1e50b4ac0d33dd15a0f42b040dac9489a9ff7867b49480ff2129d4d8331d7c31

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zexor.exe
Size 11.9MB
Sample260907-pgdzdatzfx
SHA256 1e50b4ac0d33dd15a0f42b040dac9489a9ff7867b49480ff2129d4d8331d7c31
MD5 9ae325f61b6061c72a7addabdc0ee41e
SHA1 7cdf411ce78ee3c78682266c688dc6d820199c02
SHA512 70c266216dc7b067e5ee31186b7cd87be29b75976c37fac8d59dfbd1fbc4e61b775c8edb5cf1a1718967676aeed0ba88ea21675cfe31f698e22722e739e62669
SSDEEP 98304:OQ9smrRiCVA3/hmHhRJwN2+XR++qCXARDMz/Go3j:OQSmr8r8UQez/pj
TLSH
T17DC63B017E4A5968D09AC8B0C3878AA78E3230CF1935B5BF54DA163D2F7E7F45F29219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zexor.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5832	powershell.exe
4864	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	zexor.exe
File opened (read-only)	\??\F:	zexor.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_35697431\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_1257341175\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_1257341175\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_1257341175\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_35697431\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_1257341175\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_35697431\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_483054752\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_35697431\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5644_1257341175\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2720	reg.exe
4240	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4864	powershell.exe
4864	powershell.exe
5832	powershell.exe
5832	powershell.exe
4864	powershell.exe
5832	powershell.exe
1928	msedgewebview2.exe
1928	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5644	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5836	zexor.exe
5836	zexor.exe
5836	zexor.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5836	zexor.exe
5836	zexor.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 5644	5836	zexor.exe	89
PID 5644 wrote to memory of 4128	5644	msedgewebview2.exe	90
PID 5644 wrote to memory of 752	5644	msedgewebview2.exe	91
PID 5644 wrote to memory of 752	5644	msedgewebview2.exe	91
PID 5644 wrote to memory of 752	5644	msedgewebview2.exe	91
PID 5644 wrote to memory of 752	5644	msedgewebview2.exe	91
PID 5644 wrote to memory of 5976	5644	msedgewebview2.exe	92
PID 5644 wrote to memory of 6024	5644	msedgewebview2.exe	93
PID 5644 wrote to memory of 6024	5644	msedgewebview2.exe	93
PID 5644 wrote to memory of 6024	5644	msedgewebview2.exe	93
PID 5644 wrote to memory of 4460	5644	msedgewebview2.exe	94
PID 5644 wrote to memory of 4460	5644	msedgewebview2.exe	94
PID 5644 wrote to memory of 4460	5644	msedgewebview2.exe	94
PID 5644 wrote to memory of 4460	5644	msedgewebview2.exe	94
PID 5644 wrote to memory of 4460	5644	msedgewebview2.exe	94
PID 5836 wrote to memory of 2720	5836	zexor.exe	95
PID 5836 wrote to memory of 4520	5836	zexor.exe	97
PID 5836 wrote to memory of 620	5836	zexor.exe	98
PID 5836 wrote to memory of 5832	5836	zexor.exe	99
PID 5836 wrote to memory of 4864	5836	zexor.exe	100
PID 5836 wrote to memory of 4240	5836	zexor.exe	103
PID 620 wrote to memory of 4156	620	dism.exe	105
PID 5644 wrote to memory of 4904	5644	msedgewebview2.exe	109
PID 5644 wrote to memory of 4904	5644	msedgewebview2.exe	109
PID 5644 wrote to memory of 4904	5644	msedgewebview2.exe	109
PID 5644 wrote to memory of 5760	5644	msedgewebview2.exe	110
PID 5644 wrote to memory of 5760	5644	msedgewebview2.exe	110
PID 5644 wrote to memory of 5760	5644	msedgewebview2.exe	110
PID 5644 wrote to memory of 1928	5644	msedgewebview2.exe	111
PID 5644 wrote to memory of 5116	5644	msedgewebview2.exe	112
PID 5644 wrote to memory of 5116	5644	msedgewebview2.exe	112
PID 5644 wrote to memory of 5116	5644	msedgewebview2.exe	112

C:\Users\Admin\AppData\Local\Temp\zexor.exe
"C:\Users\Admin\AppData\Local\Temp\zexor.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5836.3440.632988824614762684 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView /prefetch:4 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffe519f5fd8,0x7ffe519f5fe4,0x7ffe519f5ff0
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1856 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4528 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView" --webview-exe-name=zexor.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1860,i,13061332571283413412,1111844628595533557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:85f260c4a7785eb809a89efd47fd23a6426ab049
    3⤵
    PID:5116
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Classes\.zex /ve
  2⤵
  - Modifies registry key
  PID:2720
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --inheritcursor --width 99 --height 1 --signal 0x60c --server 0x618
  2⤵
  PID:4520
- C:\Windows\system32\dism.exe
  "dism.exe" /Online /Enable-Feature /FeatureName:Client-ProjFS /Quiet /NoRestart
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {51A7AA73-65A1-4639-9F65-F2AF71BAD10A}
    3⤵
    - Drops file in Windows directory
    PID:4156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Add-Type -AssemblyName System.Drawing; $wp = (Get-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'WallPaper').WallPaper; if (Test-Path $wp) { $bmp = New-Object System.Drawing.Bitmap($wp); $pixel = New-Object System.Drawing.Bitmap($bmp, 1, 1); $color = $pixel.GetPixel(0, 0); Write-Output (\"#{0:X2}{1:X2}{2:X2}\" -f $color.R, $color.G, $color.B); } else { Write-Output \"ERR\"; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Zexor
  2⤵
  - Modifies registry key
  PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 63f4e8c5acc8016297a8183a641000a57057038afa0e007e2df0c245b2ee70a8
MD5 60e45ecf319dccebc51e85e9d0efadfd
SHA1 97ea89ef6238b743fe41f98011115b3876a83d5d
SHA512 1b3a161e3cc7b17061d6dfba669a167a3600febbac47088247e8d9e53f7f11a2ae40e80a9572beec5bf01eaec7fc58f977ed4ff016150c96cb218b765d3ecd61
TLSH
T18DD01216720101B4C430323B1822624C1541C10FC00540805C288E1D1B440950A03581
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 75887d812187297e981fb648f9ab64ec6d023eaff11c2985226e76a71c5b5450
MD5 6fe646d61e9edc0beabaf8c2e43de76f
SHA1 b9971fc0df9640d44147a48dea9845db1011eea8
SHA512 bd4f56de9015e6346fd10d652e3ce02d7c1614b5a14e98e6aba4617bc14428ad705d8890d65cdb2ba827ddfd59cc4057d003ceecdba3920ad4acf07cc6e07845
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

AssistanceHomeSQLite

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite
Size 12KB
SHA256 1bff58feb2b1cb1872f87d9b74fdaf4f9c8c03e74f68548a20e395fa83689982
MD5 a463f433b90929ce7fd01690e65d0307
SHA1 e9b440e30ba07b97aa2181e5df5935ba6cac9c81
SHA512 f47456f054ee011bd36be7e023dac35df208c18361d3e83db47b4fe6e11298e3d7bf0107d5d86438dbb67c1f4d7d96e9b68b5e7b422e8d93a604f42be333bb91
SSDEEP 6:l9bNFlEuWkk3LH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkKORuHEyESeXdwDQ3SOAtD/ie
TLSH
T11842D80153240408CE692AB321826BB50ECB52EE82346633696498418CD19C744EE52D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistanceHomeSQLite-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite-journal
Size 512B
SHA256 ee3a3bed5359923926bc0de8a4e464cc2fbf6fb79f08f1fd4024e6cf7a542404
MD5 ee039338a5f111537fa4d3498d7d8e67
SHA1 b8fa51916b1ece7e98e4f39613b856780dd5ccc7
SHA512 e414597b8a4a6e3ce95e10277cab4ae47a348323ac33521b67660cf3d25765fc244ae559b7fa0fa0dc526f1ce333828fa903b68e9b65f233058561002e2a6657
MD5 SHA1 SHA512

Submit Download

AssistanceHomeSQLite-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite-journal
Size 512B
SHA256 8e4809358df98f8f0f05f0596c35bdea4dada415e0f00f13b902d4727f7f0826
MD5 641e7e0d682143a0d44dc02adf06bea8
SHA1 dfcaaff42ab879f203b829cf3592d218c45d2b00
SHA512 2032075164e5b50227b6592dc19a96f2b602a6761ed48c66d3c06b349e612dad9a78aaea9783e4713a43fcb3e78e65d4495297474687ccfde5fe1dbd7c14e161
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 da2b18ede35e08b30b368b2d646b7badabf6df8c0a613767995ee427825ab741
MD5 5ce5d84ec16525f79ca4b382297fb668
SHA1 f5a45a2caf622ae030206fd83b80e8b5920b9fcc
SHA512 26337cd7a9861bb597fb611f7e8bdb92a31f060a871368d8dbca2ad234def91008cc2fa0ce9cb3ff4dfe56192c79de60f7369e28e8f124afd9f27e614ca92ba3
SSDEEP 3:LstlNllklkXlWll:LsX3lPWl
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe59cdf5.TMP

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59cdf5.TMP
Size 48B
SHA256 9cc28b79662cff3fbcff2e4f25377d48e291090433532a26fda63ccae85e9bf1
MD5 710ab9032f7bcf04f856642d8b4cbc51
SHA1 88a3d1457249b7955aafc68eaf32ad5ae63394fd
SHA512 9909579e2cb2f53a18dea49857df3c67548f8513045bd9e1f945bf5927c9f7360882345e18a0e991cc2962d24418cc262ebc4175816726ac8fe214fa6a93cb57
MD5 SHA1 SHA512

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 12KB
SHA256 51061975f6011b3c36f9bf04c26d4e524a8415618f63d8e45ca9d1f77306328b
MD5 bd4fc64647b1dd16d1edb10676f20ffd
SHA1 82af432164e4e347a53d7f25fa7dd987bd41b1ed
SHA512 835c5bfc14fe6bda22005aebc0103f40b859c53c37a0ccdbcc632bbff5a42a47a014b3bbfa9f138ad3dd771c587b5aefab2edf6d8469b834011c6a818e0a9686
SSDEEP 12:TLiuWk9EuTDBJuqJSEDNvrWjJQ9Dl9np59yDL71bHa7me:TLiuW0EODDNzWjJ0npnyX71j2
TLSH
T1C642268C7B10F611C8FE733CA4D2C5D26EBC547C0B9A733245649CAADC22AF2B5D4009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeHubAppUsageSQLite.db-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db-journal
Size 512B
SHA256 3f76866e05729380e11e0dbd9caad48a6cd9f1df21f2adc926b329987c825792
MD5 aee7e52d95e63e36fa18044287e509f4
SHA1 357bf20e17743151aaac7803dfb027276a4c06b5
SHA512 e538303b85965c78799efaf4ddef185a60cedfe3fec63013f9803f37873cc5cb1b809a47a5388d56c5a3026d0ba40b14a683f32582b02d53754451d0f90a49a1
MD5 SHA1 SHA512

Submit Download

EdgeHubAppUsageSQLite.db-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db-journal
Size 512B
SHA256 16698653d15b8425972bc2316fc87f67acff0efd0655f7a92c33400a122adce4
MD5 056ceb567768c11a599f94301d45f2fa
SHA1 090175e1f30d8f3ee1ba13b272ac09c72eeaca3c
SHA512 a5ba08d92dda83755387d1d41d817f8b09c9aa86954953345f8d9f9bd1074ba079270713674570865681421ce1f0c8ae484a28d2945f52d3b9ab8f36ae8cb050
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityComp-journal
Size 512B
SHA256 5897a76e980fb32e009fd113bfcb440ab8903cffea2d8c37aafb1ed94aeb8c9b
MD5 3d814130fb2010cf20e5a077a894176c
SHA1 c71c598941a364c7a40716d4a202586269e0c85a
SHA512 0ad41b8c26c9855728c1e7c4e9bf402140aff1c24dd9c7da2421390f2a7e120bb0633042c8dbe8a75b2763eb99c3e676ca8e5ed289f802989b25f25bdc2fb0e9
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityComp-journal
Size 512B
SHA256 e202a18c1fe19fdcc6b8c259cfed316a19fbb27bf8cd7b739e22a800204c99b5
MD5 5f8f635eba84916428de60e790c39a9a
SHA1 109b2abb2e571c0ad969b0a166776c01f0ee5139
SHA512 dec4f7848a15bdd9a9441cc59e7f0e17fd28c277d87ede30937e595e1277c2fb64b9143a783c67041c87516e3a93a993026e1c3eb3a82ed49caaf9b23d124d73
MD5 SHA1 SHA512

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityEdge
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityEdge
Size 32KB
SHA256 82a98efe1f51a8563b600bff853ca537c225247c494950c7048004a22394edce
MD5 a23e48300fa45773d9b8d84e831a2c70
SHA1 88e29c6f99a0812f58858e14ce9eade6326bc395
SHA512 e657006f0035df4ea5a022d2f111878fa87876d6d7269cf3d7c2acbdd531f61ffee27b865806024aef201a01484150e02e652afa35371db7963659f52aeecdfa
SSDEEP 24:TLTWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tcm+/9ZW943WOT/
TLSH
T160E23A2A5E3C7121DD6671367C61A4275CB910EA977336F27EE000696F8268BC538CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtensionActivityEdge-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityEdge-journal
Size 512B
SHA256 4b99db47022a29357b14cdd6585b552eec5f751803e21bf83544e3d7189cb501
MD5 eea96918d122071eb42a9103f5083e0b
SHA1 6b41a6e096ad44bc26c155e24b925f4aa32dfb98
SHA512 04bd98c2401d95a122a5f1776c163b7eb63c17e7bc937e2ed1e9fb7382f5aa2f2bcbc95ed011e4be6c8e53ac6fefb78cfb66f03c74223028582334d16291e8b1
MD5 SHA1 SHA512

Submit Download

ExtensionActivityEdge-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityEdge-journal
Size 512B
SHA256 624ba30a8c3ce93e80278f7787b8be5e10d61bd9450911bbeeb88336c635d439
MD5 42cdd02aec4b9f37f4a1e8bb7d861635
SHA1 4653752b5aed1cc7c30077438751df601556f265
SHA512 25fb387cc8ba0ba10e06f56c3a8b72576b4a5543e57a8102623f39dc18869ae6db8a5bc677a6f552796ba30d6388f16ef792a7d6a18fa02e50f8ea103939cfaf
MD5 SHA1 SHA512

Submit Download

ExtensionActivityEdge-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityEdge-journal
Size 4KB
SHA256 f00ae5283f8db04714a54caafedbff945b8f3bcb356cd3953611f0befdf3b36b
MD5 0f8bb18257c536271ed206dcbffab929
SHA1 813054d41bc4b6427c3072f66952473a241a5641
SHA512 1f328c1bb4f632a52b036f3bf5d79d93b4c1ca12f3bc6adb4c4985a962fabbc5aa5fc9c75a4c0a3bd7c074d8ea87e1c0e4f734e8ea7ce64efc0a70bdf9713bc4
SSDEEP 3:dMl/FllkpMRgSWbNFl/sl+ltl4ltllOlkH5/XWEEabIDWzdWuAzTgdWj3FtFIQ:gg9bNFlEs1okk9DEPDadUTgd81J
TLSH
T1BC918C85F3802071C9242EF760924B781D32CA95A9020B93086001A4BC560DCCC74595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtensionActivityEdge-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\ExtensionActivityEdge-journal
Size 4KB
SHA256 32dbe237451aa1a63d74b7063b9b5595a3203051cac64a5715d25fd31e545251
MD5 ebc9f5133187fa729f5b01484655fc30
SHA1 e7c8c3cb0a136ad15dd33d7b846f7affd68bf20d
SHA512 959b3d24fb587196ad140eba12d78d400991fc4b2705dfd5e96936923f29fa14a5d240229fd8839384176688e519b282e2e66448cbe9fc1376ecf98c17d157b4
SSDEEP 3:7FEG2l+Xul/FllkpMRgSWbNFl/sl+ltl4ltllOlkH5/XWEEabIDWzdWuAzTgdWjD:7+/lbg9bNFlEs1okk9DEPDadUTgd81J
TLSH
T1D0918C89F7802061C9342EF7A0A24B795E32CA91A9420B93087001A8BC960DCCCB85A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 c658560253d85eb2f7d1312baa6aaa592b5d92cddd4b334098d6f39662b65d87
MD5 6537eb60dbf50ee1d60442cd7b00c746
SHA1 ac42986ba2a0f4d18feaad26c31279afb24aa1da
SHA512 ddf3e378f347a0e605dbfde00d5a558b62380467e9be71e34e292479c14636790381200aaf98c73b0a6d056fb5fcdf6f3d59d8951be6835334a6209f4b6100e9
SSDEEP 24:TLTjb6FrJNHgFXFrAd2bhnfAn1GmwOiWYE6UwccWfp15fBIe:T3vurJN2VrJ1n4n1GmzNGU1cSB
TLSH
T146F29C8F0F183622C8F4D638C9C605D73F7D551C47D6EDC45AA844F2EFC12A1A56D90A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Network\Reporting and NEL-journal
Size 4KB
SHA256 6c311c8cb11929b48ecb85669afa0fbc045fcf95746a68302769f51bc7e98133
MD5 0114b2777e51afdf5cc00fdc16520e58
SHA1 fed0175303bb8ec83c41b6eb3a8b1cfc88538d13
SHA512 f3b1b865fa2a57ef6ae63a78a5fc3603502587bfa1bba365b2b8557420e2e8b8f7c52bc65c07138ab36a6d029c748fa9def09bf283aa9aee43c634184f1509f2
SSDEEP 24:AqLTjb6FrJNHgFXFrAd2bhnfAn1GmwOiWYE6Uw7:Aq3vurJN2VrJ1n4n1GmzNGUU
TLSH
T18091B88F4F083201C4F0D274C9C108C77D7C521D8397EDC85EA800E2EF952B2A46D919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Top Sites
Size 20KB
SHA256 391be631582580776f7247387d10653ba623d8e01cff7878265cc6df0746c892
MD5 7224ca1ea66b0b691845fdf0d089e1d1
SHA1 0a6a2c085eff3ae818e4968c53e2849c4b6f4dde
SHA512 66cdb2850869fa74d4fe82db25516140988828d0ab647a90481412341bbaebf3a4849d8eaef9aefac02ca08a0066387d09242f9d3c8d2178ac13ae8b0e4806c5
SSDEEP 12:TLiNQCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiKCZwE8I6Uwcco5fBtC
TLSH
T19C927D8B5F246832C8B5473992D7C2D84E7BD51DC781AFD1419858619ED0580519A456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Top Sites-journal

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\Top Sites-journal
Size 8KB
SHA256 4bc38aa71c774753977080461e810860d059ab387d0c8c46e3c0769f11a145cc
MD5 8ce6b59677e1f6e17294544edffd0717
SHA1 c2ffb2493931446b56cecfd927df7eaed2275a34
SHA512 2d1791649f26ba89b366150735a2b0f9152e4ad5c65b3d8aad29f60d35802f468bf1f966454bb9785efcf0eead0f7d9728b918378b39303876e56688312481f2
SSDEEP 3:1Zz63ll2/fllVZz2NllVZh:qd
MD5 SHA1 SHA512 SSDEEP

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\heavy_ad_intervention_opt_out.db
Size 12KB
SHA256 76b71ac2e039c49c2691cfd8744704628810ff5e7d979fd4f14835ff5c5e15f2
MD5 d780ed9b5693bdb4c6832b4124eba317
SHA1 a63841a80398e93a0a03ebb3373f84940185a480
SHA512 bc99912b6e26199738965d6e408e46063ee32d1c7fb2bfc492ea7676f40d7f841c7827fb6867d076e7701c4c44a277bea4e028877ba6b4ebf4dfb1ea2e051096
SSDEEP 12:TLiuWkoZBgKuFtuQkMbmgcVAzO5kMCgGUg5O:TLiuWjZS53uQFE27MCgGZs
TLSH
T15042269D0E006500C4BBAD71BCC19AE5296CA22A4B526A93D34022FF4CAB032BC34995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 11077cb57392ded99e02a886151ca52312058e3ddccd948552497601d7352d0b
MD5 69f0fec89addba5f0ad3b9b9c6544c4e
SHA1 d43a2970c6667b654deea32d687ea9a2f66d7c36
SHA512 2b4916803f13734fac6f322f91f211f56d0beca4996e2899ef7a1b519beac759b1586af3b3f70681c5f68726124a00c5bc5c8330a7551eaddc86dd2e86efddf0
SSDEEP 24:TLddBgtBgJBgQjiZS53uQFE27MCgGZse:T5vg/gDgQjiZS0Qj7Bge
TLSH
T18A72E96E4D147211C4BF9E75ACD1C4D23A2C712B0757B6E1A74023FF486E032A5359A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\D2DFF558.ZexorBeta\EBWebView\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 97b54b97d8ccd53ef9f6d44f6614c050ad320e239c6d72dc5daafbccb9cc2494
MD5 80046ba5577179075ee928903ca1001c
SHA1 28647d0009423510827e8acf7c5232b746f273ca
SHA512 b014bd2f2b1f3be609942d285825f8b0c949e61871102d1be4de5a78e8a3199a20671d16efaf59663a5866b7d78c436669b9b93a126a02bb1d3cf465097138e5
SSDEEP 12:TLCQwaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLddBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T15672596E4D14B201C4BF9E75ACC0C4E23A2C712B0757B6E1A74023FF486E032A5358A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download