009419262c30401c6dc5b08ce2cf8465882c5ffa73ab0f654d390b483252cf9103e6d98b1b9f72f64237114309322e0219fd58d26542b
SSDEEP 768:mezSkbhNfI4fWLZyS/dPWxuVsheSoQuoaK9u86l:RYZyuPWxu6kL7oLQ
TLSH
T1B0F25C5297A840EAF4A7CA70C4D70E2BEE75F59057A087CF2A68454D1F137E06B3D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\core\zen.exe
Size 862KB
SHA256 738bee1cffddfa3139ef1db84ce4bc2ec24d756563ea8416872099d1c5e6a0c2
MD5 4980934aad0a5244c98571d022e5bb5f
SHA1 b2091e97baf6521ce848e385dcd4777882064590
SHA512 3c6b566b229bedd2aed4314601954713fd77eef02d03f203939864786f4a3a7606832fb6105f641e6b738334f91ed87aadb23a78cb8f8f85829fd5b84c2e4d9a
SSDEEP 12288:0Jh0v86UrAh4I0GVd6q0DhIaIvwbGYbG65bvngdrXf3U:C0v86gAhTVd6q0iaIvwJUrX/U
TLSH
T13A15B312AB858CBBF078C0398676CAB5D5257C4E83D051C73EACBE633F75A9016F9606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80E42148\setup.exe
Size 1.0MB
SHA256 3726f293b50e60818eefc19390c5f15a2fc76de43465260dcd6d374545d75ce8
MD5 a5f4a1d7a70112b4ecf1ea9e4ee32ec0
SHA1 6921d0971d6aa3d73a6d91a02b4e767dc334e155
SHA512 85bcedf9e75e6243e19f88230df4c13efa85909aa7b9004896ad529aa8d69122f3d68cc0ce1f8d06a07caf79fc220ef973474f07d3e08e4b9c41eb309c695e26
SSDEEP 6144:2T4Dt1UjD5YJY/g9D99es0mPH+WSnEP+rdlqSB9G3SoNgk:2TwUjD5Yuo9euP+bnEPeqSjwSoCk
TLSH
T15B35F603B790A462D46E6E3068B7D7553B37BD822E71826B3A1D739C4F733409A7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PinToTaskbar.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\PinToTaskbar.dll
Size 3KB
SHA256 6bec8a69845fe9012a0622e79b63328fb611151fd24f198a779d781a36dce5a3
MD5 70016ab449dd0034333b0df88193cb82
SHA1 add0b693b75f14e7f9a063d0de1921c3bc8d1a52
SHA512 1295dbe8596a37d0799b51c3be011b2aeb499d382bd860bba784dbe5a580f6d2e1116830c4c619ef32df9c5f7af0aceb600c2c7a29e321cf8e355c73627ffc71
TLSH
T1297162F3F3644076E22903B84847C42CBABCAB1213AE4697789B611E2E50CC579A3D92
MD5 SHA1 SHA512 TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\components.ini
Size 602B
SHA256 f1505640e352a1748d1cdbc6eafc0ab21b0de520c6ea6b750d6eeb41b868dfe3
MD5 637a9a06841221d166843d55316167c0
SHA1 0aaeb03991f6f828af3b90f37e6c73ee7b94e6ae
SHA512 7a3215326798d9682a8fc2eae643d47314c971f5acda4094d1e9daf59defcfb36e3ea86ccbeb3426160e0fe29fb6339c9bd70b52317fe8c1b42ddcf3b8f106eb
TLSH
T1F9F09A472AF80418F4F7B709FEB441718B393C45583DC50E91E1080E48E4A808877BEB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\extensions.ini
Size 630B
SHA256 0723b5d0c55354754b2084b712854c39ca089b1d883de067ac3c20935808397d
MD5 940e15a3691292c513f015e351f33072
SHA1 0545d9d43b188182988195db8a01fcd3ff43afc4
SHA512 cab225845a6ad929b643f3c6f8e9f1b8d0e7f0b19ca7ddaeb6350c508e9d21294749077ab3d041facca1d41578b2434f0faa37a5bb64f1ab1ddadda0edce4b75
TLSH
T14CF06D532AF9000495BABB04FAF581718B357C855C3DC90E92D0094E0CE5A818927FFB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\ioSpecial.ini
Size 1KB
SHA256 8543aabdb5d60c7edbadb7ff4f48cb9b9df684b40f5ad70a200f433537e0df3e
MD5 a51aa8d6c521298719b06ac1099b12d3
SHA1 7200d45d3590a5ac85cd9f6d61d83255f9800ec4
SHA512 6eec60e11e90c66573636432bb4cc7f78abf64db7b038889d2e809c7437d81bbe330bbb68f3a4232cc074f66ca25a006cbcc7d720be023d2e7c2d1457bf2da58
TLSH
T1CC218E032EFD4024E2BABA08EBF591359B397C55582DC51E91D10B4F48F5A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\ioSpecial.ini
Size 1KB
SHA256 2b31df82433d54be0b83731f6d79b68786bbfa165434a1b6c55e0a6541fcdce7
MD5 1ebd978ba0a987ccf23350f219620bb1
SHA1 6a3803a216a05b6650685ae2f36a16fb6f109e0e
SHA512 0b4e551c35ccb37ad56d37e9022971f287c258c8ab5aae5a24c33dfc8c252422067dd4a528988d3b3a326c972c18d38b8785bf52dfb3a9b674123d84f71c6521
TLSH
T15B217F032EFD4424E2BBBA48EBF491359B397855582DC51E91D14B0F48F5A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\ioSpecial.ini
Size 1KB
SHA256 0107da1459da2b8ac02f9124466c9e8db90eb1caadc067c4f8a298af22182228
MD5 b004dad970d0af00827ee60c3818f226
SHA1 e5e418b3ac6d65cff10c1ff370e196524d511d09
SHA512 c772fed61d1ce27c709223d1b2bb848d427b90630a00c16eb40ea4682bb0c510444d21a204f6dd8b2e264c6bb26480267f6faf11e9fc7262c991d3a8cbfc5315
TLSH
T18B31AB037AFD0518F2BABB54FFF451758B3A7856A83CC51D91C10A4E09F5A408923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\modern-header.bmp
Size 25KB
SHA256 689ea80105f4e61ffc73062516c7d7053f92bae0c700c0673c3a9b445345df1d
MD5 cb1c4da8daa79279041011b85f48c3e1
SHA1 40496c445e18eb28686ef1efdeacf39153a91062
SHA512 eaca5a8e4503c3b62a3b675de44698af80952708fc4ef19a1e0174e4dfd5d6d4af3a3a9f02c4c8ae2c8fb257ff15fd26798d5dc04cfbe727a2fe7050491ee5ae
SSDEEP 96:aCCLLsFslQUlQhMs32QcJYQ/KgGvpNgFtQXPFD2ak29SiD0bFSCxPw:aCMLsFSQOdINUMD2V29S40bkCxY
TLSH
T156C26A110F8E1647E922B2AA323235587DCACE0D56F34667FC0833CE8AF701C2A352E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\modern-wizard.bmp
Size 201KB
SHA256 c03931e6f022e29943d410030595712a29285c1130537d552a7804845a07eca7
MD5 faa41c5d172376cb31e0bbee19d332fd
SHA1 eef931a54b02588e2ee9b202bda14a612cc8f423
SHA512 b65514d05512cbcf27c5a06b97a2454f66a58a2edb081fb1949a0d91d3d9a47c9eabba6dc521566ec44b7fa7b7a863d4bcd6d5bb01a6633d978441b6bf624ee9
SSDEEP 384:sGiFLVfy3SqviWSlk75o3gDVxYi9eFQthspiapMjuqh8fLCG8YHwDT1bmJ:t/OiapMqB
TLSH
T156147F8751C424B9323C3E4292AFA80974575481BD3DBAB63E8DA3634F938E78B3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\options.ini
Size 1KB
SHA256 fba4cfe357d29168de21e4718f15f070d08fc0241bf771d5ac9f6373979de176
MD5 15ed0cec8a172e53230584b54b69f882
SHA1 f58239eb5b9693b4baccc836f901416c2bc776ca
SHA512 620e4b83a1d2d5eeca2cbbf47874a97889f035a0341bd38aa07be7aac41d283a5cf7b9b86f1da60df0ea0ebef64e14d5f6eb76da56c40fc36438e804068753e4
TLSH
T1AE216A632AF94116E5BABA08FBB581309B397C46583DC60E82E14D0E0DE57808477FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\options.ini
Size 1KB
SHA256 d5ae8ec7dd0c3416dccb3e04c0d1f9a541f12a98dc389d92741c865bde453b8b
MD5 f19c7ee8aba49731f54b85d0b07f2434
SHA1 4b1af9184c20a48b0281a5548cdafa87fecb4f05
SHA512 76608cec95e6dc2e7c63442dce60f765617278160605574e28a78c82694e20644b25de010ffa9e3b3c8bbf4930df278e2d280ce4dc32df633d5544c6faa596e0
TLSH
T1932180532EFD4516E1BAB609FBB54130E7347845583CC50E91D20A0E0DE67808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\options.ini
Size 1KB
SHA256 d5290cfe8d13d8baaeca66f4d21a6c9494e21a2bb8e9b87ed93a8994fe3a3f79
MD5 f288e786fba01dede646cf05ad15e291
SHA1 1703ebab3b7264204d59dde24a7ac7e45677a901
SHA512 e9d4fd2b83c6c22f8b7f4dd182ee36d13e6f1ab97b93d95ad346709c30a6b0b3df8f0fe8b1a8f1b677cd982e613cdbef68ebe0b96c37f8f4c2e46d8896acfe9d
TLSH
T1062180532EFD4516E1BAB609FBB54130E7347845583CC50E91D20A4E0DF67808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\shortcuts.ini
Size 866B
SHA256 d1f6b6b6fc20b84ce925e0925f9e180bc924c8f24c788edd90c3001ba15087bf
MD5 751525a3fd0e53134d4e178390655a67
SHA1 5ef73cda0e4677814a8a4ecfc4a112a563d430e3
SHA512 af4686c2db651d8c00c46f4800f2641f8870635b6a5b7961f2f1a4dfae64cfad0dfc485030488fcf2549a1b35748728c16ed1ed66ec441f672326ebccb4a1fbc
TLSH
T18A111E032EF94015E4AEBA4DEBF540769B397589182DC81ED1E14E0E48F96808577BDF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\summary.ini
Size 812B
SHA256 086ecd362b06859bd0bb48ddee94f19a554bf8b853b62008a7d1f11f845773c3
MD5 fc76ac80bd3ba31a1f2bbd07ea91225e
SHA1 eb4d58926362ddefd67852c8764c874d2f5c304f
SHA512 9a2706cacc9e41282c19d4f77b162ba2395f0a03253b71febdccedda27211ecb5d036570ac336ccf188ea1f100feab1f0100482e9bcd90879acb4b7a973bb45b
TLSH
T143018F132EFD4028E0BBBA09FFF144759734B806082DC50ED1D10A4E48F6A508967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDD.tmp\summary.ini
Size 654B
SHA256 f992973d4bd9c3a9313b56f75133df02a7bef20dcf0a72d8dd19717bdc08461e
MD5 fe47800b5174e74c796f8d0bfa4b9af8
SHA1 c420f33e2d5f5e1750a4fdc2842d19f9fb71535f
SHA512 8ddc435e96c4062f18462f02ac5e3a021c9d72b6160f9d9c4f1284420d29da3100493a743109bc0bcf7e7355dd482691a48eaf7a0487bd1379e376098d54f115
TLSH
T1B5F06D436AF84068E4AAB61CFFF5807597347806182DC90ED2D14A0E48E52908467FEF
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 564KB
SHA256 cc4262297832d19899d917a17710fbf67ed1d33a73dde0d9cb2307098cda9963
MD5 acbbd47672e3bfc3f831ee2913c94077
SHA1 46ecc79aaad56f3cb869bc842ce796078b7f83ee
SHA512 710a833804bdd5e5e4e009f8abdb2afc32ca1760f2b342d37d9b4888f1871acc2d0120843eb5ee969e3b79c7f5e4d46978376cc1c664c8cf46250a1e5e3a02d9
SSDEEP 12288:tUPW7lzlBAht7Ji4lIjPEOSqWbDy/scPaswNU5IaW4neQyrrHqN1XD6Hu+6:tjjehttlIjPJR2qvysPPjVyr7q/Dl
TLSH
T113C402F5F7A078E3A7BE020B9DC66FAD1B125926C38AA0CC447777C2456772EAF65400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\zen\Profiles\3o8gc1cn.Default (release)\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 21KB
SHA256 36a643e7e31c78e72ff57d22972b7b56934710d56a594858b0405a76a59ffaaa
MD5 c58da03856940f3a12aeb3270b4d1ba3
SHA1 d3c251ce16a40b16472b8ee75f2810f49307d468
SHA512 fd0b00fe56a31578ef96f210abef277e280b430843173bef49a0e5dab57eeb1f53741387e21cfbf75a7b36c5e66042cdc138ba7a4d5c7c8f0d19392bf985a054
SSDEEP 384:HwCe7iO024YuDL84+KDL849B7SOEAd9KVRaAcP+AWRMAfTUKisj8wkac8Woh1B9x:QqZYuDL8ZKDL8CB7S/AmVAf+hRMSUKiI
TLSH
T1FAA2BF7A5F403CBC199790E4C8B982EA4C28FA67DFD6806D25683D0ECB94599A1F448F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\zen\Profiles\3o8gc1cn.Default (release)\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 21KB
SHA256 8bd31009df758b1e98d8bcf0faa6f20e66e0ea9a201755d726d46d1436ab23f0
MD5 ba881a21e720e1f71e2a97aa5661869b
SHA1 52487fa69c27bf2eef8ef23def35c4d40a9defb9
SHA512 2220e35d0bf29b2a29da1235b320391ee6e15ffa20af8e2930c03e0fcc52e2c1bf21cbd19fa8c37899c781e9b89ef6304e863482d821278f9924a50e51b406e3
SSDEEP 384:HXkRyiO024YfDL84+KDL849B7SOEAd9KVRaAcP+AWRMAfTUKisj8wkac8Woh1B9U:3mZYfDL8ZKDL8CB7S/AmVAf+hRMSUKiJ
TLSH
T1A4A2AF7A4F003CBC199790F8C9B982AA4D18FA67DEDAC0AD24583D09CB94599F5F508F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\claeonxx.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\claeonxx.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\claeonxx.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\claeonxx.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\claeonxx.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\claeonxx.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\datareporting\glean\db\data.safe.tmp
Size 172B
SHA256 5a5077a11593842e37e4cdc672305cb0f8c4af7d910bfa7dfff959a21bb12010
MD5 c7e7ae85eadcd1d4ec26c2d5dbfec345
SHA1 f35b936df4723e8dc0df6c65e89a6013c689064e
SHA512 68439c62695970e0a9194a1f95a21cb494b8b3b8eea1b5b07bb5d318a40f08f73b8f6a2d281c353c3290fbc6a0af4882eb39b68e1287e858f6b5401ebd216996
TLSH
T124C02B55C240D40CE440643200505F800B246010404765035038F100A8072103C3EC07
MD5 SHA1 SHA512 TLSH

Submit Download

09b9eb21-1c40-418a-8a96-357f19d95d90

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\datareporting\glean\pending_pings\09b9eb21-1c40-418a-8a96-357f19d95d90
Size 712B
SHA256 8838b102c3d5876749a25a59f27a5498e61bc4185447c124061e244d974b80b9
MD5 08da0c43a90c8e83d8fef7766e865122
SHA1 064d89c73a5b723bf7c98931769ed9bec28c8176
SHA512 a414ee44deb587feb2f0f5e5fd150db72b7402ed0ccdec47c4a062c26d2221bc388c927573599df9165f654e8c376764afa02b79f805c5e88a27473400c25873
TLSH
T1AD01CB0658A4D4560CA5964AF1D97F01547810376055F309D0F0D63C7AAF5AB9373747
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\extensions.json
Size 13KB
SHA256 2b1ed4458d6ba0504e443e96f1e20ade2037bf52ac8e0f7b0f13e2d4cfbe63d0
MD5 63fa7f2110cee7d8ec0966470b1968f5
SHA1 d8e98ff6baeb0c456df8387bd593a2808f9b1a97
SHA512 f2680dc226cb45ea9eb3c48f970132630a1febac3564febe4a76d2349cff52d7d5fdaa3af5e58b52298350bb79289e69aa46e1bd23fdef7f59b7e8c09c268e0d
SSDEEP 384:XT4ij/7ThT9uj/7WTYij/79gTldij/7NT4Cj/7JT6Ej/74L4HK7L4HeL4HLuL4H7:j4A9NYAKfG4s6J4qn4E4rU4b
TLSH
T1B052FD1554155EB8298E63DAD9767E01C37C673BA0445C7CB8ADCFCC42FA0BD06A362B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\prefs-1.js
Size 7KB
SHA256 19133fffe77ec8ca5a9828ec18ca740a9f92934f1f078fd59c7b0d16a84a2d73
MD5 93bdd7cb5b9b60d84e7bdd036cf2dd5e
SHA1 4b8d0b45361d9c238a94feb9cbc58391badc1079
SHA512 310585c0e374260c94217930d7592b234cecdb9fc38112195f8bef5e9097e52675a6b2fa32f0479cc72633654dfa1a01f8efd43b979acb62a5a4a1bf5b4c676a
SSDEEP 192:WyRD95BgUpLvgH2vkjH6ZLlhCBw8CGaZ0hEG:hZO+ZvQwLahEG
TLSH
T190F1FD7891048FBF75B277BCAC2489719AB1017B7ABF18D610B944C8150CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\prefs.js
Size 3KB
SHA256 1a29f4df887f3c50c54a9f3d7a99f3a70d77b82b2f152331151382066efecdeb
MD5 0820ef08431047c9a12b046f552570f0
SHA1 171f36bc4d5f28f5badff5ede5199f23956ce8d7
SHA512 ef4cb87c21272de4fffcd18c4fe54fbd8ee56330a0e7cdbee8a5fb083178b2acf6ceaab2b962824b1a40eca0503ce8a0b3e52c24df91e2b87afd0adede33551c
TLSH
T113710D795504CF6F60B637FCAC1886708A72017B77BF28C620B89499561CF3542FA9E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\prefs.js
Size 1KB
SHA256 867d0f850844f3880693bac23673db6d90296148633ac07e69ae6d81dfbc5524
MD5 7fc8758bd3f8d848ccf96ebb20e6c4ae
SHA1 1cdd98336a63e1d0bd715c7d701881d6edcc327b
SHA512 5bb01f1bf5ca9295f2171eea54d1bd5f663780d32b4d535c43d670e10189886f150ee29d8458e986e19113ea1b807029401d47f1ca3714a5e480924b66198d6f
TLSH
T1763100671905DFAFA1B036ACFC298970CAA24232B63F68C524B494854118F3046E69D7
MD5 SHA1 SHA512 TLSH

Submit Download

2918063365piupsah.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Size 48KB
SHA256 96b299fc5de188d0f45e5a6baeee77614a3e70aac22fa1d54a3a909de774fc0e
MD5 e8196066359da040bb501dc6eaf86338
SHA1 930abd73d97c7a8debb0bc6a8147f31cb24bb442
SHA512 1ed492cc7d0329a21a734c0234c13debc71498469baeff9f69bf86d2984cee305e04ca8b328c083270b750f54687abfa793ba176d63ca703d7f590d75d556ed0
SSDEEP 48:T+OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEb7:616S6CKnqlizbxV+2xVeU7X2B0b
TLSH
T165235E8E3F07E511C53AB0B178A08D51FC5E321D07222AD56990DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 62784f6d6707f6f28164f1db81730c6d37baca31bc0a255f769215f9f580c69e
MD5 ca92cea033d0c21f9eba310cd7837ce8
SHA1 d6f3a65c61f951d7e36436d3e4f96bbc2819a3c6
SHA512 84a3bedf0b370e287a000b977d1ed58ab30643fdafd5fd80e89d9a6f25705019e4007d3387892ade763ab583c26d44e6a47e9bb6db9fd865e4a7534c92f65655
SSDEEP 384:G6S6CrAWxhaRBvOPv7hvKovVYvC6v1xbvyove730QNUeKN6eAs0eq8hetMRe9cL8:G6S6CrAWx97301yqIf
TLSH
T1814385C87376EE4ACB02C87B04C683EF808D7E6900B64D893676D75C84614EBDB6FA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.3MB
SHA256 26a738ea8149a13fa9ba6249acde9f7a34f97ca0456467d70363275d58651252
MD5 1f6b7d9464a602ac3852baea21eab370
SHA1 5e08b753f2c760f504edae18c4963c546eeda4db
SHA512 f57c006feab0ecd5ad40f9d14e2c934be0960507593f7f41c3604259eb4f853d3438674adcb0ee9850fd2e2894b537b38982590d9384ad400abbae8bbab566ac
SSDEEP 49152:wYrot80cYHkzTNmzAlfF8vIyqRnW/5TOgbbnZrddP6wzJwarCEw5r:GCTNmzAlfePqRW5bPfVB25t
TLSH
T1AA666CF820D1A257F3814033658593EB21EFD00C6037DA485BE95AE9D4B4CEB9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\zen-sessions.jsonlz4
Size 67B
SHA256 b6c6c75f75cdf697f1b10547f4f58bc1da39d05868a64f04a0260d6ce8011444
MD5 0e2028e71b6db8e185a57c1356beefa1
SHA1 80b94c53e6c805ec89bd0c183fdfe403701a05bc
SHA512 9984e207eca6250d07f669569fcc7bac10c3dd98be2e684af72f1791446ebd16ff47886903207d25a028a80b5afeed5418b1021bea66ef47bfc67eab9a4104ea
TLSH
T187A02280E0000B2002E0A30880C208EF83A33038C03008C0280B808E8E882823B83083
MD5 SHA1 SHA512 TLSH

Submit Download

zen-themes.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\3o8gc1cn.Default (release)\zen-themes.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 1008B
SHA256 f1776fe4d2f10d23bbddf9fc695bcd36e632c94dab42f09867c3be8d338e9caf
MD5 a6e9e3e5b591dcc0c3e4f97b0a555073
SHA1 9d293156b8c0a562c565023019841cb4fb6dd4e9
SHA512 d86e805f781434546f2fd49ec96632d053633f7058b1fbcb1179afe55d4eb243ae9b2034e832c60457df02387e6b4332ab248e01c962c847634759ea4b571290
TLSH
T11711801147D79236F2774A7155B12A31833BBC42D7685A2D828851A409B1110D82DFBD
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 910B
SHA256 f7a36f4eedd313444db9d45c5dd850bb5f2b0f209c3b3704009751cfab305e71
MD5 2d84d42e0d344fe431d9474adcc25fdc
SHA1 8dfe063d976e443ab4f9db714f2d25e06bafb207
SHA512 78812e367b3fc4e8e4922c7750e5f947520ec96a5b1f7c29e8922667397f8e51d8dac0c1441230e9654148583741453da55e88aea8466fecf5e2d03c1926beb0
TLSH
T1CA116D1147E35636F6778A7255B22E71833BFC42CBAC5B2E928851B449B1110D82DFBE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1412-1779-0x000001EB807B0000-0x000001EB807C0000-memory.dmp

Download

memory/1412-2727-0x000001EB80080000-0x000001EB80090000-memory.dmp

Download

memory/1412-2754-0x000001EB7C5F0000-0x000001EB7C6AC000-memory.dmp

Download

memory/3592-483-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3592-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download