c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79

Analysis

max time kernel
135s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25/02/2024, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Windows10Upgrade9252.exe
Size

3.2MB
MD5

c0b25def4312fbddbcc4f01c6c0f5ba6
SHA1

8d16a183d61233e7d6b6af7b3cafc6645ac2acb1
SHA256

c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
SHA512

8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e
SSDEEP

98304:GgjXlctych4cCzJ8k2omX8sUf0ht5f/LyXtcH/:JjKtych9CzJqXM32jyX

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1844	Windows10UpgraderApp.exe

Loads dropped DLL 1 IoCs

pid	Process
1844	Windows10UpgraderApp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10UpgraderApp.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png	Windows10Upgrade9252.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	1844	WerFault.exe	73

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	208	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	208	Windows10Upgrade9252.exe
Token: SeDebugPrivilege	4228	firefox.exe
Token: SeDebugPrivilege	4228	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1844	Windows10UpgraderApp.exe
1844	Windows10UpgraderApp.exe
1844	Windows10UpgraderApp.exe
1844	Windows10UpgraderApp.exe
1844	Windows10UpgraderApp.exe
4228	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 1844	208	Windows10Upgrade9252.exe	73
PID 208 wrote to memory of 1844	208	Windows10Upgrade9252.exe	73
PID 208 wrote to memory of 1844	208	Windows10Upgrade9252.exe	73
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4276 wrote to memory of 4228	4276	firefox.exe	82
PID 4228 wrote to memory of 1792	4228	firefox.exe	83
PID 4228 wrote to memory of 1792	4228	firefox.exe	83
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84
PID 4228 wrote to memory of 220	4228	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe
"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 1692
    3⤵
    - Program crash
    PID:868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.0.958731844\1987722071" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a773208d-bab5-4b07-aaf5-4a3e844ecd07} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 1792 195ca2da158 gpu
    3⤵
    PID:1792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.1.1692596769\135270743" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0a66c6c-18ee-451b-bed8-fbc57c7a4903} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 2148 195bf172858 socket
    3⤵
    - Checks processor information in registry
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.2.1365270589\1204890083" -childID 1 -isForBrowser -prefsHandle 2812 -prefMapHandle 2688 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c67121cc-a061-478b-894b-6f47fb5aebac} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 2936 195ca25f958 tab
    3⤵
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.3.1385961693\859577479" -childID 2 -isForBrowser -prefsHandle 3552 -prefMapHandle 3532 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d307aa3c-576a-4d0f-9fb8-e2567f7cb425} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 3564 195bf161c58 tab
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.4.1232690967\1612398859" -childID 3 -isForBrowser -prefsHandle 4148 -prefMapHandle 4128 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9e479ee-5f8f-4b22-9d75-414f4bbf0781} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 3684 195cff88758 tab
    3⤵
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.7.820642749\1380210601" -childID 6 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {553b2126-8d1f-460a-bb1f-3e4f25a02f69} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5272 195d12dce58 tab
    3⤵
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.6.90793676\60859145" -childID 5 -isForBrowser -prefsHandle 4992 -prefMapHandle 4996 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2336eefb-a1c3-4ced-bf94-75c909f2c1fe} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5076 195d0397558 tab
    3⤵
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.5.2058500908\2145064983" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4828 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7ffed40-6d83-4368-938e-fd855d6e219c} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 4816 195bf12fc58 tab
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.8.1869312919\441661582" -childID 7 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {180b880a-93c2-4ff0-ae6f-b1c55ffe5798} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5704 195d2229b58 tab
    3⤵
    PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

Filesize
27B

MD5
ca22263c7a6f965df18f5c601f5db7ce

SHA1
e4b1a401ed497523a583ae8613646b03778a33a6

SHA256
299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c

SHA512
3cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Downloader.dll

Filesize
197KB

MD5
5b62ad6ae42f32806062ad1bcb3e2de5

SHA1
8d4a543eac9643931fcb620cd588e2cc1067920a

SHA256
96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3

SHA512
af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

Filesize
3.5MB

MD5
ab38a78503d8ad3ce7d69f937d71a99c

SHA1
00b6a6f09dd45e356ef9e2cacd554c728313fa99

SHA256
f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782

SHA512
fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css

Filesize
82B

MD5
b81d1e97c529ac3d7f5a699afce27080

SHA1
0a981264db289afd71695b4d6849672187e8120f

SHA256
35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

SHA512
e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css

Filesize
5KB

MD5
7f5fcac447cc2150ac90020f8dc8c98b

SHA1
5710398d65fba59bd91d603fc340bf2a101df40a

SHA256
453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850

SHA512
b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm

Filesize
60KB

MD5
b2a06af2867a2bb3d4b198a22f7936b3

SHA1
98a28e15abdd2d6989d667cc578bf6ab954c29f5

SHA256
40f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23

SHA512
eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif

Filesize
16KB

MD5
1a276cb116bdece96adf8e32c4af4fee

SHA1
6bc30738fcd0c04370436f4d3340d460d25b788f

SHA256
9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

SHA512
5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png

Filesize
2KB

MD5
afeed45df4d74d93c260a86e71e09102

SHA1
2cc520e3d23f6b371c288645649a482a5db7ccd9

SHA256
f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

SHA512
778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png

Filesize
420B

MD5
0968430a52f9f877d83ef2b46b107631

SHA1
c1436477b4ee1ee0b0c81c9036eb228e4038b376

SHA256
b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96

SHA512
7a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU6B7B.tmp\appraiserxp.dll

Filesize
363KB

MD5
cbb270591c9a1bfb1b10559ab672f705

SHA1
fed0d59d60709b5b05b9d31030ea7a5422767a7e

SHA256
770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f

SHA512
67c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU6B7B.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css

Filesize
39KB

MD5
5ad8ceea06e280b9b42e1b8df4b8b407

SHA1
693ea7ac3f9fed186e0165e7667d2c41376c5d61

SHA256
03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb

SHA512
1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p7jdwo0d.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
af6af621d2edc6011aa44b0f9bac6c90

SHA1
85f2ccc3d3044182bb71288616c7a5c8ead5320f

SHA256
8449ff51d648c721a43928b86f55e7b997e9e0879e807566e5e3c797e15fd0bd

SHA512
551ccd1d47c5195cfa28fd47ab3d2f5c6ab540f95d8a8e7422b69b408d3ebe70d039c3f1244acbadbbd7b5894029d6b3e2b591bebc19b4ea858a818d2c3dc4ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p7jdwo0d.default-release\datareporting\glean\pending_pings\4e0769b4-8613-412d-a716-f2be08766d7f

Filesize
746B

MD5
f6e0a45f52d211c82fe7fa2294207c7e

SHA1
282b655934ab81219023ef36bafa28ed8c9ed721

SHA256
51be47a38ab668501cf6ca9bca33c1ead6982c840295cbbd9e4be8a0ff449255

SHA512
adb940f6199e0367cee257d603edc8031c551162df40821c64b03e3ad8d24068da6e4c140c3c86f2f5cea005be140a6280e3bb32784830d730e42edff44ffaca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p7jdwo0d.default-release\datareporting\glean\pending_pings\6f9be7be-5aad-4a27-9653-a369082ca26e

Filesize
10KB

MD5
a3add01dc21ccf7fb29f611d7d56d666

SHA1
7322bd4d84598ea0c423d20a07a24d87ef779488

SHA256
43db37475a1acc3bc3680ee56686871468d99fc2820acf3685e617d765811402

SHA512
22efc4c1cb73cb507b16fed692783a5f0b1af51168591c07784a2bfad37363003e7ba3bd9341fc298e8960a95f0aea20c806735a55042c036e415009006abdb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p7jdwo0d.default-release\prefs-1.js

Filesize
6KB

MD5
e227e256d490a3e0a48e5defc1b8065b

SHA1
a8d1f1d6591454b8643b3c9fe482fd4b6ede226a

SHA256
1566dfdf047a069e016df27b356f93a3eaa1f1e526a52f874f0b33bfe4f53de3

SHA512
3cfe3a014e9fcf1c44593837e5d30e2322504dcaf95bf1a3cd44b8960423df7b28293fc2250be187ff2534ec17f61ff318fca1bba72002192191a4bf12be53f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p7jdwo0d.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
1b1b1d8cb82e1cda362cf34823c88f7b

SHA1
f6189608fe1b5f536e2d81c2d0ad829e92be81d6

SHA256
5ae0f626633f9300b6fb40c8853ab81c8392d41ae1ee38b8b8d2452039a53e0d

SHA512
9213fe07684f5ceb2a29f9573785f45973958c53961ae9afa783ada98430090a055c9e2da39ee92b6e083eb5ea8c3e3c6b1dce3c711051f240419c7a931b7078

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p7jdwo0d.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
f4f6d484d9b320c22696936afbf0ff05

SHA1
649ea85edc9ce029a58aad09f375f81539e3d363

SHA256
8609a3ba88b34ccb4cf8e283edf753b4d00ba5e8311fad56484ed28143ae0b2b

SHA512
9299f0405bd3f86aaa1f08b7ef93939e1963133b9e1b9ae75466d95716e919a137e9d1bafa1eb0e02804794b7972f270b5122e9634895d08c15024fa991b5ff6

Download Submit