hxxp://zen-browser[.]app

Analysis

user interaction
yes
max time kernel
116s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/08/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://zen-browser.app
Sample260822-xjmcjayane

Score

8^/10

defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
55	1648	msedge.exe
55	1648	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 24 IoCs

pid	Process
1548	zen.installer.exe
4268	setup.exe
1740	maintenanceservice_installer.exe
1060	maintenanceservice_tmp.exe
5848	default-browser-agent.exe
2032	zen.exe
5368	zen.exe
2192	zen.exe
5980	zen.exe
5672	zen.exe
1632	zen.exe
5400	zen.exe
2856	zen.exe
1528	zen.exe
2660	zen.exe
5788	zen.exe
5276	zen.exe
3636	zen.exe
5448	zen.exe
5612	zen.exe
1768	zen.exe
6376	zen.exe
6424	zen.exe
6448	zen.exe

Loads dropped DLL 64 IoCs

pid	Process
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4056	regsvr32.exe
4056	regsvr32.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
1740	maintenanceservice_installer.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
4268	setup.exe
5848	default-browser-agent.exe
5848	default-browser-agent.exe
5848	default-browser-agent.exe
2032	zen.exe
2032	zen.exe
2032	zen.exe
2032	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
5368	zen.exe
2192	zen.exe
2192	zen.exe
2192	zen.exe
2192	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe
5980	zen.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zen.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	zen.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1548-306-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1548-693-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Zen Browser\application.ini	setup.exe
File created	C:\Program Files\Zen Browser\libGLESv2.dll	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice.exe	setup.exe
File created	C:\Program Files\Zen Browser\plugin-container.exe	setup.exe
File created	C:\Program Files\Zen Browser\updater.exe	setup.exe
File created	C:\Program Files\Zen Browser\installation_dir_layout\versioned\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\fonts\TwemojiMozilla.ttf	setup.exe
File created	C:\Program Files\Zen Browser\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Zen Browser\marshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Zen Browser\notificationserver.dll	setup.exe
File created	C:\Program Files\Zen Browser\softokn3.dll	setup.exe
File created	C:\Program Files\Zen Browser\updater.ini	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	maintenanceservice_tmp.exe
File created	C:\Program Files\Zen Browser\freebl3.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\omni.ja	setup.exe
File created	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\installation_telemetry.json	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsdD87C.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\AccessibleMarshal.dll	setup.exe
File created	C:\Program Files\Zen Browser\gkcodecs.dll	setup.exe
File created	C:\Program Files\Zen Browser\lgpllibs.dll	setup.exe
File created	C:\Program Files\Zen Browser\maintenanceservice_installer.exe	setup.exe
File created	C:\Program Files\Zen Browser\mozavutil.dll	setup.exe
File created	C:\Program Files\Zen Browser\nmhproxy.exe	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\clearkey.dll	setup.exe
File opened for modification	C:\Program Files\Zen Browser\nsdD87B.tmp\	setup.exe
File created	C:\Program Files\Zen Browser\nss3.dll	setup.exe
File created	C:\Program Files\Zen Browser\precomplete	setup.exe
File created	C:\Program Files\Zen Browser\defaults\pref\channel-prefs.js	setup.exe
File created	C:\Program Files\Zen Browser\browser\confused_fox.pdf	setup.exe
File created	C:\Program Files\Zen Browser\dependentlibs.list	setup.exe
File created	C:\Program Files\Zen Browser\libEGL.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.Internal.FrameworkUdk.dll	setup.exe
File created	C:\Program Files\Zen Browser\onnxruntime.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_70.png	setup.exe
File created	C:\Program Files\Zen Browser\mozavcodec.dll	setup.exe
File created	C:\Program Files\Zen Browser\xul.dll	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File opened for modification	C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Zen Browser\install.log	setup.exe
File created	C:\Program Files\Zen Browser\private_browsing.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\update-settings.ini	setup.exe
File created	C:\Program Files\Zen Browser\zen.exe	setup.exe
File opened for modification	C:\Program Files\Zen Browser\	setup.exe
File created	C:\Program Files\Zen Browser\default-browser-agent.exe	setup.exe
File created	C:\Program Files\Zen Browser\firefox.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_150.png	setup.exe
File created	C:\Program Files\Zen Browser\browser\components\shell\assets\kit.gif	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.InputStateManager.dll	setup.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Composition.OSSupport.dll	setup.exe
File created	C:\Program Files\Zen Browser\mozglue.dll	setup.exe
File created	C:\Program Files\Zen Browser\pingsender.exe	setup.exe
File created	C:\Program Files\Zen Browser\vcruntime140_1.dll	setup.exe
File created	C:\Program Files\Zen Browser\gmp-clearkey\0.1\manifest.json	setup.exe
File created	C:\Program Files\Zen Browser\browser\blank.pdf	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Zen Browser\nsdD87D.tmp	setup.exe
File created	C:\Program Files\Zen Browser\mozinference.dll	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Zen Browser\Microsoft.UI.Windowing.dll	setup.exe
File created	C:\Program Files\Zen Browser\removed-files	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\zen.installer.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\zen.installer (1).exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zen.installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1648	msedge.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	zen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	zen.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Colors	zen.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Colors	zen.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	zen.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318984024229719"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.shtml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ = "ISimpleDOMDocument"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.flac	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{01E800C4-B53D-4A5E-B755-4CC9048A877F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.ogg	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\ = "Firefox URL"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{01E800C4-B53D-4A5E-B755-4CC9048A877F}\DllSurrogate	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Interface	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\command\ = "\"C:\\Program Files\\Zen Browser\\zen.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Program Files\\Zen Browser\\AccessibleMarshal.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\command	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\EditFlags = "2"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\URL Protocol	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xht	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods\ = "18"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\ = "Firefox PDF Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.mp3	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.xhtml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "PSFactoryBuffer"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700\ = "Firefox PDF Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.m4a	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.gif	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\ZenToast-F0DC299D809B9700\DisplayName = "Zen Browser"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	zen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\FirefoxPDF-F0DC299D809B9700\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-F0DC299D809B9700\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.ogv	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.pjpeg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.webm	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{9B2EACDE-248F-4F19-A81E-E95BC7198022}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\DefaultIcon\ = "C:\\Program Files\\Zen Browser\\zen.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\zen.exe\SupportedTypes\.opus	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-F0DC299D809B9700	setup.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\zen.installer.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\zen.installer (1).exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	maintenanceservice_tmp.exe
1060	maintenanceservice_tmp.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	zen.exe
Token: SeDebugPrivilege	1632	zen.exe
Token: SeDebugPrivilege	1632	zen.exe
Token: SeDebugPrivilege	1632	zen.exe
Token: SeDebugPrivilege	1632	zen.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	zen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 3196	5148	msedge.exe	81
PID 5148 wrote to memory of 1092	5148	msedge.exe	83
PID 5148 wrote to memory of 1648	5148	msedge.exe	82
PID 5148 wrote to memory of 1092	5148	msedge.exe	83
PID 5148 wrote to memory of 1092	5148	msedge.exe	83
PID 5148 wrote to memory of 2664	5148	msedge.exe	85
PID 5148 wrote to memory of 2664	5148	msedge.exe	85
PID 5148 wrote to memory of 2008	5148	msedge.exe	86
PID 5148 wrote to memory of 2008	5148	msedge.exe	86
PID 5148 wrote to memory of 2008	5148	msedge.exe	86
PID 5148 wrote to memory of 3844	5148	msedge.exe	87
PID 5148 wrote to memory of 3844	5148	msedge.exe	87
PID 5148 wrote to memory of 3844	5148	msedge.exe	87
PID 5148 wrote to memory of 2884	5148	msedge.exe	88
PID 5148 wrote to memory of 2884	5148	msedge.exe	88
PID 5148 wrote to memory of 2884	5148	msedge.exe	88
PID 5148 wrote to memory of 3064	5148	msedge.exe	89
PID 5148 wrote to memory of 4836	5148	msedge.exe	90
PID 5148 wrote to memory of 4484	5148	msedge.exe	91
PID 5148 wrote to memory of 3064	5148	msedge.exe	89
PID 5148 wrote to memory of 3064	5148	msedge.exe	89
PID 5148 wrote to memory of 4836	5148	msedge.exe	90
PID 5148 wrote to memory of 4836	5148	msedge.exe	90
PID 5148 wrote to memory of 4484	5148	msedge.exe	91
PID 5148 wrote to memory of 4484	5148	msedge.exe	91
PID 5148 wrote to memory of 3380	5148	msedge.exe	93
PID 5148 wrote to memory of 3380	5148	msedge.exe	93
PID 5148 wrote to memory of 3380	5148	msedge.exe	93
PID 5148 wrote to memory of 5524	5148	msedge.exe	95
PID 5148 wrote to memory of 5496	5148	msedge.exe	96
PID 5148 wrote to memory of 5524	5148	msedge.exe	95
PID 5148 wrote to memory of 5496	5148	msedge.exe	96
PID 5148 wrote to memory of 5824	5148	msedge.exe	98
PID 5148 wrote to memory of 5904	5148	msedge.exe	99
PID 5904 wrote to memory of 984	5904	msedge.exe	100
PID 5148 wrote to memory of 3748	5148	msedge.exe	101
PID 5148 wrote to memory of 3748	5148	msedge.exe	101
PID 5148 wrote to memory of 3748	5148	msedge.exe	101
PID 5148 wrote to memory of 6100	5148	msedge.exe	102
PID 5148 wrote to memory of 6076	5148	msedge.exe	103
PID 5148 wrote to memory of 6100	5148	msedge.exe	102
PID 5148 wrote to memory of 6100	5148	msedge.exe	102
PID 5148 wrote to memory of 6076	5148	msedge.exe	103
PID 5148 wrote to memory of 900	5148	msedge.exe	104
PID 5148 wrote to memory of 900	5148	msedge.exe	104
PID 5148 wrote to memory of 900	5148	msedge.exe	104
PID 5148 wrote to memory of 1412	5148	msedge.exe	105
PID 5148 wrote to memory of 1412	5148	msedge.exe	105
PID 5148 wrote to memory of 1412	5148	msedge.exe	105
PID 5148 wrote to memory of 2492	5148	msedge.exe	106
PID 5148 wrote to memory of 2392	5148	msedge.exe	107
PID 5148 wrote to memory of 2392	5148	msedge.exe	107
PID 5148 wrote to memory of 2392	5148	msedge.exe	107
PID 5148 wrote to memory of 5212	5148	msedge.exe	108
PID 5148 wrote to memory of 5516	5148	msedge.exe	109
PID 5148 wrote to memory of 5516	5148	msedge.exe	109
PID 5148 wrote to memory of 5516	5148	msedge.exe	109
PID 5148 wrote to memory of 2324	5148	msedge.exe	110
PID 5148 wrote to memory of 1064	5148	msedge.exe	111
PID 5148 wrote to memory of 1284	5148	msedge.exe	112
PID 5148 wrote to memory of 1548	5148	msedge.exe	113
PID 1548 wrote to memory of 4268	1548	zen.installer.exe	114
PID 5148 wrote to memory of 4576	5148	msedge.exe	115
PID 5148 wrote to memory of 4576	5148	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://zen-browser.app
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff840dfc188,0x7ff840dfc194,0x7ff840dfc1a0
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,13721463193930032214,17556636085095398637,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,12580883461449689517,12186104128412881100,262144 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,17787452984624934543,6462632559253602727,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,8792606524583855463,10767490500491833119,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,10302018371714602396,56867581367265233,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,4356104205078313688,3588738990469570593,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,12488441447742962671,14210748189647268629,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4348,i,8681263127900513701,12326817755928169480,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4360,i,6244724987623272800,9252087652551185057,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3592,i,2945404381516028517,9111362130700715533,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,1154686665062247288,18270523353110500994,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,10739319427748409643,3170043004412444874,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,12389145855717926505,12993528249484431541,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,12389145855717926505,12993528249484431541,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,5194250153872611618,9812042807033657645,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6636,i,18316117449280461308,17208710068367963322,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5420,i,13838766185363304250,2453192042757058917,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,17821140981653337241,3715714353207050613,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3532,i,16421220733431982648,2887296445124058697,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6860,i,8193659935498892993,11948185948163655253,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,1030157598163373347,666587434935182867,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7484,i,4958296767541380994,9418688900063536099,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,2525304170362050786,5307985584920894030,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3604,i,2829992296218903473,5879658535548793968,2097152 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,1417254925226455377,3577982982901625832,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,2095229830490693355,164730820212032194,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,4519011963245839251,5487980789263945954,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:14
  2⤵
  PID:1284
- C:\Users\Admin\Downloads\zen.installer.exe
  "C:\Users\Admin\Downloads\zen.installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\setup.exe
    .\setup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4268
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Zen Browser\AccessibleMarshal.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4056
  - - C:\Program Files\Zen Browser\maintenanceservice_installer.exe
      "C:\Program Files\Zen Browser\maintenanceservice_installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:1740
    - - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1060
  - - C:\Program Files\Zen Browser\default-browser-agent.exe
      "C:\Program Files\Zen Browser\default-browser-agent.exe" register-task F0DC299D809B9700
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5848
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2032
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask defaultagent register-task F0DC299D809B9700
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:5368
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2192
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" --backgroundtask install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies Control Panel
        
        PID:5980
  - - C:\Program Files\Zen Browser\zen.exe
      "C:\Program Files\Zen Browser\zen.exe" -first-startup
      4⤵
      Executes dropped EXE
      PID:5672
    - - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -first-startup
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies Control Panel
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260818101929 -prefsHandle 2536:27089 -prefMapHandle 2540:307472 -ipcHandle 2584 -initialChannelId {004c2dee-d0ac-418c-99f5-d9d87badffba} -parentPid 1632 -appDir "C:\Program Files\Zen Browser\browser" - 1 gpu
        6⤵
        Executes dropped EXE
        
        PID:5400
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260818101929 -prefsHandle 2852:27089 -prefMapHandle 2856:307472 -ipcHandle 2864 -initialChannelId {2a4ed6c8-8d3a-401f-8206-05c36bd3b06c} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 2 socket
        6⤵
        Executes dropped EXE
        
        PID:2856
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 1876:27192 -prefMapHandle 2144:307472 -jsInitHandle 2148:161776 -parentBuildID 20260818101929 -ipcHandle 2184 -initialChannelId {955dc54c-59a5-4261-86fe-c0f7ad77dcd5} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 3 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1528
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260818101929 -prefsHandle 3712:27797 -prefMapHandle 3716:307472 -ipcHandle 3724 -initialChannelId {cba0db52-dc40-4b46-b42e-2a9c86d1a929} -parentPid 1632 -appDir "C:\Program Files\Zen Browser\browser" - 4 rdd
        6⤵
        Executes dropped EXE
        
        PID:2660
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3992:28108 -prefMapHandle 3996:307472 -jsInitHandle 4000:161776 -parentBuildID 20260818101929 -ipcHandle 4008 -initialChannelId {910b794f-1e74-49d4-ad6f-7e4eafe489b3} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 5 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5788
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4760:28414 -prefMapHandle 4764:307472 -jsInitHandle 4768:161776 -parentBuildID 20260818101929 -ipcHandle 3896 -initialChannelId {d6b529cb-3e73-4996-babb-360fd24a8617} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 6 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5276
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 4944:28414 -prefMapHandle 4948:307472 -jsInitHandle 4952:161776 -parentBuildID 20260818101929 -ipcHandle 4960 -initialChannelId {a0a87636-d76f-4b0d-b793-e78ad0711879} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 7 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3636
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5164:28414 -prefMapHandle 5168:307472 -jsInitHandle 5172:161776 -parentBuildID 20260818101929 -ipcHandle 5180 -initialChannelId {64d22aa2-d5e4-4823-a077-50ecc91a0dea} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 8 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5448
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5608:31517 -prefMapHandle 5612:307472 -jsInitHandle 5616:161776 -parentBuildID 20260818101929 -ipcHandle 5624 -initialChannelId {4920250e-3e81-4874-a377-f5a8a7d545c7} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 9 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5612
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260818101929 -sandboxingKind 0 -prefsHandle 6252:47818 -prefMapHandle 6336:307472 -ipcHandle 2264 -initialChannelId {d10c413d-a690-47b4-8c96-7a3f270984d8} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 10 utility
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1768
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 6680:46032 -prefMapHandle 1532:307472 -jsInitHandle 1544:161776 -parentBuildID 20260818101929 -ipcHandle 1176 -initialChannelId {9d96e64c-4374-4b12-9e34-e06eb6e2372f} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 11 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6376
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 5612:46032 -prefMapHandle 5676:307472 -jsInitHandle 5996:161776 -parentBuildID 20260818101929 -ipcHandle 6712 -initialChannelId {9a4111b5-e778-47f6-ad1f-4d2d93735b78} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 12 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6424
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 3180:46032 -prefMapHandle 864:307472 -jsInitHandle 1172:161776 -parentBuildID 20260818101929 -ipcHandle 6720 -initialChannelId {6959dbd5-adf9-415d-8c5d-eb36a32df7ba} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 13 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6448
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 7944:50665 -prefMapHandle 8352:307472 -jsInitHandle 11272:161776 -parentBuildID 20260818101929 -ipcHandle 7912 -initialChannelId {71cab921-1993-45f3-b985-e5f97fb05e06} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 14 tab
        6⤵
        
        PID:10012
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -parentBuildID 20260818101929 -sandboxingKind 1 -prefsHandle 6204:53733 -prefMapHandle 7616:307472 -ipcHandle 6900 -initialChannelId {98bf353a-60c7-4581-9cae-2420b8224fce} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 15 utility
        6⤵
        
        PID:7832
      - C:\Program Files\Zen Browser\zen.exe
        
        "C:\Program Files\Zen Browser\zen.exe" -contentproc -isForBrowser -prefsHandle 19508:50665 -prefMapHandle 19516:307472 -jsInitHandle 19520:161776 -parentBuildID 20260818101929 -ipcHandle 22508 -initialChannelId {aca3a657-9bf7-44f0-a514-60a8128c467e} -parentPid 1632 -win32kLockedDown -appDir "C:\Program Files\Zen Browser\browser" - 16 tab
        6⤵
        
        PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,715317012900548708,15041002363977411170,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,1819224005126315519,8184265255264493339,524288 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2912,i,1665981204363083229,16571644443220088228,262144 --field-trial-handle=2128,i,8629630048163865530,14264480347344540401,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:10
  2⤵
  PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PrivateBrowsing_150.png

Path C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_150.png
Size 9KB
SHA256 2ee22aa49d12fa9146274dc5a03793fc45bb632bb341799542516fb17c142371
MD5 2b47f5fa099f97fb4b7d1a88aa494541
SHA1 eaaf09c44abcf6f7495224a3a3d8e651afe59403
SHA512 4e4e03b804c64085e701055f9b741f99b4715807682a7141eca184a6ad03fb7626c9ae6e9f74a6dd54d717330b154a68193e52cb97f66bd232f788c77ad01e9f
SSDEEP 192:379hCymCdj+pGzVoFkPc8Y1F266DMQdcv+mwI4NNR92uITz5s:r9sojPHQFVJ3wLH92uITz5s
TLSH
T19412BF20F215CF2E91743884A4CAC6C5D23B7217F7C02074482FA4FB1C2EF152AB5AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateBrowsing_70.png

Path C:\Program Files\Zen Browser\browser\VisualElements\PrivateBrowsing_70.png
Size 4KB
SHA256 c348fb831e245763f6c1ca74e769599daf4b88d6b2487144a5a8a58c7172d9e5
MD5 f938a334dac97a3b99e020a4fd45e39c
SHA1 b476456542430be300a48bed22dd0b3c496b9920
SHA512 d2f490a4bae244ded37dd6270f01a24e461cc2df2852834133b7a38db7b3f46221fbccc8d66b33eb2237803174f7e68a7b65d28eaea759f990ead3a203674b67
SSDEEP 96:fqPxsxciKQQsIBEzEZXhaOec0AGHL5lYRTBXWAhh3+KW789+q5:fqJsxXQsIK+XhYc0AGHLSWArBSc+q5
TLSH
T1EB919EF983A10CEFBB40289FBB26A67DDC470D7590063234BEC155E32675A9E09E5251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VisualElements_150.png

Path C:\Program Files\Zen Browser\browser\VisualElements\VisualElements_150.png
Size 102KB
SHA256 68e5025e6835c0142272276dba9a3f2ad8cbe6f6ad8c425882befd3146a9f7f7
MD5 a0ce9ccbf2dbdb3a3d2e044e0f74bc7a
SHA1 88cbe63c90dcbb5c9abdb48a983c4f153513f8b1
SHA512 6f7556d3622868599dd8f3dccbbef21fcd3c9a71349327f2474159a7131d563b176f940882a1c19d3cdbede983bcc436a7f61b50a7495a0a553c6d95e77ee10a
SSDEEP 1536:XqShEeITCdH1Xxi+BmgdUMhh3le4HQtOfRuWaGOaOK3Yf8QKaqaZAtyaiWNy:as5ITAVhXBHTaOVFOaOKjQrqaoyau
TLSH
T16FA3129A941BC481CC5E19B2486EE06865BF95C752264AB4D03C7CEAFCB917CC186D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.pdf

Path C:\Program Files\Zen Browser\browser\blank.pdf
Size 8KB
SHA256 81a4b1da9df2cfe8f229abb939591b708e2a6ab7d4bc58d411ddb471d0dc3964
MD5 0a98a0712d09cec3945c0728b0c7c465
SHA1 f4e62cbdc0afd816e24929c2a6e71e63072c4b32
SHA512 02619d47e399fe4ccd8138d58f68acd9d692fa61a59d43ed5bd97f709916c4de781f83aa32c9404030887afd55467aa2fbf9ab086fa8ed858d3aeb562da6ee0b
SSDEEP 192:KCYALPEyUKCIoYxrfJeHrJhnAynX/fCQCwQwJsqYmMNVoDVoCow4YePa/TY61/:WUP8KCIXxrOjAynX3hCwTLbMNmZLPeiN
TLSH
T1B9027B34E99F5C5CFA94CA1BD276B70D8E99B10F6FD8349241310F52F080971EB6A2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kit.gif

Path C:\Program Files\Zen Browser\browser\components\shell\assets\kit.gif
Size 795KB
SHA256 97174b9abfc2c3d18b2c59e87790bfc663680dd73cd6a53fbe6a84ebd50cbc3f
MD5 326237f5a642098ae0ab233be9b54c25
SHA1 114d336f7d7c2dc8b703e82cc8add45fa9cb62e3
SHA512 202e75960f347754cffbabbd7c85a05227e237b1c6a7a100b611549273d362375da187949df1b6847f271209d76c6eb1fcf41abc89071b242b04aa3a05daae2a
SSDEEP 24576:gUkKnMUIxX0YuxsKt6KVlEK1Pqv1lf2Ql6NRqN2:ginMpxX5Y6kWKBqv1B2QlEB
TLSH
T19005136E02364F79FE2B1438320F16F1488EA49DB9FDE13768F5F9D2564A52860EC853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

confused_fox.pdf

Path C:\Program Files\Zen Browser\browser\confused_fox.pdf
Size 51KB
SHA256 e2916092e9764860829db21b78ab0fbfbb22f976687e65716ba7dbc16e954ce8
MD5 10aaade034c04af93ad3c805642e5b0e
SHA1 a6e98403bba37c9e87c632e4a8662284a9098e3b
SHA512 9b9621dcc753e8d7b545fa225b2c3504bb8606bcb4b5bc8dce4844cac7f82722bb3882ed8170adb7ef737460b07aa1b078c0ed820ed9d22e19b39038f3c157d1
SSDEEP 384:4c7vp5LOr9QrOjRzYOv06lPBP2R7uJS9lEWHEugiGB2LtlC:17XWRH1J5DSX/HEugr2O
TLSH
T1513363F291801999F401CD789F9F3D9C109E30ABEED98DDA74FCE711AF228A429E51C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-prefs.js

Path C:\Program Files\Zen Browser\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
TLSH
T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
MD5 SHA1 SHA512 TLSH

Submit Download

TwemojiMozilla.ttf

Path C:\Program Files\Zen Browser\fonts\TwemojiMozilla.ttf
Size 1.4MB
SHA256 6d90152ee0d29e82fe2a87793af5aa4b7ad13e6538360889e141e81ed299ee8e
MD5 aac75d901445bc0419d56e56dbc18891
SHA1 3ada434f3a727167ce6dce3b865fa6bfb70ed86f
SHA512 83fd92ff444ab6de18d48997247f49845abb8420a07b74ebc8a65bda8da69d28f87b6abe0f607b2fd7da398dc0f8cbe7fbf655af6d25785ad8b2f1a3afca136a
SSDEEP 24576:jUx1tOjzy675RUa0cHib00er/4TMXvBo2IvyCPKsUxJug7WwObnkBl0Z1koEXdwV:CeIa3iurjIExYrdz
TLSH
T1EF656C3FA704CBEEF4951AF6C9640A27B5D08D8522021287F74DF87F8C9D3985897A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clearkey.dll

Path C:\Program Files\Zen Browser\gmp-clearkey\0.1\clearkey.dll
Size 111KB
SHA256 ca4ca48da9fbd278fa2d39a5c74ebc7e930eac94364bc80b8799c8e1d088e6ee
MD5 c9f1117e48e254cfe3efc09b4030c0c9
SHA1 d57be2f466325888733185e420228f07eba4a5c2
SHA512 5eeb9356e8f2e492cc9c19890ff56711a236e6ab7ca8af99f4a5079fcc21fb60fac3dd5b2cf20100c9092facf42574e894ff97c99b1a29e4002cfb8e67b3012c
SSDEEP 1536:jY6s17lnEmSJjxNhcHreZyyFnIR20TYgGKkwOf6kL7oKu:sZZKv6LehIR2yYHKkwOf6kfoKu
TLSH
T187B33A13EA9A90BFD649D97886475802DF23BC864B5276CF53514EDA1FA2BE46F3C300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\Zen Browser\gmp-clearkey\0.1\manifest.json
Size 229B
SHA256 ef47e83036753b53f59d079fef62bfedc749abdbcdb0fe16f448d9920f11114c
MD5 cffdadfaeeaaf0a5a78e7f9a299aa7f1
SHA1 7a8f06d7c91877484301ce8474dfbb1bde08a040
SHA512 5a11e448389326ddbd3be792d9a10ae746c66e4a41f9c96f4979ec71fde385fc4deb205a40f1b4f24415abd9d41c453ca1285f4b813005b1d12a2701f214db85
TLSH
T100D09214C812DEF33CECA2295D554D5867A9129B19823C847B08174EDF599BF92AAB0C
MD5 SHA1 SHA512 TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Program Files\Zen Browser\installation_dir_layout\versioned\InstallationDirLayout.dll
Size 19KB
SHA256 3b02e75bfb20b84b0cee054cece6b200246ed69ce28a15647abff10bdba0a5e3
MD5 c4bfc33d366cf0b2604b7f432fe19493
SHA1 4330d01b4992ebb0ec55e651195b99100654c672
SHA512 176197fb259d1ceefa8e14c5b56616e4aebe2d988991a51c3442b883a619cf31543ba15ef94ab2d9c0e84a2c7d9b204f0c3589ac08bd0a3d3f9c11a1c48efdfe
SSDEEP 384:yNmCCN3LNn2dBcFu46dWl2mNDsSofousJUKURFD2pgOSv:QjwtrgVsheSoQuoacyO2
TLSH
T14B925C9AAF6044E9F9178A3085DD491BAD72FB901F9141CB6219048D2F937F93F3932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Program Files\Zen Browser\onnxruntime.dll
Size 9.3MB
SHA256 d6da95491da4239fce93e000e066821d1d9c0cc22bb63083fdfd8bfc4248d2b6
MD5 668e99ac0c21bab9b5f0d43aa0dc69e7
SHA1 00ff70461b31afac7f71f6fa63738abc7c7948d1
SHA512 07c1a98bd5ac7c0a7d24456cbcfe20a076806e1af6ade75e28ae62ca5933ac3d3cd421feca322b48949646f7cb3eeffbf65a685b46015b2bb9ae8da6d5fb899f
SSDEEP 98304:m80OXTtRrQH+MEXT0Eo6AeF+R81rZTCBe1a8xEiwTtpXd04aye:m/OXTtRrQHBXEo6AnRcTCBe7xEFtDa5
TLSH
T11FA67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB01E254912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Zen Browser\pingsender.exe
Size 77KB
SHA256 2c617c5a6df494a3d420c18916645eec2940ac39aca007606a98c7ed5b5790a3
MD5 80cbb7dda39867db5bf85ff33a366e71
SHA1 c2a0e266dd9bb6502fee3ec85c95ce7472888fac
SHA512 14f6b02f72bd36f9a1ae3918f28c1db099c6f8084961613ff0ec4c0263c5e1809b2baa7dca2893132237d0d93354a5918d4fe956524221fb8280b1ef74e4c7b3
SSDEEP 1536:+MqDYRoDMwGZw+adBkQVybQ3Rn6dhi596kL7oIPcR:+M+wZw+a0Qph2i596kfoIC
TLSH
T1AA736DEA5A6051FAE451C2F0D2EB1313EB7575892B2666CF938452623F037E01F7D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Program Files\Zen Browser\platform.ini
Size 156B
SHA256 490364f28e85442aa3b352c32abca9b0af5ea7d6d5860bbcc838a0358247c1dc
MD5 069eb5d131bfb58945a41b0bd0aaf3cb
SHA1 3cfe0bde7ffd8fe5a6106619d6ec632fb2786dbc
SHA512 9c57a9f760af1eb86dc626e490d11977415edc44d5c0d568fa54aed9b6a927b25f0d218cc62865ec26519d96cab801677b86a424e92760a79cf886813131c507
TLSH
T1E3C08CFB440C00A80F19B5A6A8A01BC3958A1D829FDB100DB45240440EB54269AAE0E9
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Zen Browser\plugin-container.exe
Size 171KB
SHA256 e2731c200e8c8c7b7e594afba035043601454f94766a43220ed020e1646fd77b
MD5 6dfa1f232a7ee1b024b4b2c4ae4d201b
SHA1 4d27f0db0f555227474bdd050983f486e0accbef
SHA512 2c1b6aa43b4ce5e6d32d4442d387a19a38d7b4ba36885047781cc12ce4c7ea7260adf7d53322cfcc5c6e0945497c1be4d15be22e64373854d624c50ca8faee22
SSDEEP 3072:nGpvuLG2oXZdRWnRDHDppEnSDDJDhn3UTd5dhFu9+JGtNz7R6kfo2:GkLWXJWnRn7FZD5odhdMtNP5g2
TLSH
T1B7045A13EA5950F6F559C9348B828122F972BC824B20A5DF2B451E712FA4BE4FB3D352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

precomplete

Path C:\Program Files\Zen Browser\precomplete
Size 2KB
SHA256 cb216a030603926f2e937eef8ccdd6a8da61e7f0bc50fd00ff45a1053defacd0
MD5 6634a2cedc191ce2ee3185946a8a584e
SHA1 a1c8240b50de6fb1b7d316caeb89b7b59c1ed3d3
SHA512 f732ef029a7030dcea2adc6b57e93834bb5491718c399e657ffe50b23c7476697e1c36be210f49579929130f6b57c9c3c9bad79d3c07be7d57731cdc650ecd60
TLSH
T12741138CD05EEE5569DA51C884D31D8F3DA702A6DD9DEA780EC301447FD39EF010D62A
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Program Files\Zen Browser\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Program Files\Zen Browser\private_browsing.exe
Size 132KB
SHA256 ec0b819c6670fc38f5a156ebcf329a2e3e16a45e5f72db996ec7683bab891424
MD5 5aa0e7b29e436ef2f41b728c1dfbad83
SHA1 f2d7ae93944186a61154493e2818cd299e7478cb
SHA512 3235925754f7cc8d3d0bca2a8afd7a3f7ad326d8321224541eb82a9f3c994cd1ca16bd08307e01e78c95a5b2f233eddd9aee4ec5f1e56da5b6c767c04f5aa121
SSDEEP 3072:R49i0HZNqFx6m6N3MbE/66TsnA7Ftf6kfo0:RSDqH6m6N3Mbu66gnghg0
TLSH
T1B0D34F8A9E858E57F07CF17E45BA4D35D55AA60F230051C3BF3CAB83EF58B94282D606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Program Files\Zen Browser\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Program Files\Zen Browser\softokn3.dll
Size 354KB
SHA256 7ac809ff546d454182de3094927803664d1425b9951011a1b20dd113b34d1a2d
MD5 9e0f50ee4b370a5e64a5acf547ba609c
SHA1 f2599c14054980bb2f3fa9976ae072ba9734ccda
SHA512 c2dc09bf5fc668891046059c81625b58c871ea6dff294e519f74886db9d54b97cbfaf9aa86cf257acc1ef710d25c9c4233ffb7bb341de11aab3af7c78cd947dc
SSDEEP 6144:toh3I84QLm+Laevr1THTsYlOZEFJfA/5X4rUIw3N0E9kW9FdM6Ggj:to5FLTxPsu1Q4rpw90E9kWjLj
TLSH
T116744A03FB9165B9C815C57491578733B5B3B8980765ADCF93289B2A2F61BD0BB3C388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Program Files\Zen Browser\uninstall\helper.exe
Size 1.4MB
SHA256 3d6ed4d7ef1529c4fdeef3a5e6255151ed0f67da6e885283607ed09bb14177ba
MD5 266abe89d011dcb4870425b5d2183d33
SHA1 c398a6f01412a6b4e431895258cc41bdf46fea6e
SHA512 7ff148678563c6f3412a5e72e7e84c8f9b3500650e78ac4644dcc2bf36b4aa77b658e322f7e6bfb0371e000109fd231d24e0269a8396d2836ab07c3abfadf1a0
SSDEEP 12288:TTCUjD5NUTj9euP+bnEPsSjlSoTUJDJm95+B7a2SooEPQn:TTvUTBhmbEPsSjIoj0BW1oZPQn
TLSH
T1F7651803A790A822D46E6D3064ABD7253B37FD812E7186573B1DB39C5F73340AA7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shortcuts_log.ini

Path C:\Program Files\Zen Browser\uninstall\shortcuts_log.ini
Size 198B
SHA256 5fbda59442223c5d2fc4779c116f314fc4ee448ab786e102f570aa5de4336cbc
MD5 c18e70154afa4c346b4a5f28ca9a5664
SHA1 1c71628ac2c1609c57db351a2127e16834947173
SHA512 476971174289ce8dc076deb5bbfcdd21d0e55f3dd7ebe635702a2b9d5c4c671713e06c0185f157ab731f7b0c3400e866ad850d7c4990e70ec9624112c5cca3f6
TLSH
T1A6D0023206D60229AE465F81EDE84179DFA6F959609DCB0CF082161E1DF4440C9925F7
MD5 SHA1 SHA512 TLSH

Submit Download

update-settings.ini

Path C:\Program Files\Zen Browser\update-settings.ini
Size 116B
SHA256 17224c6040c70203f9228f35c345ba7f72e3be84ddbada6fb8f971c701e87e30
MD5 68acb4ae209a1fe7910b85a3c43c5cf2
SHA1 c70a6335fc65b17453a88e59bdcec7a067c94cfe
SHA512 3bd99664ce6abd681bcf8c089c7db5759eafd165d6f00adaa8c900f7b988e98cb99342778e90658ffb17660ff95023f49f8efeac28bd7c366a208df6c3e1bece
TLSH
T191B092895A94A84C8113C462EA6D022305A2C529090521252748E441B3E77208ADADAA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Program Files\Zen Browser\updater.exe
Size 984KB
SHA256 d1bff198422596e80012d7f192aca9620b572b499ddb0eca62bc9dff63867766
MD5 e61213f3291df15c56fecf978a9d5ac6
SHA1 48d625ec8d652b73e6ee70338f5c47586ff74b54
SHA512 985353eb3aadc2008755c974a68755972539864a4313a0ea7273e55969134334da85b12d7001725e31e3d6125015dcc9d5c66a93c0d25266fc5f8c70252df195
SSDEEP 24576:igQyntqmpcnGfhxPyq5L/Xrkwh0lhSMXlBwJ+R+X:ientqmpcn6hxPyqwFVo
TLSH
T1C125AD1BF7A041F8E459D9748BAA4513EA32B88A4721A6DF03D49B552F73AF01F3E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Program Files\Zen Browser\updater.ini
Size 1KB
SHA256 a6d81b46188b52069c2582dfc6b4d682bb722c2436cf5f531fe6ed0c94952c9d
MD5 27a5a5f5ae9b41546c9b6c7a0eb6f026
SHA1 21dcaed4a05199f407230b60fbc554a23e195f33
SHA512 a6208e3819debb7a169adbfec9a426570acf5e8117258dbf8faea4d886c923007e52cdb3cc46028878c3aeb810a9f7b9482f92b1f77b5899319a1644156b11d4
TLSH
T1F62121562688B3F409D29B85BA4633D6D78381ED23513120A0ACC160434793547FEBE9
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\Zen Browser\vcruntime140_1.dll
Size 36KB
SHA256 a96257ec7e79ca3d89c771cfd5a1e9addd12c30a32da75e3d62595865089bb3b
MD5 a4001207688065614971ce88b819b91f
SHA1 4872fbffb87d1115bf045a1a85140404f95000d8
SHA512 e90393206f7ae4a65d4bdbba6de465d33ffb3a42d846e4e1dd236a1280bfff12d814c1085133794cebbb847f5cf902b3c4b758f1f0769a668c148bd7865faabe
SSDEEP 768:rezSkbhNfI4fWLZyS/dPWxuVsheSoQuoaK9Pf:QYZyuPWxu6kL7oLl
TLSH
T1F0F26C1297A840E6E4A7CA70C4DB0E2BFE76F590976087CF2A68455D1F137E06B3D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen.exe

Path C:\Program Files\Zen Browser\zen.exe
Size 1.4MB
SHA256 c30ac226f67a265598cf1930bbcafc3af4213e3aedf3cea546a39067c9f31481
MD5 7281435515cd86625e1da722bf043504
SHA1 0a0ef833004133e23d483ed0349a9014e5362520
SHA512 0f7d5d7e8367b128f0c23d479177eaa19311845ccbe0edbbe1f5d24a9abf0903d9353e0671c0acb5fe3207baba6ad3233669382253cb454cf2158d5d41211828
SSDEEP 24576:MvOYBAGjeF81wUQUgD9jaCwJUrXRErmyFAeiHyF68:MvOoABuGRJBjcJUrmyyFFiHyZ
TLSH
T188653852AB84CDBBF038C1388572CAB1D526BD4E57D051C73EAC7E633B75A8016FA612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 2793abb1f946f8671886d8f9790b47473a53093fb3753d915355c0077a5b6e25
MD5 c2e33c579cf6cbf0c34adc24bd48d43f
SHA1 7595cc066ed0b89e006ffcc1b1f1b9fbb1a075f1
SHA512 29d05142073decf3b42e84e33bfad03473086f9d2f756f024d96d6a589bee30f3de9cca3f2dd3571a32939b28887cddcf67b3a7f4e9520e5081d964b34c36099
TLSH
T1DA419D1047D56639F1B75E3246713B3147B7FD80AA78826E828CC2C40571030C56DBB7
MD5 SHA1 SHA512 TLSH

Submit Download

Zen Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen Private Browsing.lnk
Size 1KB
SHA256 1f70f7f06f1e685d028095c8b7a9c5217f2b4282d0f8bdd33749acf427258b8d
MD5 da68b66e825c25df244a0c08541a9d87
SHA1 896ee4f19debf8a588b3ae03bedfb11a08fb8641
SHA512 e31f7ecaabe255d4e995593e36f42b0bde7e18d3f2992862d07a067129e755fa1cf8a5cde87f2eba731c0fcce0c94d4fb271017f6fdc684630896d3443587e6e
TLSH
T11731381047D16675F1B35E3255323B3047BBFD80AA79826E828D81C50571134C66DBBB
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 922B
SHA256 4358493237f266a35e35cfea46cb1c29f5effd149600d213c8898e59c40edee0
MD5 8656e9cdac2ab1b183cdf06d329d1bb0
SHA1 8e071ba6d47ecdc572ad79831635dfe87dff6082
SHA512 aba7efaf1d42cc1b344a30ce2db7857d89a1ac6c904ca8fd7738aaebe95e3a5008a77bfba34c172c585438e02dbae90ddf7d5bcb2b8889950fce828b40585ed0
TLSH
T12511890087D62B66F1BA8B3015712B32CB7FBD05DAB9435E82C841940874124D51CFF6
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zen.lnk
Size 1020B
SHA256 934ba5a784923820808e41f4fbe9505568498c6f3688b36158e952dfa125412e
MD5 69004b13e19033385ba31156ddfdaa22
SHA1 aae06700ee14eb49adaa608ff0ab235c9183335a
SHA512 e890e80c71ef3479fdb8c8a406d962db9b554d7e2441acac62f2de19bdf2395da1906cfdcf10f9a2419a2f0ed7a95cf4161c5160afc4c6d60233ebabe25cfdee
TLSH
T195118C018B9A2B76F1BA8A3115B12B32877FBD05EAB9435D828842940975524D51CFF6
MD5 SHA1 SHA512 TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\F0DC299D809B9700\update-config.json
Size 78B
SHA256 3f7b3252ef3b6217ad78adb7007738601ce1eebca69f55990b64bf254bd4fc63
MD5 fe74f5c38f433736ee7015868cfb159e
SHA1 f723b0032565fb3007407201963f7bb762bdd981
SHA512 19fe20baff40c195955a921ee2fe1927d00da14e0ed3eb683e5f6f026353bfcd5322a1d2399b8977bdf97bb23dfd6cc811c9a9494f019b6e404aff477316cafd
TLSH
T1EBA011800000A2A8B0E888CC00302A3E02888028008B2A02800A30A0383A0020A0A8BA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b83d8b3b3bb64ff97dfd21017822c565c50fa4655623c882c9854229a2eb9fc0
MD5 2a1c26025a16af9770d1943aece12b07
SHA1 e99f200ab4b656082ea4283baf673ac37faaae9d
SHA512 c6a6b667c750c33f99946cd667b400c38692f5bf6c8cc28971c0ef5899c7166adba2ea6dda0f083bb68464d66d757a9fa633c1820e825946725f45a260f459cf
TLSH
T15BD09B313F5A7451DA451235584087162D554445155793079151444DED9509493C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 dcf60ef88c0afa57578b4422afc82fa8cd9df668e5a558210843b9688906bda9
MD5 585cc75aaeb6dc94fa9d10025e6eb1a2
SHA1 4a2e4418aec05668a45df26250a75e7b22f8a72b
SHA512 2d76a944cb7116b208475ee79ce203e154cd9b161c9fc7ee8e2b743d35208af2b15e51500fb282dd38ec93409b2a7035fe4b33e45a9472cdabb67b6e9a4b7b35
TLSH
T128710D040B4205D9DB95C9F2E893CACD3A35CE6FC906FE66134494BEB1167614DD703A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ec413028265a157e16593f709d8f01ed29894dfc0c19e50c7916a62c4a7c2ba7
MD5 96ef58daae0e87158bb0cbabce1ce55e
SHA1 7ab670bedf2780b2cfbdd7ab95a1bfdaa5c78d6d
SHA512 a4d8137ce1f8097f03082e7208be2a108bbba907b6310b1a23f1bd74a97a037bef6f3266b5d9f4cc8a40b39820b39e77333c4ca8a1c24e8beb5eafd7e1760ff2
TLSH
T17241CDB7C3E586AE8D1192F0AA147E1BCE5C0528431C3C6A88E1FF5BA3E3871E11165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ad668f45f2727f9d0c233ab70097ad31650564a37dd5dda998bac958a2cee1e0
MD5 dad680f85e15c6d78144bc37ddd34926
SHA1 47fc4f39aa413adb05fcdb1b147ca45adf39d293
SHA512 a5bc20c8110ee46c2dfbef2fbd5698457db321f9d24bfbf30786bcc0f3c7aed6da84a17a93959a4eca3362e3b6015712b814596800a28ac5ac7b6502299429a2
SSDEEP 192:sxZzRw1yM/jK1Ml8UQxo1/ftsNH3kIdprY/W6+WNNfzXY0aID4rIg5jJ:sxZz+qq1/ftsNHNU/b1X5iX
TLSH
T1BC52E911AA345E77CCDBE209B955BF53D6F9447292900E84AEFCCA1C01E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c7d0ea65f750e716c224389d1e85e7e1014780e4102599661b6d17a78e95590b
MD5 d58d67c81eb5f0047231b4bc29ca36a7
SHA1 dd482f8c66134b7476e6a4e18096c671e6dce742
SHA512 50886fa94df8756d927b4cc2e2395e8b5dbbe18d61e47b60d608b9e49a402cf87f8ccf165f4b9436d8c76584d13dbb541aabcf0367f97d0e0b45e918f04a15e9
SSDEEP 192:sxZzRw1yM/jK1Ml8Mo1/ftspC3kIdpZY/W6+WNN0o/Y0akYJrIgrJ:sxZz+Q1/ftspCNS/bt/5c9
TLSH
T12252D812AA34AA77CCDBD209F955BB53D6F94572D2900E44AEFCC91C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 9894654bd90fa0bbf3e0fded1ba2cf4c9127f6328de1663179d2d6e72c1bbb1f
MD5 11c269d3c83e0285c62f0545971b7bc3
SHA1 9e3c281eafb3d200dceff5550b369f226a8e8958
SHA512 94207b6e1cb77a333a767c41f673150c226fdd203854f4b9fe0614775c04991614b67a1711c24e3dd912ed3b8105b5b35d21b537a4222e42cd53392983934fa0
SSDEEP 768:3W/zh8dF2PkWRmEcQhw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VKcroH2:3W/zh8dF2PkWRmEcQhwu1jaKWjLp2tV1
TLSH
T1F9E20A2F280CC77E4F844E9CEC26AF966ED801CB66584D544BFA894C03C77DB521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 df4df8cd5b20c76f9fff3ad04a3cefa55781f42d0aa8f94d8f453c999ffe2232
MD5 585a3619ea7c0e7a63ecfe673af429bd
SHA1 122e955b059e6c3113b564e4e312a6c45a653d09
SHA512 fe16b03f4327acb4e3334a9c232bac65a1bce9d9336a49f61f856ae5f827b37731b60ce70a461f34b6479536203d7aa937bcf70bf1eb4db551b03616b72619e0
SSDEEP 48:KEWIHKv3XIZKsQELypAIzK1a87yZuIXKjaMB:KEWgKv3XaKsQiKAQK1a66uIKjae
TLSH
T1FFB1074671BB82413C7E250C93A4C7575B42F2A37028A92B7BE810755E27E385EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dca0168e-483a-42b6-9984-b05fe10832d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dca0168e-483a-42b6-9984-b05fe10832d0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58dcde.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58dcde.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b48062cd1ea81e9d62fb0f3c614e88801d62b8b25bcab0edee20f46ab157914b
MD5 5e0c2f9241d9133d38a63f13b9e98b32
SHA1 4812cb15e4bb8bafc92a5066a3c65309480d7539
SHA512 63fe28d9f044dab42cd91344334c07f1a4fb80306d14e1abf9553c6204aa8a6c634036f139a2303a5c05142a96e2673c5fea6e514b60e62b5f160bfc6fcf075a
SSDEEP 384:wZcIh8Njul+VOauJOnjnsudK3V/MivI3Aoa:Oh9larTsueMiAQN
TLSH
T1C6826C751C749C771AA6E585F48636138FF89067EACD6EC094DCEF1D00AE9A82317C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2f22afc7e241b5db4be0936121304253a12218afac3251fa9fdda44bcd1d159b
MD5 10a812d372a5e2c2aae00f785b34bcd9
SHA1 129c1ec0dca81a3afecdcbeb10daac059f9c6e1c
SHA512 ebcf951904798c71e45e787e246ff4229b266b6ef7e78de430779a92d13f814f8c4689864ca4a49f1201260d80c4cf04ee5c90401b31cc1655a98dfa59647730
SSDEEP 384:FZcI58NjNl+VOaumOnjnsudK3VFMivI3Aoa:95slaETsu8MiAQN
TLSH
T1A7927C751C749C7719A6E585F48636138FF89067EBCD6EC094DCEF1D00AEAA82317C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 00bb92c0f66c1e388718c31cc85c9b89dd79b054affb44c23ad7e18e6fa32abd
MD5 64d30153fe0dc24a35ede8edbd725e9c
SHA1 39518a2a65a8f5b13b7c700d9a0eb11f508a4b62
SHA512 0d8e9eb5c5df3c5a31f991db1d7f9e121213e5e86151a1d4f511a78a106a3fc9c665f0446b22af9f501a5e7ce835c1d409eda4df1feabd0127fa876d62e2e73f
SSDEEP 384:/iFwZcI18NK8TUNTUlIlNl+VOauTqnjnsudK3VyMivI3Aoa:KFO1VwgtlaHTsuHMiAQN
TLSH
T123C22BF208D78876D9AD9747E77D2D034EBCC067B9896990B3889A0CCC9A5BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1ecd9c68460cb0fbf6dd20641a5dc901ee95babad01251bd810d7e13706a913c
MD5 82205ebf18708c9ff39631f948ce56fe
SHA1 03c49a1071dd923804641f6c3b4daf4ebe00f948
SHA512 b655becb20626169444a2bb847f66af0923b118f6af806eacb3c81e33539b7e2a666de2074d0ab7adec447653f895b37ff1680a44b5c4b1e7bd976b5cb24cf87
SSDEEP 384:/iFPZcI18N98TUNTUlIlNl+VOauTqnjnsudK3VyMivI3Aoa:KFH14wgtlaHTsuHMiAQN
TLSH
T106C22BF208D78876D9AD9743E77D2D038FBCC063B9896990B3889A0CCC5A5BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 77e4bf0eb3545031109a9249d402d40eb2e1d341a1eef894a3d53a1b020c2db3
MD5 f85e8f1cadcf87a6efc563f419b50616
SHA1 4d8ff861b9ec2662e1a55041712d417e0b1aa470
SHA512 08e1f2392440d3bbcb74889cc268072f2b3232e856d1457d129d56917c70e80ad55383c02019c420976c37cb99bd057865ddbf24af6bd034194d20ca2a1b4e96
SSDEEP 384:/iF0ZcIE8N98TUNTUlIlNl+VOaumqnjnsudK3VsMivI3Aoa:KFyE4wgtlaoTsujMiAQN
TLSH
T108C22BF208D78876D9AD9747E77D2D038FBCC063B9896980B3889A1CCC5A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b37029f90712edca55e590faee754ca314c7858e296ad8421c2e4fa301d47dd
MD5 4ba8aa38d1bb6921d7aaec3d8d460cac
SHA1 e279cb069d66bbe983399baf93595b7015758ec1
SHA512 0d43b43a3e804a223c74e83cbd65a441d2356902843ebce11dc6bb03082eb81fc0c89a8edf7c991b31555e5ce78d5a9c9994abadd29d2ce141eb29bfdf1161ba
SSDEEP 384:ZZcIr8Njxl+VOauLOnjnsudK3V/MivI3Aoa:xrgla9TsueMiAQN
TLSH
T10E827C751C749C7719A6E585F88636138FFC9067EBCD6EC094DCEF1D00AE9A8231782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f4a8bcda91e34398bf4eb0b4d6f684a8a4dd7348820c9bba7f5ae116e4a98bb1
MD5 f6c67ef35ef2b482e8cf7867a717dd43
SHA1 e47ae9cd827f8370f9669f3c0dc4d62fa4e76d2c
SHA512 f13fdd5fdbcbf4ced2d4e52073ac2b6dfc3225c9c7d170b036c727e04d69d315315a19e737e7151922c57ed7411ba71e3838ff931e0d4960c3798d5db8aa1f42
SSDEEP 192:BGNS6P2UOcQmiUyLIUWqGv0R+FdKsswS8hThU6:BGNS6eXscI5qGsudK1eU6
TLSH
T11B02C8396C782CBB8EA2AD45B88777135FE8117BEA962B84D6E45F0C00D765C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71e3679853d3fa7128430c308fccb4d9dc3f65874b9fdb5b7df86cbe2ee30d85
MD5 0a8a690186618e28aeb094b8d9cd8658
SHA1 aac9859dec37d966c8db3a30d488c5ee5c5b1ef9
SHA512 7d9ff8d3a9bb39d65ec9d42a0da0fdb1a406d64db64d5a867fb296b7b9ee83eeb482457cd1c807c950ab779136ed6e4820fd551e9a8403c59e5f641af310e740
SSDEEP 192:PGNO6P2UrQmiUyrEWxGv0R+FdKsDz+VB0B82q9U6:PGNO6e6qpxGsudK3VGMU6
TLSH
T185120A3668B46C7B5E92A945F48736134FF85167EE8A2F90E5DC5E0C01EF6AC2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c10087f8-e8ac-4271-bd22-c6e6bb3f6c82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c10087f8-e8ac-4271-bd22-c6e6bb3f6c82.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

73cbc2d3-055e-4194-97d0-d68f83f3cc27.zip

Path C:\Users\Admin\AppData\Local\Temp\73cbc2d3-055e-4194-97d0-d68f83f3cc27.zip
Size 3.8MB
SHA256 d08c73dd1f32fbd201ba90d0c877f9b972739c0e1fee4f6d816445be1c58fb08
MD5 9b5c5784cd6ee400fa2b1bc4efcd9e9d
SHA1 35fc800590c554590580a9a2e430fa11e9e7c4a9
SHA512 21b695f76d67f6e96dd8f1208ce43116b6058155a92130a59d3cd212f49384544cb7ee11ee7656751309fd7800b408c23524cf1f92927a515f5b3f6109c5f322
SSDEEP 49152:1Ga84n/7L8vRDQFj8kww+DHBshv34yvSDOHPIUlI8R6k+hX9e8oxi6BYCaPO30uc:ca8oF7W1shXRQUlIQ6kwe+DW30uPE
TLSH
T1A306F175E69C1A09CDCFB3BA850D2FC2D84C4FA680E4A96F7A6BD9715CA31E61F44C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\AccessibleMarshal.dll
Size 30KB
SHA256 e7139638f322cab57305d41cc0013f16ac6bc5876d5082045423d40c9f23eb4e
MD5 d1fa6bac9f7d0dc33f32fee3f9e58a4a
SHA1 441eef32fb2f475090bb6b88071035b6ee3ef0aa
SHA512 391694d2885642f2955a111877aa0922e4aace98492ef2037535d39b2105ef30334ae3f13929db9113f8b0ed4e91c57712a5ed16ac8e12912240dcd03793ab6c
SSDEEP 384:f9MSlCaZ8nvlfN0GeUMc25dQru46dWl2mNDsSofousJUKURF0+4h8SAf:nCaZ8vkGeq2ASVsheSoQuoa88Ff
TLSH
T1FED2D455FE0084A5E81D843088DF8AAA5E71FE419F9247C73359332E1EB37C56F366A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\CoreMessagingXP.dll
Size 1018KB
SHA256 f90d77a04800fea167fd4ffcc4440b53b119861a074ab40aa5c78644d87a4153
MD5 8a59b3c28e9a86f13c0150da7641d838
SHA1 35c338337cbb68959ebbf2f37000013de2bbf8a3
SHA512 7e3ece306255a87b6a585230919abe5f97831a063fe45d35b2e26e4b2589e8c246261420a4647abdf3c1f737c04155dd7b40831da39e33cd956f04cac08082ee
SSDEEP 12288:Itl2DdkYB2Zme5NY1RZq3SzFJeb8HzroHCpstWcLObI6DPsb8UsAfh:OgdP4meM1Rlwb839pwWrDlUs8h
TLSH
T197252C6F6FA84097D17AC27E85BB8A8AF2F1B8531B3187CB0451426D3F27BE45979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\InstallationDirLayout.dll
Size 19KB
SHA256 9ef9c5923fcf7bc4114957d3aa5a112bc88b0393370bbcc4b7038d3d20a6082e
MD5 174048204ab1b4230bdb20618291207d
SHA1 6d887800285fff75600c5d2cd711d654bfe4e659
SHA512 54ed0abc3a26b32c76d8cb6ff48a608cca02578253e69ef0202d2203f5b1d18c62331ffa48ef5d096f4085ea02ec8879ed051e210e617e6e85f495b8e17f0d06
SSDEEP 384:fNmCCN3LNn2dBcPu46dWl2mNDsSofousJUKURFnC7S+:FjwtrGVsheSoQuoas7v
TLSH
T127926C9EAF6054E9F95B8A3085DD4A1B6D72F7905B9141CF621800991F937F83F3932C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\Microsoft.InputStateManager.dll
Size 446KB
SHA256 2b82cd63a1e81f2480151c25f731717298a955011148e601e3dd3cdbc4817343
MD5 2cbfc1c1734b932783a3eed10a2ee856
SHA1 b69ad2278f4c9487f208868b297e62938a6fa18b
SHA512 957726699ef111c1ef25fe6b79acd3d8ef15f7c2d27287602b252c3cebcdddc92527539bfd360cdec4801be75285a6cdd454cf015448cd6fea815656cc4d00bd
SSDEEP 12288:ZCfOXk5FPwj04LiaHVnZWz10AmzdTVCKK:EBMLTVnZPK
TLSH
T186A44A7BEBA844A0D136D23C85A78A07F6B2745507329BCB42A0926D1F37FE46D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\Microsoft.Internal.FrameworkUdk.dll
Size 910KB
SHA256 7ae1a04f9d411139fb8845ffaa46952a42d0ef1011712279bfa6a9dc326005b3
MD5 9e09ed45c51e045813547c4b7aa9214f
SHA1 9ca8fe4dbae35ae7d39ece185921ae9655b4b867
SHA512 62a2edbafd5778d96b35fcfa1d37a24ce0352a370c95c8f9bf1510cf68130b6c8e2875188d694ac941a1bef4249d247a3b47a06ca0d6dd585764f3f6da83aedd
SSDEEP 6144:dq2pdSEZxDjmUlfp04mtVkookZea4u2IUWB8Yi+c0p20GHs667I7IK/ECQ23YRgP:PWYdjm9VkookZ4TT+cHH6OIK1yeP
TLSH
T10315741BEE6991E0C4BAD03D9192622FF8B170A68B7057C3D6515A1F1F32FE4A93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\Microsoft.UI.Composition.OSSupport.dll
Size 66KB
SHA256 b37ec22caa7771d0514541d1067989ecf13b6663e49f1e95c93c71e069f92f75
MD5 8df7748800a9e0f6db9b890464590d5c
SHA1 fb03bfa5464c495009af20df0fed34b8990449f3
SHA512 c7fa6f19a60c5ea7e8fefef961b0798dd352aec35242ddaf41b224d07f6c7fdd1ed327209d402150b598320f8f544af054357f41996931fda41e4d327b69bcbe
SSDEEP 1536:Kcum2n7hIpk5Bsshnj9gQFPS47L6kL7o30:KcuThIpkDfg+L6kfo30
TLSH
T1FC636C596A8830FAF536423DC4964E19D9B1B12163405BEF0364C2BE2F83BD9763EBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\Microsoft.UI.Input.dll
Size 1.5MB
SHA256 0603233882d1b045ef245d815e683c7fe5e4e15e2efe22f401217dfdb3907716
MD5 70cc9a355fd6ed6ba233c1da363c024d
SHA1 f3f76d3be6cea85f1b8129a429a9629f67b85878
SHA512 44359dac1aed5c5805695eacb6b4eebab4ef736cbc51be063fad3d6c1bf74649e5b2e1efdab00cd7087b9f7c09c86e30e073383d7d714990e10226a1b2cc3b2e
SSDEEP 24576:UB6TePxZNKmKI9tp/jLNXoqWnbvxtXypD:UAaMmFp//sndtXcD
TLSH
T1B8752A2BAFE881A6D331A23DC0974E4AF2B174421B7166EB0165412E5F3BBF45D3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 0ea0c5784cff78a1594087651890c2501a191f9acf713bfa5baa9b05c3c8c87c
MD5 bb153d4249ff786d6dcf17ee5511b235
SHA1 9221364f598135a02503a6824bcaceba9f213ce5
SHA512 34644b638f962ed9ba870f73795807ddb01943f44f7a222793ef9206daf73ef316b87d9525ddc4e398bba91f82cd3ee472d9c51792cf538402540c2e71b57d95
SSDEEP 6144:es4jY1PnSzURJG9m3+v6Vtcu5/gm0qV1OU4IkhNFSDm/RuZ2QlXgJ:NSY1PSw+5CcuOm0q/OUhUNKm/RuuJ
TLSH
T18FB44D6F6BA84492E22AA13DD5978B0AF6F174125732CBCB0111D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\Microsoft.UI.Windowing.dll
Size 538KB
SHA256 ed32d7c62c5d3c11f7a4f9354f1e1ea270e27b0b76e2fd080d0ddd79cea8a3e9
MD5 02b73d63c8ef585ed8bc30d5850d126b
SHA1 3017f9c50c08f6855c9c89b3f89d7b8c08c44ee0
SHA512 cb7e4cb5e625dc260a28faa4c3dbfa4ea08465dcc9fa27e39c5c1b48e8f4c55d0dbfcb4d4f4fc9e74cf2e79f02e5d282152fb6c48087d2ceed9733c40d69bd6a
SSDEEP 6144:BlLJdDCMslOzqjXsvPueIP7mNq6CIRPDoxSTHXapklto2UInrMRAc6egG:LLJdDCrkqj3eIKFC6DokjaaBjcwG
TLSH
T111C43B7EBBA44696D12A813DC6AB4F06F3F0B8515731DBCB4161823D9F27BE8593A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\application.ini
Size 633B
SHA256 480ad5e8cd77ee242ea336c52e1b4a0631e5ec3da033106c4f8e753d11977c26
MD5 77a9824fddca9b7825f27f460530b06a
SHA1 2697735b1225ffc3f2a27a772eaa13b00b35dd8e
SHA512 29f8c3719eee3a31f314f061a383983a8be72c6d8b340259ab3518a96922a884b0d6e8eb9404d6b13ef4fc51d2cb7e363c57e7666431b0772d2edab0e564a111
TLSH
T130F07DD7430975FD4FF379BE644556D252734828ACD7341C10468009162D32A6ADEAED
MD5 SHA1 SHA512 TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\default-browser-agent.exe
Size 31KB
SHA256 e5c9875383cb0407ab7d0c765d996d98f7703ad4ae545de7fc9b552fc5dc4f8d
MD5 e35892618e083a7cc184e7f9c5d45f97
SHA1 d93d0f4aaca319814685a70952cfa6854e4a13c8
SHA512 587353884420aa5db12c690528ae6d7a6ee249f328537ad2dc167dda755e9f97723877fe0b71c109383df148bc88c524cbd53e503387e863cca5e150d4c8a533
SSDEEP 768:DGl5FOvVVvZpZBwlHpcANVsheSoQuoaudV:DMCv9pMDcAN6kL7oL
TLSH
T1E7E28D67DE9140F9FC15D53506A98127EE32FB425F6252CBAB86022D1F317E05F3A3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
TLSH
T1C6900252006F40226145A5A1684D890C80186146DC9101901567260E16259C008D456D
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\dxcompiler.dll
Size 23.2MB
SHA256 be75427a6be325a70ea697544ea8889081bd01505f4370b55f0c3a8f5246de05
MD5 c32720cc85dcd8f3f30994efc94038cc
SHA1 d5bfea2aaeee985e5e32d8eda3450349eee22034
SHA512 ad60045718d1d1cea1d150f9140ef9f1dc8e7a7eb9ec6d5145d3d6af114bcaed263d4f6b1be8b3b8a34e934fc92f845c045fa3982628bd8fbcf42158962ee6a9
SSDEEP 196608:SLn8gE6byTF5lWua5oiVfMn6puhDpn5yfKr0x:SL8v6+TFvWuanOXhIKG
TLSH
T109374C123686946DC05AC878C3574B279A2870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 dded8c3942e2d8eca65838e55379b1da5765c2dd6183dd5c3530c9976cb25a86
MD5 613815852a622ff9e54d697b9b3d2862
SHA1 a49149260f4e6d09412ce09d5847f15be65f527b
SHA512 64993969eccb8f75496b11cecab6f351a3ac659d8d6906cda2bfec8684b2d0d253f4c1bc23eefbec388939dc9ad0e898bec0a8f3e03c78d1b9c73d714fa5feb3
TLSH
T112F0C0DCB158130016CA6A556113528FB10F11FB46D501DEB0ED80381B8AB4C491EBCC
MD5 SHA1 SHA512 TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\freebl3.dll
Size 1.2MB
SHA256 d212af6121eb4a7e7c289653e06c018d3551dd661a497894ed37230c410fd7d7
MD5 ac54eefa98d61befc85babd6e5ffd8e7
SHA1 0423d030d828c026a10c1892542611d63c64e37d
SHA512 9b901501f2c9c2b50503c2c5bdf79337d47c27d2ba9af63fc024f104a042346d92559ff8dc862bb4535fd66c33f24fc428ae4c2f035439475b121452ec72ca5b
SSDEEP 24576:Z0E2zH/nJ99XunnnZnnRLtEYhTiLMfUUxvfxny10J+JZzH6z8pi+hBdw:WE2zH/nJ99XunnnZnnRL2Y9iLinyAqV0
TLSH
T161456D0BF2B647E0D067CD7C1396B623FA253C5D4B5136D357C886213AA1BD4B22AF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\gkcodecs.dll
Size 10.7MB
SHA256 a5ca39f2f6ea8e06b2f0a286a4011b8d6b4c07859602266448960e0f409d3b55
MD5 a6841829f472cc21d2db7832654df409
SHA1 e3891ba540cd6a040032319e11008d0f20bba6d5
SHA512 78607d05bde38d914a5bebf11644e7351d6cf08615354be5e4e45b186bacd214e40e247b7e3653b7ee92c2a9d245641cbd41942196f4118fb56f4058c57d50ad
SSDEEP 98304:FeUaMX+Ix56hdDuy3FqkjyzY7Ehk8QFEvXHjbNd3WwkhskbD7RcOox6cJyxeOxOs:aMXMdyy360Et14wkhswJcOnOHtRKZ
TLSH
T187B66C4EF1A351A4D41BCCB8527DEA12BD18385EC718D6EB77DA15243AE37C0AB29F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\lgpllibs.dll
Size 161KB
SHA256 68663cca13a9d1164d48150ab2ac39550c1aeb8c6b7827517ec00604fb38609e
MD5 4cfb7f5c19d876c134176cc06b512e06
SHA1 5803ecca2c92076e3d4646178475ed9fd6f586c8
SHA512 078ea0d5fe658466e7a9fff48253cf5582fc5fb985041577c97cf1ef204e983b7556ce50dae432e331bb75bdcec745dceb8386da50a0241b6943259fbc2b07a9
SSDEEP 3072:Uy7aNMj5So5n8tJ/AgWr+Q7HRR+rJXlLyY64IGdsdHnr3S6q93EduDoxWReuv6kA:Uy7OMj5Swn8AgWrtAf64IosFnr3S6q9U
TLSH
T116F38D26DA88886AD43A8C748DA38E1B977E7C8007551ECF57D45E961F16BC06BFB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\libEGL.dll
Size 58KB
SHA256 3c0f89f47c2975a100925b8d855a3f29303e1e0c671e03108ee5e3e95485f894
MD5 a7463b535ae430eb35d1114b0db6ef17
SHA1 e9fdca4eb2db41d001d6dbcd6a639fa1f8556199
SHA512 d47c287bc813fafa556d9105afc41b05f28f5489c3ced7b838633f728e21e26e99a58e45f8e3d79ca9c3f24e83c3237261a078b4595d6b18844c69f2ab3d6493
SSDEEP 768:6uZqPDiUt0cI0+3TxUuaJ+A5xQYEHABe+VsheSoQuoadcyRt:rZ6ZJH+3FKDxQ3HAE+6kL7oc
TLSH
T13B43FA3BCD6AA133DE0D8DB0C9930806EEA5BDD54BB274CF6B640DE10D94AD4A779314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\libGLESv2.dll
Size 4.8MB
SHA256 5f7663e900879b2320fa14ffc92756a71664d537847657b3affd954970c942b4
MD5 9b402ea8f1cccf5dd7ea8ef60fed078d
SHA1 f6985bf5217c8d425a8bc3d59b7ef2eceeba19d7
SHA512 edb8a5bed798e11b90f8efb35deb0f9bacb0dd2da2db40edbc448add37dbe11245d78ca1c997b45f42fbfd1ea5b2aa87ce52ba8d7811849b8e43b899339f82cd
SSDEEP 49152:zdNXtNY+9jRzdsLZUCiM2z2NSv4XmW8tMXG3t/C6YbpMyVsfiAxeJW6Dutcq8m+X:zLjYapd4ZUCiM2ilmAt/+fiIuBMqmJQ
TLSH
T1BB366C13F2A240AEC46DC279979BD223F6367885171572DF269843363FA6BE02B7C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\maintenanceservice.exe
Size 267KB
SHA256 f7cf85b7fe88add15c9dc6afcf6339f1853875f91d156bd7e3e5d13135d8eb12
MD5 07d7d58efae02a2e12ec1088dbabbef4
SHA1 c3757c12a762d56e532c28f002bf68b6f9f21b57
SHA512 9dd5f1bf742b6d4dbd89936204c199443d09b1ad7cc05b2ecdc671b982e038aaeb9a91a47c2163f8151e30b4fdec35cd2d3d25c85747e203f2e8789c25966ef7
SSDEEP 6144:HgwXxl9ZICnZ7hCml09PEuxEpcfJxwjlzSakOMg0H:AwBl9iqZu9PEuepqUAaD10H
TLSH
T158448D2977A409F9ED67C23CCDF28516EA72B8514360EBDB03A489251F237D05E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\maintenanceservice_installer.exe
Size 181KB
SHA256 1f249d6b0b68cd735bb9043d81e8d59fb4a5bf9e563af44f5eed7a3856af5f18
MD5 8abeafeb045e7436855b2d02c1fec833
SHA1 dc0c2b77e4b9bfed00a5d1a0b952945bea2ddd16
SHA512 b97af9f4aad16330563d22fc4a9a9716323318d9b98102dc475618d65c179e2fa539c4b1c75c70338108b630a17c943dcf7fcddd55b1f9c9f697e4b8727f5bb3
SSDEEP 3072:cNRCywDw1DiJkuKUNRD5bukxTem7y6tuU/RDObU7y4jem7y6tW6kfoG:cT4DteUjD5Zh9oU5DOY7y4j9+gG
TLSH
T178046D01BBE0D5A2F9B20A303CB6D7365F31FC666E90874B6350B35CAD72391AD2535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\marshal.dll
Size 498KB
SHA256 995d4b4fe866f6eb448e3ae12f875fdeac55528f2e1ca0a5d739c2d055a1db7a
MD5 5d6ca84f447b60c6791dd02c79ac6bc6
SHA1 9e03af45dcd7ded13e2f0b226879126625e66d14
SHA512 9c90c177bb8a2c3fd7c24ace2ba38a93e9e6d2d2eb3b7fcbcfdac7d8c5ffa51c7b3e66d559ef905ccc69e440bb9e0c5ca9bc31359341c6015292d64223b6e22c
SSDEEP 12288:xQFOnIXiS/m+7FpMenWosalm9r/0jX/L/yHw:xfIx/maFpMValm9wD/yQ
TLSH
T137B4068F616104A3C57F5378B95F474EDBB1BA1103509BCF026072A99F5FBE42C7AA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\mozavcodec.dll
Size 3.9MB
SHA256 b624fd3ba0cb2ef3660f6828adeae102131f83191b49188f02869aa462c6565f
MD5 69fce145ca8088d0948dfea5c6ddabde
SHA1 fe2e531706b3da0de9b3615940dfbb0aa0f68d74
SHA512 2fe044ddac2b508862b7bea477bfaef391fcc49fb2bbeb5c3a6dfb8e91a5fd41a5ee13dd27b43398ffe7c4d6ff72d7c7419546866c60d213963a9bff96cdb88f
SSDEEP 98304:6paT843aNMoh+WbJVA9163F+T8IacPGT8:6pUv3aNMA+m8
TLSH
T13416AF4EF0A34191C40BC9B4937BE722F924345DA71575E75B8A82247FA2BC0AF7AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\mozavutil.dll
Size 595KB
SHA256 ff4dd8fdad1d284597c8cadb423e56e6128e6a4164a5c963df9105ccb20557b4
MD5 7db1dc5374a8c743a3b9bf6b1e73c292
SHA1 9d553738b7fef8302b1cf1f85dd838f06ab1c8e2
SHA512 a9b8681661f37d4352d767403df063aca38baa0ae36d619553d6ed68f51e969387dc8411040521550fff19932568c9826c62683aefbded9d7d2d4cb277aba92a
SSDEEP 6144:Q/VCTqkmb0Y7L3RkqZv9Bp0VFnjAdabR+lITZXLhIbjzUHzqKFXLGG23e6CQ6JPj:Qv9b0Ud2Fnc84CVLqczqKFC6JTX
TLSH
T182D45B16D5C2082FC4068575839F5969F3723442CB94BAEF379205283F28BE17E7AE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\mozglue.dll
Size 684KB
SHA256 261c86c457f90328bcb9c5becc4dfedb31de2a8781ed1f97a4c5d31e1dd6ca52
MD5 e323852fd9412632357c910b9986a406
SHA1 0f3407aef9854f05b26a284eb5fe2d779995a6ef
SHA512 138dfbf3bb7437c753de35bdde119094282fca7e183006f417e571f935572ce740aeec659a08923eebfe5240be967389b2be8284d9bbb87b97d0317016a8239d
SSDEEP 12288:TeVGjtCRPatw2rmNtt8v6NnqwpntUSiT60ghE3TNVMKReO2PSvmM:T3tCRcw2r6tu6AwptUSCghE3TNVMKRKC
TLSH
T16FE4AD03FA8A41F9E058D5395B9BD523FA72B8450724B5CF0380562A3EA9FE0B73E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\mozinference.dll
Size 3.2MB
SHA256 826a803bcd782f6f93c2489f7abe99d8400e123ee3d6b284e0c001216ac1e966
MD5 0c887f618ed0b482dcf2f80178f606f0
SHA1 300c8da555fccbc832f4ad9ad253eaf70bf84083
SHA512 7254e166ba54cb681f599978a7788ace1009d18381fc25c2afb86c532c71e27181f7255524f2bc3601057ba65f17ca84aeb687ac35129584553d436793566975
SSDEEP 49152:xScOyV/z9Gqr1zJN/8YiKrxgfqry5hxjHo/8wcAC+xrcQr01f5qQ05clLt:xPvSKrxgD5XTaw0qlJ
TLSH
T1FCF51717F69A4098C09AC0BC570AE673AA34BC4C563876DB9F548B113B76FA0F97D324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\msvcp140.dll
Size 530KB
SHA256 add65988014c5280f68f03438d7b520e6280e321b863571fd42161c0ca4eaca9
MD5 0564086bde11bd2ec842f227678b3488
SHA1 740e4193d39bb0f07b89673a45b68f87c14c40f0
SHA512 8587ada1366c67ed128ea2e3182bfd08d86004c99d6975205709d96e87f86055780761f264fc67f5fd8f45268fa10aafe14528181af2a5a94c6ff12eef37ef61
SSDEEP 12288:V0MrE03u1mHWV/I3z+bQEKZm+jWodEEV77O:V0p1F/IiQEKZm+jWodEEN7O
TLSH
T1FFC41A23F75906B0E195E3B8A1838302D7F1BC598322E3C752EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\msvcp140_atomic_wait.dll
Size 37KB
SHA256 28ec03d88e0e65806a5a424dfb595d6fa983d6ddc8334d699bb5db57453ed58d
MD5 a61941d866c27ece10bb98aa8c4e38d6
SHA1 0e890ebee2e5a413278fed5c0e98ae572717ea47
SHA512 60b805e04fc2fc72aab0246cb2626b5a4bd123d58a0ff1f335ffc2c434b4c00d8b5791e42f13c9ada83c2839472db0086c6514d1142a9202d31a917a50fd0212
SSDEEP 768:UPMo5RIqKYwIgMhpLDQl4wFbZVsheSoQuoamfhj:tOR+tMhNQl4wxZ6kL7oPB
TLSH
T1FA037D19BB5804E1F5568734C4EA162FE6B2B6E08760CBCF2221558E0F93BE17F34B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\nmhproxy.exe
Size 642KB
SHA256 15c5834d3a51c74c1d3bee8663f8c5ec341c8c2c449115d0d187d5e922ec4634
MD5 85a56b9916913907b1a70b4094fd66fa
SHA1 4370bb19a859819d82e5cc8c83429acc3ac5b725
SHA512 f984ab865e4233989c5c4a13f3531da3de806169158dec50269c2b93aea52dd226f0f0e73b75a17d8b57e879a1bc16a9ade28e16d672480caed949991c3dc136
SSDEEP 6144:O7CWaKkPdEuX3j+lxrXR6bCXpY4UxdZijQA8QkxGQNE/80Q8D2XnmzzpAQFZ186+:QCWaKoHQ7XjumPkxhNORQ82mfFX6
TLSH
T19AE44B13F64689DCDA1AC07D871682326633B4994B3169FB21886F3C3E67ED61E7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\notificationserver.dll
Size 59KB
SHA256 60fab5956ae0df4dc21210df9a4bfaab50aa981cceeb92080a6a4ea76f3fccb1
MD5 c18c72ee9f85337e2e225862c70ad7c0
SHA1 e7c4a8699e4b8349f8f08b330ce8737770917701
SHA512 42440b845f3c133fca3299791e1bb066dbb0f8874a63a829335160ae2175da940785984e31c91036d68c87858ee96830f9032f78369bfd728fa903af9e49ba05
SSDEEP 768:k0OsSpdzmhLziDyMs1b5iKWr2li/55i+oSEdkXl5JuhS0Y++VsheSoQuoaZAsuxH:CsS6VgsxDWrX/5Mdouo0Y++6kL7o7d
TLSH
T10B536C47FB9500A8F9E6C738D2AB0A16A933FD4D473161CF0385815A3FA0BD46B3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\core\nss3.dll
Size 3.1MB
SHA256 6bf2903be0280dcf84899bcfc107f06e0a2577a60d8912727aacccfa1407c59b
MD5 f502aa36a69142f4c8b46e96d9be641d
SHA1 00f71b1c22a10d4a2903e8a3aba10822b3d8cd69
SHA512 6ccc669798f11f861653e7637051203e67848a11a605ac0f888ee31f6eacef1b5a52cfa3ec917740c3a4a4ad68e07ad0d883dea3a6904b9af39518bfdc681a2a
SSDEEP 98304:4nAR9FzfYqd1gQoxXa+yFRlE7XsmjaCy8bXSzB:RGXUE7XZy8bXS9
TLSH
T124E58D13F6A510E8C029C279979B9323A6B2B4454F3876CB52945B153FE2FE03B3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC06B3358\setup.exe
Size 1.0MB
SHA256 80c08b631b77a0449c328ffaee34d88cff5fdd117443e73b2b092865840f1230
MD5 7bb29f05baf9bbf0145b816294668777
SHA1 81e0af52f56afa677b900d45dd5e33962c784a6f
SHA512 804c920cbc1fbbdbad5af92ab352f2273caa60f393c8b87388dcdccaedb14a19e9a7b2e0312c374588037607e526122ad5942e311f89ab74a00a5dd02f4cae71
SSDEEP 6144:JT4Dt1UjD5YHeVM9Vx9es0mPH+WSnEP+rdlqSB9G3So0gM:JTwUjD5Y+c9euP+bnEPeqSjwSo9M
TLSH
T1B435E603B790A462D46E6E3068B7D7553B37BD822E71826B3A1D739C4F733409A7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PinToTaskbar.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\PinToTaskbar.dll
Size 3KB
SHA256 6bec8a69845fe9012a0622e79b63328fb611151fd24f198a779d781a36dce5a3
MD5 70016ab449dd0034333b0df88193cb82
SHA1 add0b693b75f14e7f9a063d0de1921c3bc8d1a52
SHA512 1295dbe8596a37d0799b51c3be011b2aeb499d382bd860bba784dbe5a580f6d2e1116830c4c619ef32df9c5f7af0aceb600c2c7a29e321cf8e355c73627ffc71
TLSH
T1297162F3F3644076E22903B84847C42CBABCAB1213AE4697789B611E2E50CC579A3D92
MD5 SHA1 SHA512 TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\components.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\components.ini
Size 602B
SHA256 f1505640e352a1748d1cdbc6eafc0ab21b0de520c6ea6b750d6eeb41b868dfe3
MD5 637a9a06841221d166843d55316167c0
SHA1 0aaeb03991f6f828af3b90f37e6c73ee7b94e6ae
SHA512 7a3215326798d9682a8fc2eae643d47314c971f5acda4094d1e9daf59defcfb36e3ea86ccbeb3426160e0fe29fb6339c9bd70b52317fe8c1b42ddcf3b8f106eb
TLSH
T1F9F09A472AF80418F4F7B709FEB441718B393C45583DC50E91E1080E48E4A808877BEB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\extensions.ini
Size 630B
SHA256 0723b5d0c55354754b2084b712854c39ca089b1d883de067ac3c20935808397d
MD5 940e15a3691292c513f015e351f33072
SHA1 0545d9d43b188182988195db8a01fcd3ff43afc4
SHA512 cab225845a6ad929b643f3c6f8e9f1b8d0e7f0b19ca7ddaeb6350c508e9d21294749077ab3d041facca1d41578b2434f0faa37a5bb64f1ab1ddadda0edce4b75
TLSH
T14CF06D532AF9000495BABB04FAF581718B357C855C3DC90E92D0094E0CE5A818927FFB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\ioSpecial.ini
Size 1KB
SHA256 caf349d488979b9faa411ffd07f905d3d692e748d4b798f4cfa75c48700e4c9f
MD5 cffde3cd80c9831d699b25d1e0c692c6
SHA1 1c494cf5e496a6e4b35d4bf760312e8ac01c93eb
SHA512 3f31825040f376028933cdc0c7e801992144fc6218519e1d7ed8123d7fc0b7c9c7dda62a94efcf16b3fd72837dc9fac6221020f5609bc28bde49a687b642e43f
TLSH
T1502180032EFD5424E2BBBB48EBF5503997397C56582DC91E91D14A0F48F5A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\ioSpecial.ini
Size 1KB
SHA256 48e0fdae8208bf12870cb4dd12ddda1fd0983985272ba7703577bb835147df70
MD5 3dd81593c5670c0041f075f1f27fd8ff
SHA1 ee0e8ea6da9fea53ff7cb4ab53ba1245c72b6369
SHA512 8c72e2c96d533688d6f9944351783561cb211ac754deebf8ab69aa3933970a1fad1eff8021394f430fb860fde74578abba54f58ca9e95bf7ce65d65b8c36dc9a
TLSH
T12231BC037BFD0514F2BABB54FEB451749B3ABC16A83CC50E91C1090E09F6A508923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\modern-header.bmp
Size 25KB
SHA256 689ea80105f4e61ffc73062516c7d7053f92bae0c700c0673c3a9b445345df1d
MD5 cb1c4da8daa79279041011b85f48c3e1
SHA1 40496c445e18eb28686ef1efdeacf39153a91062
SHA512 eaca5a8e4503c3b62a3b675de44698af80952708fc4ef19a1e0174e4dfd5d6d4af3a3a9f02c4c8ae2c8fb257ff15fd26798d5dc04cfbe727a2fe7050491ee5ae
SSDEEP 96:aCCLLsFslQUlQhMs32QcJYQ/KgGvpNgFtQXPFD2ak29SiD0bFSCxPw:aCMLsFSQOdINUMD2V29S40bkCxY
TLSH
T156C26A110F8E1647E922B2AA323235587DCACE0D56F34667FC0833CE8AF701C2A352E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\modern-wizard.bmp
Size 201KB
SHA256 c03931e6f022e29943d410030595712a29285c1130537d552a7804845a07eca7
MD5 faa41c5d172376cb31e0bbee19d332fd
SHA1 eef931a54b02588e2ee9b202bda14a612cc8f423
SHA512 b65514d05512cbcf27c5a06b97a2454f66a58a2edb081fb1949a0d91d3d9a47c9eabba6dc521566ec44b7fa7b7a863d4bcd6d5bb01a6633d978441b6bf624ee9
SSDEEP 384:sGiFLVfy3SqviWSlk75o3gDVxYi9eFQthspiapMjuqh8fLCG8YHwDT1bmJ:t/OiapMqB
TLSH
T156147F8751C424B9323C3E4292AFA80974575481BD3DBAB63E8DA3634F938E78B3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\options.ini
Size 1KB
SHA256 fba4cfe357d29168de21e4718f15f070d08fc0241bf771d5ac9f6373979de176
MD5 15ed0cec8a172e53230584b54b69f882
SHA1 f58239eb5b9693b4baccc836f901416c2bc776ca
SHA512 620e4b83a1d2d5eeca2cbbf47874a97889f035a0341bd38aa07be7aac41d283a5cf7b9b86f1da60df0ea0ebef64e14d5f6eb76da56c40fc36438e804068753e4
TLSH
T1AE216A632AF94116E5BABA08FBB581309B397C46583DC60E82E14D0E0DE57808477FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\options.ini
Size 1KB
SHA256 f4203ebcdf288297324887bbeb512bdbd104e1d21dbcbcd7d553f46bd36397a9
MD5 933367b54c8dd884823241bf81162ae9
SHA1 a36809eacc6cba6cc7285b415102a9a747e845bf
SHA512 37fd3e402d689bb73434edde105574083e0809715fb0f321884e2d0ae2b100263253f8511065b79694f74971e094e024db4849721a7eea67f1a92066438a824e
TLSH
T1572192532EFD4519E1BAF609FBB54034A7343846583DC50E91D10E0E09E6B808967FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\options.ini
Size 1KB
SHA256 abe0b3c4aefa8a208d967f9f2cd03443294bfe9953c5d1206dcced8f98e9e1b3
MD5 bd3ca69b0ae290649b0a5c5a044ded4e
SHA1 f845b6358169b6eae03565fcc71fd165bc4d8ddc
SHA512 89a58127a55bad47cb3c233d65ad3bd656adabef4f87167859a9a73eec276f619f90cb87526cd9b48d02f2f98fc784ca3d73f677af443cd2f1701cd7451c1c26
TLSH
T1DC2180532EFD4519E1BBF609FBB54034A7343846583DC50E91D10A0E49E6B808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\shortcuts.ini
Size 866B
SHA256 d1f6b6b6fc20b84ce925e0925f9e180bc924c8f24c788edd90c3001ba15087bf
MD5 751525a3fd0e53134d4e178390655a67
SHA1 5ef73cda0e4677814a8a4ecfc4a112a563d430e3
SHA512 af4686c2db651d8c00c46f4800f2641f8870635b6a5b7961f2f1a4dfae64cfad0dfc485030488fcf2549a1b35748728c16ed1ed66ec441f672326ebccb4a1fbc
TLSH
T18A111E032EF94015E4AEBA4DEBF540769B397589182DC81ED1E14E0E48F96808577BDF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\summary.ini
Size 810B
SHA256 ebc6a66a3deca3536c90b9a4259200e1ff173fcb543dd9a30ade16bb99884da8
MD5 7a099ee8fae38d4d468a700739806237
SHA1 5c1e3c3df5fb2c691abb1486984e6e64ef22ddc8
SHA512 4074e5501dc1caf4d8f9e86cede341502fcd13ee4280531c880ce0870096027dc61e37830e3634ffdc0e23a666af933e87a143f5c47e9ba37a62d329b904c286
TLSH
T1C4018B132EFD4028E0BBBA09FFF144759734B846182DC90ED5D10A0E88F66508967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz9C3C.tmp\summary.ini
Size 732B
SHA256 e34689af101a8aad70ceed814a7662f139b7865dc0ae5f048a8394d1a67a53a3
MD5 137ad9d07a9b0d90d1774812240ae452
SHA1 33718a8e37439616ff6dfd111309e392be5a7e08
SHA512 372e9a7616169c3148b322e80408e9535bf534194e116e72bd405fb2967d644325f3d7457077cd376b68e9591d5a4ecc57344a35f966f74fdbe5e9ad055e2ab2
TLSH
T15301F4032EFD0028E0BAF60CFFF0407597347806182DC90ED1D00A0E48E66408963BEF
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 564KB
SHA256 7ccc6e16914708a7427fe8078d6f7ec1df7ab6b1eb8324fe9f8bd87fa6296683
MD5 e600018ba39ff715d9edb43acc6c760d
SHA1 2a36f69d84cee0c1d8e83a31e820c2fab15702a5
SHA512 c9f6f443ba8cdcab96055c3500d14a186b4f1c6a3652eb7f6b06150d3e4c4674b670a9341a5ffd9b6571b4d28749702020856a19f75affe82c2100f569cd70a7
SSDEEP 12288:Gs4cPIXwpTYdgPFS2rVII16afcp3tn11XGVfxh/IscPaJ/jfOW4neIgXm:VPXFP3VII16afcp9nn+f/gvy1WjPZ
TLSH
T19EC401F6F76078A367AE034B9D867FAD1B629522C78FE0CC547B27C2455372AAF64100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\zen\Profiles\bk1y9igh.Default (release)\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 21KB
SHA256 17e14acf9dda4430eb0c9ad4ba1fb2efd6f82d2cdccc9d6a8b955653359ffb50
MD5 f355d04f67605cb0abf5c1f732ed8eac
SHA1 23d4f2ddd6800cbd28097d3962ca42d908328e25
SHA512 2962ec9a9d6334e9647f97de317790f8326ba5384806fc0b4d59f813b6f3f93003445c622dc20fc4c39b75b9acaec841d4297c831760ca55d106074015f0a42a
SSDEEP 384:HXkRyiO024YYDL84+KDL849B7SOEAd9KVRaAcP+AWRMAfTUKisj8wkac8Woh1B9K:3mZYYDL8ZKDL8CB7S/AmVAf+hRMSUKiT
TLSH
T136A2A07A4F403CBC199790F8C9B982AA4C18FB67DED6C0AD25583D09CB94599F1F508F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\i43g91k3.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\i43g91k3.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\i43g91k3.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\i43g91k3.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\i43g91k3.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\zen\Background Tasks Profiles\i43g91k3.MozillaBackgroundTask-F0DC299D809B9700-defaultagent\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\AlternateServices.bin
Size 15KB
SHA256 ebfe91e24cc4b2dcd7a9585cfc656048b03ca74244ae9b908accbcd4179445f9
MD5 edc1902c0ba1b3b88dfc3496aeea99b2
SHA1 10a1d25b152514ae22447101e5035bf01a8921d1
SHA512 637626a9e44a16c72c92fb9afa33cb5a5a17c8c20dd325665367ea212e12374895e486c3fa921d00fca17e498f1ba5cd26c35eb3a6e8c7c9d5ee4108b940cd0d
SSDEEP 96:XEbfOcdGaIjCtGEGbjC/PIoTB1LqI56GL3:yTeCthKCv
TLSH
T1C662C9E727759023F0D1CFFC9469B14D9C37472A0569A598CA24D0F30285AA4E1BEBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcd4d451-37b2-40fb-8463-8272c8fc5b23

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\datareporting\glean\pending_pings\bcd4d451-37b2-40fb-8463-8272c8fc5b23
Size 713B
SHA256 ec9db79aacca599e571548e01e378e04d72a631d0c7ab3be3ac426b6d60842ee
MD5 ff6d700507ecc7e3497d5669969bf34d
SHA1 4577cc9749ab068e3fb75fbd5c18aa6e69f94d01
SHA512 7b747664ef01e26186ac407671dbfe03cc20b695d24f83f122abd74655d11bb633d9cf23d0ff92ee972dcf1fa58f639ad60a35dbb156f452ca3bc27a2510452f
TLSH
T1A0014E5266E8C1AA48A0A70BF0D47F40817850336066F289D0E0863C3DAF19B827331B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\extensions.json
Size 13KB
SHA256 b46e0e805784895f95f44925ec3560a97feaf3d73b8fbdb8c6e28e256bbe234b
MD5 923cb9e8c302587b6fd2ebc38046567e
SHA1 909f2f3b8de93c8f602d8d1eca8fe43e2e4c6150
SHA512 77d36c2d4b34410a45d3a6c7b57c3fe4d3908a00d42ac46361032b072815572b12f05801dba061ca3b36bd52f56e6f6c87a4584af5ce7a023374b1178ae899b3
SSDEEP 384:kT4ij/7TiT9uj/76TYij/75gTldij/7dT4Cj/7vwQT6Ej/7xL4HvvL4HHRL4H3VT:W4V9BYIKfi4ir6C4Pz4nJ4XV4i
TLSH
T10C52FC1554159EB8298E63DAD976BE02C27C623B70445C7CB8ADCFCC42FB1BD06A361B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\prefs-1.js
Size 8KB
SHA256 4959e8c935c4a43f7674ff29c011c565f06f643546ec329b957e17fbcc89224f
MD5 24c6442325062b169fc068aeae8483a6
SHA1 e1d9a180f0db13cedb8ed7210067c48b5e2448ae
SHA512 9be8827edb70968073b4b08276b55a51fcd3c8b134cec2b9a335084f8561dca18eb860e10ac7b1d4f6e65f692a6cdb3036c0d171a4102bf35912d766492ea550
SSDEEP 192:qyRDt56gQpHXmagHuM98FdmwYhNBw8C7IGmW:ypqKmHvwN4W
TLSH
T1CF02FE7891048FBF65B232BC6C25897155B1013B77BF6CC610B984C8510CF7985FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\prefs-1.js
Size 3KB
SHA256 d4ae313b5d1418abee29223596696b57c4ce70c85562248d6e183623d66c059e
MD5 82c39fcb1f9f0606089ed07044945680
SHA1 9e772fbca769c31aaad43d4249224db968590e84
SHA512 f408e0fb5e6d71750223005f6cecf64d9a27f9eaf921fc9d49870657699e06009315de5c06f690c95d34025cda50c638b95ce2e25d77bac1d88c47a0b93b79bc
TLSH
T11A71207951049F6F65B633BCBC148A7086B2417B77BF6CC620B88499511CF3842FA5EB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\prefs.js
Size 1KB
SHA256 813dcd577f00ed6a2c7d0f733fbcca31f49d8388d9403254dae0b11eedf399b7
MD5 eaa7b6e91cb0f30dd9d1ccf0f37b905f
SHA1 75987cdc4d6625a94559b150373b66158f63c26a
SHA512 b5fbcabd9c600956414650642d99d0718dccf84f4519d61f79548559171ba9a284262a8e392a431c23e27a525fcfd966fb7705dd001c48b7437e99fa1f4919d3
TLSH
T1863120535805DFBFA1B476BCFC2A4D60C6638636B63F5C8624B8C48A4118F3446F29EB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\prefs.js
Size 3KB
SHA256 fe307b679d3a9bc0cc71e49d151727c317c6c284e03f896ed843a2305a089280
MD5 115ac7bbfc522e1c64ed06b5aa5f3090
SHA1 4064202ceff23fb5788ca340396aeeb23d027704
SHA512 9c206fc7aa3fd4c05b7d5afe719c117b99ca056a5e0de7082d5da495455a3ac1d0c2b5462030c54cd6199988068bf985f10b32489b2a0e11dbc1b49cfc8ac8da
TLSH
T1AA71307951048FAF65B633BCBC158AB086B2453B77BF6CC610B88099510CF3442FA5EB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\prefs.js
Size 4KB
SHA256 dca308466790c44155fd184c7eb0f5cc6268e7d27c265e82d35a53b8d09fd621
MD5 a44ff74d3a186d2d93abc61d44f574b8
SHA1 af24ee657911e500a9a40ac396c72f1d033171b5
SHA512 b2551eb9e6d4c50d3fe70b9c5cb71e5f473b5b834d434f7d96f087f511c2bb8a7c541c8139219d46598581774b2339063a3b20df9ca5d6bed1f56ee09f756fd8
SSDEEP 96:xH1JmSkq3szJzoAGT526ZQLdOt2WmKWHKOhasBo0huDJ0:Bl3RAGT+odmwOhNBo0IDJ0
TLSH
T116A111799114CF6F64B237BCAC248A7086B2417B77BF6CC620B84098110CF7855FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 64c2d882a121466b72ca1f884c70ce85436af3c9655ee15d78fe1e0cc57e70e0
MD5 cbb540a3b8ba3fb1f60a652bfdd475bc
SHA1 f0c6dff514036e555bf150c5c77ff857fb2aef15
SHA512 236470f84693326490b9bb9d9fd009cc95a16c237b8a71a3af474f3063d0178a9b80e24000292f0768c63bff7b333be2d53367dd5bf5ae1d7b534f1e562afe17
TLSH
T1BC716D1BAAB14AE0DA36872D214D9D362A1A7C6A41BF6CC044BE159C07A030B7DC969D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 f5e90f4e2a18d568935628158bef28033fbd27adec44eb32745816a1ebe8416c
MD5 9b4e450f7f132fc04e9e3222191e6fd2
SHA1 7c99fd2aa188a350b6f3c2f24662d9eb3617373e
SHA512 22d843ffd5719149c12a5aafcd22abdb3bd7c18090a33f67207aa443e31d1878e3790a48d48c9e4444a2b7104ed0e402f3f6b49ead257a0548284f07613070ed
TLSH
T1C5716D1BA9B04EE0DA36C72D214D9D362A1E7C6A50FF6CC048FE159C07A030B7DC969D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fdbc9b9dd806b8bea01b5bf853ca690b03e135f0ff10f86c6da79a4c50a98e6c
MD5 fd48de81dbfbcc70d75f6725ad1e70ae
SHA1 0ee8780be00ff9eef64389691e3b2154b258169d
SHA512 cb20863d9c1476be4c664093c6626e3e1ec7ecb48cce641bda1e0c4c9eb15be0b7c73189d7016e273a0a94e005c63c8aacb48d6ccd23a9443a2cdebd7a40b231
TLSH
T1E7410A53FA754EE0E7E7A68D030DDEB8255E3C1287FD1DE4E4490964462827F7D07688
MD5 SHA1 SHA512 TLSH

Submit Download

1974846527meornoittso-r.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\storage\permanent\chrome\idb\1974846527meornoittso-r.sqlite
Size 48KB
SHA256 f8b0a3cdd8cf2d4e223b59ea8e3ac464db9589df35d8c4f12164a7111e7da574
MD5 32cd0a745cc2313ae75ad761403228ac
SHA1 89c5e8ec33de2b97a01f0ed856aa23a4f7f3c53a
SHA512 2d4bc6152fd90fcc91a38e1a7f6240dbbef98725cdc940fccf0e2412d6dd564d6ffd0f1bcaf666cf4ec901d0d0745140a447cc402a36b9d360bf6d55b3b32948
SSDEEP 48:T+OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE7:616S6CKnqlizbxV+2xVeU7X2B0
TLSH
T1B323608E3F07A511C43AF0B178A08D51BC5E321D07222AD57990DAE4C8F211AEE1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 10d2c9b49a9e7361603aab0e4a37440f30ad325d4775c7a655dfe7f9068e322c
MD5 dc4d5e3b855db0112d6ae9edfdcd0a84
SHA1 7c698c15aeb381dab9349e607e4cb980c21ce21d
SHA512 7b307b34889d299a35d693e392715b6e0ef757cb7a381c88717f344fe125ea0c843fc2f29efe7ac019e3228624b74ad9c3fe4953eb882ccfda5945ab5f6ff170
SSDEEP 49152:IELcoxY7P5e97ACRu1iUw9mU9gpTCxj7939GfxccxOcU+FLOU1:yY9BRu1if9mU9glpfa73GqU
TLSH
T137666BF820D1A257F3814033658593EB21EFD00D6037DA085BA95AF9D4B4CEB9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.9MB
SHA256 b7d100b6100a0f46101be2c42abcedd8a3e61c1d0dc0fc83b616c0573565cbfb
MD5 8da3941512c4fcf786177a9562906ec8
SHA1 b9a9bff6bcfe2935c75187a3530500ce8995a617
SHA512 72765799b42564a2bc145d9f7ee646876ae92dc43c4f1b031b6daabbbf966d1a5f0f4c54f96b07a92eae94f73870ccb886a8495eeaa00c5047f809568c1c88ff
SSDEEP 49152:8GLc2xYq45197BCRZ1iUwCmU74WoXV9ljNd798fGfxccxOcUsFLO91h2NsXPf8:3G9YRZ1ifCmU7JAvXfa73Yq9mkH8
TLSH
T19FE64A9670E4D6A2EA0146B7F30F82CF317FC1DD20C6859816B82A68595369FFE2F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zen-live-folders.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\zen-live-folders.jsonlz4
Size 15B
SHA256 0dd22af73bf7560a8bc72ee90aba611c1241c2054d488f75d90a4afc27309efb
MD5 e88094f8457c6fd244c2787c6524b125
SHA1 a5823f19d67c3b3d9cda80aa3acf20dd00a2d437
SHA512 769ffbd35a9c2a1be4ec91c60036f4a7d3925e15a947d909f9e4b14573ee9b993508917d0e28513c6fe13b4202d7f4c39173ba729ddbfd400a90a01812910ea1
MD5 SHA1 SHA512

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 586B
SHA256 518eb8fabceeb4a8c5eeda819c093236c8e93df99a75287929a17b8f3380785c
MD5 0797a3316a9b1b9194dd800d861dfcec
SHA1 c8025bcbdd9f615d800fd8ba143c81d2825fc3ec
SHA512 92cf2ff4069476c7908a0580b6a0d08eb20c42bc78bea0424b692122fc92b3286892755c229b7a84b58a09969484fbaf944d6a346d9d7c7b056be11fb6de3b3c
TLSH
T1A4F041116E008FE1B7E290ACC1808258F1467B2CA6F8FCE15409850481C60A37E3668A
MD5 SHA1 SHA512 TLSH

Submit Download

clean.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\zen-sessions-backup\clean.jsonlz4
Size 2KB
SHA256 bf91b89371833c02e422af824b5a56a78ddd6d2a972f3c833af4bb432f60c368
MD5 d936ba5cb34e65f1011f4827d1c7ba24
SHA1 ad9b3a0a14ace01582ced02897abaad2c80b7ae1
SHA512 e63c56f05ce4196a512cc75259f7ac39cb158a71f07e8aee34cb2e3c7df2de4031437703bc9e394c11ca9cb3304bc6760cd16f5beae87a20f71776f90ea9ea69
TLSH
T121513E86F691DBEEE214571D01889629FD82E07625D5FDC02C8D724D4261F016DF913E
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\zen-sessions.jsonlz4
Size 2KB
SHA256 28918f96dc8f84dabeff71078486229c0280b7f424bc9307d5722366e1fb6143
MD5 1ad582cf97061f57a626db8a6da51e3f
SHA1 3596c3a378d5db578acf2ee472de076dea95bb25
SHA512 a02a46dc26a266924eff62891e33ec70ee177f234ce68f334e65567cd6d7d86f351f87d052f394e467d47cded3120e9a92df34f8b42425171e421469bf46620f
TLSH
T140513C9AF7919BEEA264571D0188622AFD82A07625A5BCC02C8D624E4261F016DF913E
MD5 SHA1 SHA512 TLSH

Submit Download

zen-sessions.jsonlz4

Path C:\Users\Admin\AppData\Roaming\zen\Profiles\bk1y9igh.Default (release)\zen-sessions.jsonlz4
Size 67B
SHA256 6fb0f783d2d1a85196c56cc30ab302b968e9e80c00cd2c1ccb7b2b4fe2d38f67
MD5 e39a4b74f8eceb0999897b41209e32bf
SHA1 b3e065ec17af4d201974e7abac0e4c1afff0e8c5
SHA512 81e6fff9e8da99274579cfe03fbdd78a62af2d5d103905078510b0f0061e07e992126e6786ef12a2926a0c5ec8af9b159642b2cab7ed8a07a4a71407f3985682
TLSH
T144A0222882000B2083E0A20E80A28AEF038A2028803008C0280B00CF83083828AC3082
MD5 SHA1 SHA512 TLSH

Submit Download

zen.installer.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\zen.installer.exe:Zone.Identifier
Size 988B
SHA256 b72aa03c7742fc8e2de19426125dc410ff36628028ac8e9ef3cfe55f85d2b039
MD5 04a7bf7b254628111b4152fe64e5d9cd
SHA1 ce67bf55c13cb2a386bdbbba473688d3e919f88f
SHA512 e7ad360e912b0a76926214232650f5fd009b316899fea20e29872b337801d24a3d05aea53b776e5a7ee95ddc14dd441b39b02d6daaf4ea2d8dcedf1b24c2a246
TLSH
T1821188F6D028055E2F1B798AC90E4EDF7027F49BC687434CD09BC04884C01BA61DB93B
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 1008B
SHA256 6c0a0fc6eef57bf067b8767b6fd41a55c002a6228e6ceda2697d94ac99812a03
MD5 2528f7bf76ceb4c5f2d08ed90a4d1f5d
SHA1 25762eb956a2a2c6f97a3f6e255fea095d0a240a
SHA512 517c8caea9f7681f142bedf949a1e60a73e763231803c462c5baf75efcd6cb439831628141d717440ba7944855081ed19b12a062aedef0bec3efc69de3491d38
TLSH
T17A11AF008BDA2A76F1BA8B3115B13B73C77FFD05DA79425D828842940975124D55CBF6
MD5 SHA1 SHA512 TLSH

Submit Download

Zen.lnk

Path C:\Users\Public\Desktop\Zen.lnk
Size 910B
SHA256 9949696744d41de5d5bf8e5c94d4db646aa3c14f0a6600fa983f9cfb13b0a65e
MD5 5feea475bab9102d81fa476e3191d112
SHA1 2085256fe51fa84f6a29fc1099cac9499cd5f719
SHA512 95534598e1338e000784498bbc10864479f1a96ebd64f1dd2733baf954f39c8770793adce123cf5b86c86ab76e50d6e41bc5a04502d06eea2aa2d4fad549ee13
TLSH
T174116D0087D62A66F5B78F3115722B72CB7FFD05DAB9435E82C841940974124D55CBF6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1548-306-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1548-693-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1632-2288-0x000002B359320000-0x000002B359330000-memory.dmp

Download