Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

Client_protected.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/11/2024, 21:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client_protected.exe

  • Size

    2.9MB

  • MD5

    29e814ca993bb291e2965e965efea4e7

  • SHA1

    04e4771d22bcc4fcfaeecec4e45177e4f16752e7

  • SHA256

    24e4267cb003cbeb5bdaffbf4089bff010cad46033172894165e765adb55f308

  • SHA512

    340cb2d1381175bf0c6d33901b3bfd6b5ef13affb236901922f942f0b085e99b3bdce358a2066cdf636af2634858a18a3cc0c25862a6258f3c695668524bcc68

  • SSDEEP

    49152:DWcmOyXHtKsdNH4R8Qips6kIbBAQMaNJObmgd3nQCxdfNd26k:DeRos94tipTOQJObm63bdT

Score
10/10
xwormdiscoveryevasionexecutionpersistenceratthemidatrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7666

192.168.1.46:7666
Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\Client_protected.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Admin\AppData\Local\Temp\Particle.exe
      "C:\Users\Admin\AppData\Local\Temp\Particle.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Particle.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1792
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Particle.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3412
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Breeze Dependencies'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2860
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Breeze Dependencies'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:252
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Breeze Dependencies" /tr "C:\Users\Admin\Breeze Dependencies"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2432
  • C:\Users\Admin\Breeze Dependencies
    "C:\Users\Admin\Breeze Dependencies"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:864
  • C:\Windows\system32\BackgroundTransferHost.exe
    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
    1⤵
    • Modifies registry class
    PID:4520
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1412
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22da6e91-77be-4b57-b816-e5fd5ef789b9} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" gpu
          3⤵
            PID:2156
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2376 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd01b068-516c-4191-861f-5c46d714c7b1} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" socket
            3⤵
              PID:3700
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -childID 1 -isForBrowser -prefsHandle 3300 -prefMapHandle 3036 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90a114bd-1cef-4d1e-9f5c-be9d7075e301} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" tab
              3⤵
                PID:2440
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2844 -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 3148 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e975ac2-5c8e-4951-9d6a-6d88c0bb6696} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" tab
                3⤵
                  PID:3016
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4436 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4452 -prefMapHandle 4448 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da3b28da-63f7-426e-893f-73c3b6438bc9} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" utility
                  3⤵
                  • Checks processor information in registry
                  PID:5292
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 3 -isForBrowser -prefsHandle 5672 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6401138e-96eb-44b2-b9b7-079b09084261} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" tab
                  3⤵
                    PID:5928
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -childID 4 -isForBrowser -prefsHandle 5820 -prefMapHandle 5824 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0682d55f-d641-4c29-a093-1a719ebba55d} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" tab
                    3⤵
                      PID:5940
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6072 -childID 5 -isForBrowser -prefsHandle 5992 -prefMapHandle 5996 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a503d55-37af-404a-92f8-a2ad098c04b4} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" tab
                      3⤵
                        PID:5952
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 6 -isForBrowser -prefsHandle 7128 -prefMapHandle 7000 -prefsLen 30902 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2635d283-448c-4b79-a66f-58b42a12f551} 4772 "\\.\pipe\gecko-crash-server-pipe.4772" tab
                        3⤵
                          PID:7116
                    • C:\Users\Admin\Breeze Dependencies
                      "C:\Users\Admin\Breeze Dependencies"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5612

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Modify Registry

                    1
                    T1112

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    Credential Access

                    Discovery

                    Query Registry

                    4
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    Lateral Movement

                    Collection

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Breeze Dependencies.log
                      Filesize

                      654B

                      MD5

                      2cbbb74b7da1f720b48ed31085cbd5b8

                      SHA1

                      79caa9a3ea8abe1b9c4326c3633da64a5f724964

                      SHA256

                      e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

                      SHA512

                      ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      627073ee3ca9676911bee35548eff2b8

                      SHA1

                      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                      SHA256

                      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                      SHA512

                      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      d0a4a3b9a52b8fe3b019f6cd0ef3dad6

                      SHA1

                      fed70ce7834c3b97edbd078eccda1e5effa527cd

                      SHA256

                      21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

                      SHA512

                      1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      df808b11175970c23f00e611a7b6d2cc

                      SHA1

                      0243f099e483fcafb6838c0055982e65634b6db6

                      SHA256

                      2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d

                      SHA512

                      c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      8082885362359f72fb414d2fa6ad357d

                      SHA1

                      c6111820bcf1adf9ac4e8a441d984790465b6393

                      SHA256

                      0b70605985f4148a236426049c44406110e9edc165a0501f636015a30340beef

                      SHA512

                      b5d227b5ac6549566d7456616b98fe9aa62f6721be43a9e5674c35c2c9d218f7fec0fea978bdaff3ec73b6591c6e41efa8946526c2ab473da1c443a5a851a145

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\activity-stream.discovery_stream.json
                      Filesize

                      19KB

                      MD5

                      b745e28df1da17719f824a832a6e60e0

                      SHA1

                      e8adc1744e26798f48ea660eed6459e3e7a4dc08

                      SHA256

                      9d7451c43264a22d0f76bddbfd36dde2136c26c2c1384ad355f40f2f489e1340

                      SHA512

                      35120c511457dd1135eb61de480a3a90323af8a076ff37b50f07e74ab16ebaeced0c1033d95142ec98ef49746ce88b78bb51c6ccbadda8334b43a637f7aabc10

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                      Filesize

                      13KB

                      MD5

                      6d1e6c078587071a0e64f0e5592283b0

                      SHA1

                      14f102552a60b9678670493f1ba4abfaffe8e6d0

                      SHA256

                      d5d7578e0b241cb8532d5d5e020a3474f4170c58172e1622738938b8524867ad

                      SHA512

                      ac847f2cb7e38de6229a18ec9ef48e9425a3d70b89473d5f3127641a794cfc63430b7997e048b594e315f982426588ec901eb34e3ea81fca032f66a5a071216a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
                      Filesize

                      9KB

                      MD5

                      61016fa51e5c27ba2e323e1ec635f2f1

                      SHA1

                      b58b891142ee1b6ccbda3c19251f7dbc59f136d2

                      SHA256

                      006dd7a404031ffff697082ef46930c7b9cad3aae2d50209814ada7490f4751c

                      SHA512

                      185b84cc1661e93340cda7a17070777b8a31b34e123ce01561c9f4d6dda5ec2dfbcd32966ff0523a651cd8b6092657daec362b23ebea704fd81fe143a0da77b7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\618c42ca-1a82-4e68-b756-20f49f562703.down_data
                      Filesize

                      555KB

                      MD5

                      5683c0028832cae4ef93ca39c8ac5029

                      SHA1

                      248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                      SHA256

                      855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                      SHA512

                      aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Particle.exe
                      Filesize

                      66KB

                      MD5

                      5ef72dadacfa3b577e843899b7ca8b77

                      SHA1

                      d09a930c3be9640dedd5e05abc56b8e144feb2a7

                      SHA256

                      e96dc38a4dbc211fed709d64e5c8d5b03ae46ec6fe68ad94fd26345790ff88b2

                      SHA512

                      ece848c67382ebdc5090a4430a7d74d7454ab9cca94329e3bc1111a2d409e1898ab102705526d742831e156149dde911e87a9573da5b57415ab914914af722c5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\WinX32.exe
                      Filesize

                      280KB

                      MD5

                      adc536532afd849a10203a3e129903d4

                      SHA1

                      2f51790284e62627b622b69dc8ca73360d4be03e

                      SHA256

                      b5f5f3d1c5f8bc8ed19d4d9338b0348d31f2099b8367bf6301575b28b38f10c1

                      SHA512

                      5bdf685495e6e14375412e228de0a3c12ce0686fcc3759d9a387536c0115614f8058eb310e4e5c87aa52939a36bc4969b165f44b89dfd85575dbb3b57c040bf4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4tofvcf.xrt.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Breeze Dependencies.lnk
                      Filesize

                      818B

                      MD5

                      5c08cca0dcacf45efce7524f8233f8b0

                      SHA1

                      daf63f550130b7977e96c3d74778511f92de2a3d

                      SHA256

                      46ad6c1623c0753222af8bc337bd720f01cc2dd03d2816654e04a44c63473b6c

                      SHA512

                      3c0af8f01fd4a2e23a892e5135258380a72a9655205f99180adb2a12f436f58ccb91a5df835c86cf2b329c1999456f2b460cc130e23561ca0fc82bda716cd2da

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin
                      Filesize

                      7KB

                      MD5

                      0b6b07f6d3dde5f9e69b363a4e25c76a

                      SHA1

                      e066589d65953e55fed722ce12a78b33fd0b3282

                      SHA256

                      7e4dcee293c11c973ad68aed3b86bf7d88c96f8f04c156cbc06178278aefa466

                      SHA512

                      1c1a043e26f0fdd03b66fbe88351c65eede5457e1e5499383e821a5513d386abc379b2b6b94ae0be132682d77c1ce9160b60210107c00ca0781be740d4bdc5d0

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp
                      Filesize

                      5KB

                      MD5

                      5900afd7c20f249fd476a2bc9ddb2f13

                      SHA1

                      ffdf438f734d54af2949732184ba11d9db4ed22d

                      SHA256

                      a474370d4b89cc0e44e8b707375b696b665534d0c853caa20b1d2598686226b5

                      SHA512

                      2456510887b3d38ad1f703b139d6ec89d8d56c5d2b1c3d469ae5d50d389669184ec945648dc0f346058d7b55e221a7c8d823ba6a41fa9ece96f8f8c20018f0df

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp
                      Filesize

                      14KB

                      MD5

                      a4451de1415287ae0def2ade535fdded

                      SHA1

                      075917719cf4319dbca8cfbe948c8c3c0a0c79b4

                      SHA256

                      4ec37654c92890f6b946a98dc3a8826f4ab2d4e016fa874d31065fa34fa85084

                      SHA512

                      e3bb225c7c56a5096ba643f7966eb64c1a05f423e8819211574d09057ef99e43b2f416b663c733d99e5439b994ecdc31e94c2cf98b01bedbf46de7db2a9e52d2

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\5996bfba-81df-4b04-8bf7-bf30a0ad0f00
                      Filesize

                      24KB

                      MD5

                      355aec4e92297d6fc991097f782d8e9b

                      SHA1

                      d3a5de8a082ad1c06121c2ffdce4e02cb036b239

                      SHA256

                      ed65ac32bcd06bddfd2213b6253d4c84f413d680802ff17feb6e7cedac81ef88

                      SHA512

                      fbcd9a7bec9cea57a5011bf22374fff446e1fc5167efabf45282cf9632ae52fa6ca625ade13277ae63378600f52233bad4f68e06032007324e9ca3786d77cba6

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\b0f14938-86a7-4f47-95fd-7d99c66401d5
                      Filesize

                      982B

                      MD5

                      8a98ebe5f8baff2603aaacee2eae1b9e

                      SHA1

                      7f419e42cb8d05d21f8a7a9dae347ba996a1ff38

                      SHA256

                      e7f268d61646a51c356b5407f5b970adfa49f8da4d4bdd755d052aaa5ef433ae

                      SHA512

                      fb5b2fe16186b1d7622e652850db73909b00800b3fba913df046b33373ce8553847ecea024b0f53214d21b23a8f5b9ca57841bf525009afbe3e0a67c3c7d5c34

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\dca87167-fa01-4354-a99f-460bfc73d70e
                      Filesize

                      671B

                      MD5

                      4b98200f78a1d485d9ca022acc6208f4

                      SHA1

                      b79c9c8fd772db73dc3320a89af3de5b7dac0d81

                      SHA256

                      94a23d8aeb733e59afc1e4819b9bd0b5783ad5236bc4ba29a640a3b25c154c14

                      SHA512

                      bc0b8e893eaccfb32ff1774f45d9fad8e1531a72072b0e8b86fcad99766dfcd7cac58fa86e4026fcb1778a565a363f718663e455442bc17c76e529b4f55f6d3a

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js
                      Filesize

                      12KB

                      MD5

                      be68890ac5f4b85c5cc760b91b53f2d4

                      SHA1

                      2959d5bea3f6c8789807adacb639d5228022a619

                      SHA256

                      889cabe7beb0845261fe1d299b7188fc5dddb0f4809d8da8e524d0edc8d54616

                      SHA512

                      6239ee96421df0fdf440f68683b5a75847f4550844e329a4a708fca5b9009b8a673adbeab6a9c123b8aa22ec2f591ddd44a95f62cc2615bcc8419d0f4430e750

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js
                      Filesize

                      16KB

                      MD5

                      b0895fd2e9a913196cf6c27f4023eff9

                      SHA1

                      02b1aeb0b7ccb4fd3a54e8a8867f4d3f04089957

                      SHA256

                      1becf9e07248e73d566367d00f4e987656b599abd672326ed1d0b3cfa4de8296

                      SHA512

                      bef4bbd31feb9f3d315fe215c96b8b2ec3e43c80483b6ea51cfcdb641d68479156dbea40cb74ef48e5868c6584e4d87903afbad6e735d1613218f3ab6d080dab

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs.js
                      Filesize

                      10KB

                      MD5

                      0e73a708a0500dacb9d900d16e0e07cd

                      SHA1

                      1dbc3c51da226a11f76dcc763714d958bf72d618

                      SHA256

                      79f378bbb6cda051034f3517bf8c69d8602dd464e1155af5ed4d8fe76ab98477

                      SHA512

                      67b17c512d29775663e79cb052880dbf1a48c63e759a0be1172b598847603d8a010350c1366d76ed8c57fa7a57abce6fa4361a50313b89423819563403b3b030

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
                      Filesize

                      1KB

                      MD5

                      3f69183b1c5cfda0d8381c6253bfa2f6

                      SHA1

                      190aa70a6a0e4922ecb749b01f38a029cad0d05d

                      SHA256

                      e4c765cf8a059051c8586fc57c8ec6d0c1dc138ecd7fb93d4285f410538f9b20

                      SHA512

                      2b577a6780b22e2b062853fd8ed4259696768564dee047df5737021836bce89e75e88ed0f014b61a2c5608837ce5edc45323de2bf39f8fd8baca6ef13e84ec09

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
                      Filesize

                      5KB

                      MD5

                      83d68c4ebf74cf6661d1ba5bdf89dd36

                      SHA1

                      346164c3cdcd3bea7e3cd2e919df243ed9acb1a1

                      SHA256

                      69e237e354e672651d07ce81cd4e03ff40cb854f25cdcbf5ea7402a104696f7c

                      SHA512

                      1e8e047bb5e1808d968b54b9604ebf3604da3e69a190a40baf0f6ffef2eb231f08efad75391b8270e7205d54c6d5aa5f2ca9b17039a86947b71418717ad796ba

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
                      Filesize

                      5KB

                      MD5

                      44fcac7bb9542ee36b2e2485f8d8913b

                      SHA1

                      57586b0c3960b629f2fcec26c2fcbba4fb3d726e

                      SHA256

                      3410da1dcf604269f9c24ba2ad721871519b59673c55fe2713a9a3f3b453c9be

                      SHA512

                      6e780f886301f3e210cdc078e1ebd9511ee12d530458e9dad904c430ec8a9d1e154d4e0f2fbdd0137133e87917e885f9b809d3a5e494ff677bbfad3ec44d70fd

                      Download Submit

                    • memory/1588-96-0x00007FFFC93D3000-0x00007FFFC93D5000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/1588-46-0x00007FFFC93D3000-0x00007FFFC93D5000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/1588-98-0x00007FFFC93D0000-0x00007FFFC9E92000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/1588-48-0x0000000000F80000-0x0000000000F96000-memory.dmp

                      Filesize

                      88KB

                      Download

                    • memory/1588-50-0x00007FFFC93D0000-0x00007FFFC9E92000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/1792-51-0x000001486E480000-0x000001486E4A2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/4984-2-0x0000000000400000-0x0000000000B71000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4984-1-0x0000000077096000-0x0000000077098000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/4984-49-0x0000000000400000-0x0000000000B71000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4984-0-0x0000000000400000-0x0000000000B71000-memory.dmp

                      Filesize

                      7.4MB

                      Download