c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79

Resubmissions

26-03-2024 16:24

240326-twshjahb5y 10

26-03-2024 16:14

240326-tpnwrsdh78 8

Analysis

max time kernel
269s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Windows10Upgrade9252.exe
Size

3.2MB
MD5

c0b25def4312fbddbcc4f01c6c0f5ba6
SHA1

8d16a183d61233e7d6b6af7b3cafc6645ac2acb1
SHA256

c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
SHA512

8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e
SSDEEP

98304:GgjXlctych4cCzJ8k2omX8sUf0ht5f/LyXtcH/:JjKtych9CzJqXM32jyX

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe

Executes dropped EXE 17 IoCs

pid	Process
3160	Windows10UpgraderApp.exe
6792	Windows10Upgrade9252.exe
6252	Windows10UpgraderApp.exe
5708	Windows10Upgrade9252.exe
5668	Windows10UpgraderApp.exe
964	Windows10Upgrade9252.exe
4480	Windows10UpgraderApp.exe
7104	Windows10Upgrade9252.exe
5416	Windows10UpgraderApp.exe
3916	Windows10Upgrade9252.exe
5200	Windows10UpgraderApp.exe
3268	Windows10Upgrade9252.exe
5828	Windows10UpgraderApp.exe
1612	Windows10Upgrade9252.exe
5892	Windows10UpgraderApp.exe
5128	Windows10Upgrade9252.exe
5124	Windows10UpgraderApp.exe

Loads dropped DLL 9 IoCs

pid	Process
3160	Windows10UpgraderApp.exe
6252	Windows10UpgraderApp.exe
5668	Windows10UpgraderApp.exe
4480	Windows10UpgraderApp.exe
5416	Windows10UpgraderApp.exe
5200	Windows10UpgraderApp.exe
5828	Windows10UpgraderApp.exe
5892	Windows10UpgraderApp.exe
5124	Windows10UpgraderApp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
109	pastebin.com
112	pastebin.com
113	pastebin.com
116	pastebin.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10UpgraderApp.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png	Windows10Upgrade9252.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
2412	3160	WerFault.exe	84
5452	6252	WerFault.exe	126
232	5668	WerFault.exe	134
5772	4480	WerFault.exe	138
976	5416	WerFault.exe	142
5028	5200	WerFault.exe	146
3124	5828	WerFault.exe	156
5616	5892	WerFault.exe	160
6524	5124	WerFault.exe	164

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Windows10Upgrade9252.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeBackupPrivilege	4580	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	4580	Windows10Upgrade9252.exe
Token: SeDebugPrivilege	2756	firefox.exe
Token: SeDebugPrivilege	2756	firefox.exe
Token: SeDebugPrivilege	2756	firefox.exe
Token: SeDebugPrivilege	2756	firefox.exe
Token: SeDebugPrivilege	2756	firefox.exe
Token: SeBackupPrivilege	6792	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	6792	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	6792	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	6792	Windows10Upgrade9252.exe
Token: SeDebugPrivilege	6252	Windows10UpgraderApp.exe
Token: SeDebugPrivilege	6252	Windows10UpgraderApp.exe
Token: SeDebugPrivilege	6252	Windows10UpgraderApp.exe
Token: SeDebugPrivilege	6252	Windows10UpgraderApp.exe
Token: SeBackupPrivilege	5708	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	5708	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	5708	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	5708	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	964	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	964	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	964	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	964	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	7104	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	7104	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	7104	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	7104	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	3916	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	3916	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	3916	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	3916	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	3268	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	3268	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	3268	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	3268	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	1612	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	1612	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	1612	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	1612	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	5128	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	5128	Windows10Upgrade9252.exe
Token: SeBackupPrivilege	5128	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	5128	Windows10Upgrade9252.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3160	Windows10UpgraderApp.exe
3160	Windows10UpgraderApp.exe
3160	Windows10UpgraderApp.exe
3160	Windows10UpgraderApp.exe
3160	Windows10UpgraderApp.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
2756	firefox.exe
6792	Windows10Upgrade9252.exe
6252	Windows10UpgraderApp.exe
6252	Windows10UpgraderApp.exe
6252	Windows10UpgraderApp.exe
6252	Windows10UpgraderApp.exe
6252	Windows10UpgraderApp.exe
6252	Windows10UpgraderApp.exe
6252	Windows10UpgraderApp.exe
5708	Windows10Upgrade9252.exe
5668	Windows10UpgraderApp.exe
5668	Windows10UpgraderApp.exe
5668	Windows10UpgraderApp.exe
5668	Windows10UpgraderApp.exe
5668	Windows10UpgraderApp.exe
5668	Windows10UpgraderApp.exe
5668	Windows10UpgraderApp.exe
964	Windows10Upgrade9252.exe
4480	Windows10UpgraderApp.exe
4480	Windows10UpgraderApp.exe
4480	Windows10UpgraderApp.exe
4480	Windows10UpgraderApp.exe
4480	Windows10UpgraderApp.exe
4480	Windows10UpgraderApp.exe
4480	Windows10UpgraderApp.exe
7104	Windows10Upgrade9252.exe
5416	Windows10UpgraderApp.exe
5416	Windows10UpgraderApp.exe
5416	Windows10UpgraderApp.exe
5416	Windows10UpgraderApp.exe
5416	Windows10UpgraderApp.exe
5416	Windows10UpgraderApp.exe
5416	Windows10UpgraderApp.exe
3916	Windows10Upgrade9252.exe
5200	Windows10UpgraderApp.exe
5200	Windows10UpgraderApp.exe
5200	Windows10UpgraderApp.exe
5200	Windows10UpgraderApp.exe
5200	Windows10UpgraderApp.exe
5200	Windows10UpgraderApp.exe
5200	Windows10UpgraderApp.exe
3268	Windows10Upgrade9252.exe
5828	Windows10UpgraderApp.exe
5828	Windows10UpgraderApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3160	4580	Windows10Upgrade9252.exe	84
PID 4580 wrote to memory of 3160	4580	Windows10Upgrade9252.exe	84
PID 4580 wrote to memory of 3160	4580	Windows10Upgrade9252.exe	84
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 3008 wrote to memory of 2756	3008	firefox.exe	100
PID 2756 wrote to memory of 4304	2756	firefox.exe	101
PID 2756 wrote to memory of 4304	2756	firefox.exe	101
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102
PID 2756 wrote to memory of 2428	2756	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe
"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1836
    3⤵
    - Program crash
    PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3160 -ip 3160
1⤵
PID:3916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.0.2091672875\1488331608" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c645a77e-887b-4876-a337-b48cb8232bc2} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 1976 2db1c504758 gpu
    3⤵
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.1.381052438\1587933769" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc42d34a-8764-4064-bfda-8aac93755f79} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 2376 2db0ec72b58 socket
    3⤵
    PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.2.844022056\1356347077" -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 1668 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aedde831-eb45-47ae-87d6-4a831994d403} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 2972 2db1b75d058 tab
    3⤵
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.3.786309340\2062670356" -childID 2 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce21d679-6ddb-419a-b070-6c8ce2b0ac35} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 3780 2db0ec69958 tab
    3⤵
    PID:1868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.4.1661799743\1124917987" -childID 3 -isForBrowser -prefsHandle 4556 -prefMapHandle 4560 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83db835b-4d53-4f5e-b55b-ca74450b2242} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 4580 2db212f9958 tab
    3⤵
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.5.980791048\552792111" -childID 4 -isForBrowser -prefsHandle 4760 -prefMapHandle 5028 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf39f9d7-46b9-4f30-8fcf-f39f4c2e5705} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5012 2db0ec2d858 tab
    3⤵
    PID:2740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.6.1906329064\1636083328" -childID 5 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {879529dd-749c-4de8-b72c-d068aa08fadb} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5228 2db2193be58 tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.7.519108148\507594092" -childID 6 -isForBrowser -prefsHandle 5436 -prefMapHandle 5440 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3c899ea-da20-44de-bf11-2c23c9f28255} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5428 2db219f5b58 tab
    3⤵
    PID:4456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.8.1983347368\31181186" -childID 7 -isForBrowser -prefsHandle 5932 -prefMapHandle 5976 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {134a0eb1-479b-4fa8-825c-68f7a7cd9961} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 4896 2db28a05558 tab
    3⤵
    PID:212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.9.390071029\573138788" -parentBuildID 20221007134813 -prefsHandle 6992 -prefMapHandle 6996 -prefsLen 29694 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb5b5d72-55a6-4df1-b58e-4f55bfbab702} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10224 2db24bbc558 rdd
    3⤵
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.10.1312557247\1997271046" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6980 -prefMapHandle 6984 -prefsLen 29694 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bdd9a69-2520-4dc9-9fe3-9c3c12fd708d} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 6968 2db24bbda58 utility
    3⤵
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.11.1924813743\648818122" -childID 8 -isForBrowser -prefsHandle 10172 -prefMapHandle 10176 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {068e2d23-e3ce-4048-8c94-a51b2cc30d71} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 6744 2db25283f58 tab
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.12.1042585406\2006575561" -childID 9 -isForBrowser -prefsHandle 10144 -prefMapHandle 10140 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2555906d-5c5a-49c4-8e01-15b769684037} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10152 2db25284258 tab
    3⤵
    PID:844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.13.937831735\1538381803" -childID 10 -isForBrowser -prefsHandle 6508 -prefMapHandle 6512 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {251c1cf6-8992-4a6d-8091-8471e4fb1c27} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 6524 2db25d47f58 tab
    3⤵
    PID:2828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.14.483980115\1243123276" -childID 11 -isForBrowser -prefsHandle 6496 -prefMapHandle 6492 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e98d023-a9aa-42db-aafd-3125c524529e} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10204 2db28347858 tab
    3⤵
    PID:552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.15.496213282\1218411724" -childID 12 -isForBrowser -prefsHandle 9816 -prefMapHandle 10600 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9df5d023-56ea-4080-8da4-1a63d148ebe1} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10576 2db270f9b58 tab
    3⤵
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.16.2018710211\1276539024" -childID 13 -isForBrowser -prefsHandle 9780 -prefMapHandle 9784 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caeaf95f-1447-4eab-af84-545f57c6afec} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10696 2db28773a58 tab
    3⤵
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.17.63646664\1710446068" -childID 14 -isForBrowser -prefsHandle 10888 -prefMapHandle 10892 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {812ad973-6476-4375-8588-cf7cd06330e0} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10884 2db28b2e958 tab
    3⤵
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.18.1149425469\1481467640" -childID 15 -isForBrowser -prefsHandle 9676 -prefMapHandle 9680 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75669659-151f-4d34-89cc-080a459b126a} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9664 2db28347558 tab
    3⤵
    PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.19.1491666194\1170825509" -childID 16 -isForBrowser -prefsHandle 9572 -prefMapHandle 9576 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6048ca7-9560-4951-be9a-7f379d677158} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9564 2db25d45258 tab
    3⤵
    PID:3524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.20.319878296\1693435455" -childID 17 -isForBrowser -prefsHandle 11244 -prefMapHandle 11252 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99d2447b-51aa-4ab8-92a9-0d3ae3d5bc74} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 11220 2db28c44b58 tab
    3⤵
    PID:5788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.21.1899491014\1225994073" -childID 18 -isForBrowser -prefsHandle 9372 -prefMapHandle 9376 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7d4670b-f07f-466a-97df-10a400f61af0} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9364 2db28c44258 tab
    3⤵
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.22.4135606\1350016245" -childID 19 -isForBrowser -prefsHandle 9344 -prefMapHandle 9348 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a40c62a-345a-4393-a690-ef2f4dd2abda} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9172 2db28c46958 tab
    3⤵
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.23.1259620078\380085104" -childID 20 -isForBrowser -prefsHandle 5512 -prefMapHandle 9828 -prefsLen 29734 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b6cc526-42ba-443c-b915-faf4d0a642d7} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5596 2db29a89b58 tab
    3⤵
    PID:6568
- - C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
    "C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:6792
  - - C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
      "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Internet Explorer settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 1976
        5⤵
        Program crash
        
        PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.24.363755686\576763000" -childID 21 -isForBrowser -prefsHandle 11208 -prefMapHandle 11212 -prefsLen 29799 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6f13d76-a64f-4b70-baaa-f8026216bc6b} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9496 2db1c503b58 tab
    3⤵
    PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 6252 -ip 6252
1⤵
PID:5420

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5708
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 1972
    3⤵
    - Program crash
    PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5668 -ip 5668
1⤵
PID:884

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:964
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1948
    3⤵
    - Program crash
    PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4480 -ip 4480
1⤵
PID:7044

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7104
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 1944
    3⤵
    - Program crash
    PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5416 -ip 5416
1⤵
PID:3904

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3916
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 1948
    3⤵
    - Program crash
    PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5200 -ip 5200
1⤵
PID:5084

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3268
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 1924
    3⤵
    - Program crash
    PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5828 -ip 5828
1⤵
PID:1992

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1612
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  PID:5892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 2236
    3⤵
    - Program crash
    PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5892 -ip 5892
1⤵
PID:1436

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe
"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5128
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  PID:5124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 1940
    3⤵
    - Program crash
    PID:6524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5124 -ip 5124
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

Filesize
27B

MD5
ca22263c7a6f965df18f5c601f5db7ce

SHA1
e4b1a401ed497523a583ae8613646b03778a33a6

SHA256
299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c

SHA512
3cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Downloader.dll

Filesize
197KB

MD5
5b62ad6ae42f32806062ad1bcb3e2de5

SHA1
8d4a543eac9643931fcb620cd588e2cc1067920a

SHA256
96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3

SHA512
af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

Filesize
3.5MB

MD5
ab38a78503d8ad3ce7d69f937d71a99c

SHA1
00b6a6f09dd45e356ef9e2cacd554c728313fa99

SHA256
f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782

SHA512
fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css

Filesize
82B

MD5
b81d1e97c529ac3d7f5a699afce27080

SHA1
0a981264db289afd71695b4d6849672187e8120f

SHA256
35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

SHA512
e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css

Filesize
5KB

MD5
7f5fcac447cc2150ac90020f8dc8c98b

SHA1
5710398d65fba59bd91d603fc340bf2a101df40a

SHA256
453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850

SHA512
b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm

Filesize
60KB

MD5
b2a06af2867a2bb3d4b198a22f7936b3

SHA1
98a28e15abdd2d6989d667cc578bf6ab954c29f5

SHA256
40f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23

SHA512
eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif

Filesize
16KB

MD5
1a276cb116bdece96adf8e32c4af4fee

SHA1
6bc30738fcd0c04370436f4d3340d460d25b788f

SHA256
9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

SHA512
5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png

Filesize
2KB

MD5
afeed45df4d74d93c260a86e71e09102

SHA1
2cc520e3d23f6b371c288645649a482a5db7ccd9

SHA256
f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

SHA512
778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png

Filesize
420B

MD5
0968430a52f9f877d83ef2b46b107631

SHA1
c1436477b4ee1ee0b0c81c9036eb228e4038b376

SHA256
b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96

SHA512
7a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\strings[1]

Filesize
11KB

MD5
1e1f71d6643ad3cfc44879d4309551f4

SHA1
2da6d2cf306b4fd61de219f7dcafe5b6d58e05d5

SHA256
7a8d46866bf0ec208669cf22241af8fcacd027f09e59aa1d844314abbb5be2d0

SHA512
d2de717d0e3f75d2abc4783e79aacd4ed50cc1a3bbaccdb3d86dfd5104ee06075762ba9f8044e81a469d55fdf2e5be8d385d26738be6905771c2aa31bf6e8319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\errorPageStrings[1]

Filesize
4KB

MD5
d65ec06f21c379c87040b83cc1abac6b

SHA1
208d0a0bb775661758394be7e4afb18357e46c8b

SHA256
a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

SHA512
8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\NewErrorPageTemplate[1]

Filesize
1KB

MD5
dfeabde84792228093a5a270352395b6

SHA1
e41258c9576721025926326f76063c2305586f76

SHA256
77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

SHA512
e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\httpErrorPagesScripts[1]

Filesize
11KB

MD5
9234071287e637f85d721463c488704c

SHA1
cca09b1e0fba38ba29d3972ed8dcecefdef8c152

SHA256
65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

SHA512
87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\dnserrordiagoff[1]

Filesize
1KB

MD5
7e81a79f38695e467a49ee41dd24146d

SHA1
035e110c36bf3072525b05394f73d1ba54d0d316

SHA256
a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536

SHA512
53c5f2f2b9ad8b555f9ae6644941cf2016108e803ea6ab2c7418e31e66874dea5a2bc04be0fa9766e7206617879520e730e9e3e0de136bae886c2e786082d622

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\21A7D5731DFA23DF1F2B625219D1B9B7A118D4C4

Filesize
192KB

MD5
f6dbb2ef84c0e0acee5f4952a62667ef

SHA1
72c55392307a31d696d835bf31ebe5c35085cc2a

SHA256
c58d74b3529c6de0a4e433e548d08207014ca6cd6badba872560e35ac11e64cb

SHA512
53c956fed4f83d331f7b3bb13e7cdb1a8212969f4542f85fdd6d9502d08e74ceb3f1ea732e9ed5c7e652da1ba3f4dd3487724f273baedf7986589f60de506965

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\A72798DEF4F924983D5A0DB82D383C613B515FF2

Filesize
13KB

MD5
25a1a4d015fa5e8f68ad5b6402ed2e45

SHA1
aefb5286a696410e2bcab01d8887a318ad3274d3

SHA256
197e124dd2b73affbe2a182f17fdf6ee208f27968ee0c92183bbd6561fdc73b3

SHA512
cc652319020bd1f96919e503b8ec3bcd633c369445ec66855cf2e84e3b07b90ba88f37939f95f0bff6291559cd7528dca3a9414b4c7abee05b5595531fc4ab4f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\DE23CF9E01AA6278843163311B343B07086E02FC

Filesize
207KB

MD5
5687316730aa837c8db841f2f7b93c8f

SHA1
36c094fe8bb314d90c8ecab56033c36e7a83cc58

SHA256
1fa1ab6387d46aedeccce99a66b2e4ad1b506c3168e80e6b30d932e8be32187d

SHA512
ac9f0e69b8f2bedde24d96ed6938644913340998b09e1d0303d138c14f74ad885abd7c062b6d0dfa68a17c40a2eb928e1c48b9019f61e7ec90c032f67b66be14

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\thumbnails\b1b557eda59743b28a0e020c845fb289.png

Filesize
9KB

MD5
9baf85bbf2544c70cf20796d9acb292b

SHA1
357777a36738c0cad508246da490aac65a88960a

SHA256
8b8cacb7435b012d62aa6aae25e8c1de9e20c798e8ea98046d971aada86d0dd1

SHA512
3bcb1d38116135d8e2ece03ecb982c10561b0150fa14492fc368cea77066d07244771800a80fc131b93ffc127812a63d0e6b989570349869a41a1fc1196e6103

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\GetCurrentOOBE.dll

Filesize
126KB

MD5
c062b03a177cf1d25b91d0a911784533

SHA1
dd96534252e07bb6db047bf990a3caed70e05cc3

SHA256
396df40adac039f8a6847b7c8efff7dfead7a77b93e12b0b141a4cfa808c0035

SHA512
27850b93c3f33e1c6672cea4e0a1d572375f0dd8c9f2d3521f1060123eacdc9da456447afcc23ca751222941e09d611fdd80d236b7620b15b12c16f133d6e41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\resources\ux\Microsoft.WinJS\css\ui-dark.css

Filesize
262KB

MD5
c9674190d140117be506a070c4ef5be2

SHA1
51db8cf46f6ecac6cab85a52402fd66c035e837f

SHA256
1e8e74e5a29f269157c043718b43c10c6f8beb806a6d2b3f3f2dd542731fd196

SHA512
9d41b784a377dc9a1bb61e337ade6acf7f841a672609626697925ace30f8fc574e58ee54388a76b446a84d4ba6de46d72e0b7cad64ada5bf5664c28df09ca585

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\resources\ux\Microsoft.WinJS\js\base.js

Filesize
1.2MB

MD5
221c534deb612992681b0a2fb55bc5ed

SHA1
1ac3eb5a4ea6a0d876f8077e87357fccba472323

SHA256
7b67ab12bd5dcc229ea7f197fcb7723b1c41a517e198fad31020d8fea42e9715

SHA512
c9bd493fad305eb4c881eb6c9aa1daf672ec3531ca4871c44f3383b48389db24232b6dfe35ab6e82a5c8bc1a38f68b57fd30e2fab35bd6237d751285fd74444e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\resources\ux\block.png

Filesize
919B

MD5
a132f4d4f23f1bc40cfdb88223b1c74a

SHA1
11fc3eea08765c7dfa697cd9cacd18f7a9900181

SHA256
35825ad138cec97d3cff27cd8d139377e6ba4d0a55b473b59fb4f5f4b9508be6

SHA512
c5284f403c6617947545b0282d935d7e3b2ccb30c67d85920907b7cbd00c01e4c560824c3e7d77a51e97a646aff806879f76e418973a66e2fe1086b8288326b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU4E3F.tmp\appraiserxp.dll

Filesize
363KB

MD5
cbb270591c9a1bfb1b10559ab672f705

SHA1
fed0d59d60709b5b05b9d31030ea7a5422767a7e

SHA256
770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f

SHA512
67c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU4E3F.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css

Filesize
39KB

MD5
5ad8ceea06e280b9b42e1b8df4b8b407

SHA1
693ea7ac3f9fed186e0165e7667d2c41376c5d61

SHA256
03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb

SHA512
1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c68043fc3df5b8f8630635bae4fdc5e4

SHA1
6ccb5a5eca190b35cb871ed34a62a21b807f07bc

SHA256
2999c0c67f2904e7016962c74fa86e18481247efdf50a307f63bd35d2f25c7d5

SHA512
f4e89c6eb38044f1d540e60210197e8634285b501b875ea52aa832471550e9df8702e4327b04a93b7cd86c579eb4d7e05ba0e974546e6d21e5ffb7cd071f5a09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\8a6d8cf4-8492-4ed5-ab41-bf652998a09e

Filesize
11KB

MD5
b9b908d6f19c6154cad36771953e773c

SHA1
cfb19f5804059e8698cf79f68adb74e3d9c881db

SHA256
4ae805a0d387ba420e8b5b6452b71aea9b3dee37d1ba0952bd0a81cb9bc9dd95

SHA512
a337185662cc578cebd2cc9ae61bc269a812ad3f6a266b5b1bb5f403bee3cdbcc493abcd609191c1c4f938d445ff4e84d21a74a70d98f8d6dfb19601a449a65f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\f441f24f-e7cd-43f6-bd8d-6557d165e5e1

Filesize
746B

MD5
61e4667ffdb647859ce0162753de343b

SHA1
4fa824303caae0495c3a6dcb29ded52a32c61d02

SHA256
6d047d88d274aa418f861252d256a4a6136e7940716488c78d6fb4b45f8c767c

SHA512
3be2837778d676c5ea67272b7e510d291e3818c9670dc7996c9f3a8696509a696da0a052df86132821d5dc57dfbd242a20e21f8e6019d97d1a5f8b622b694d8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

Filesize
6KB

MD5
381fbbe6093579702acff869f7b0e94a

SHA1
fd663103fcea584236ebbf828df1cdc17645d0dc

SHA256
979e882e58acec7629382692aba0a6ee9c55bdc9cba68ea56036afe88a884dee

SHA512
d26f7b3ed5ca270371627ede886f516c23cd029cd21d59bb5b1ab32fa7aa969e5f992565c2ce1425b82621d26f6f4fbbd0f176506a39dad66a8afd5f96bd0e41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

Filesize
9KB

MD5
7331a66f651346d99a43720d380f8722

SHA1
92589811ba5250dae6324d710ab989070e617133

SHA256
0d88c667a6c938d253fea01421be4ccc8954a4db8cdf4abbb1c154818d6d516c

SHA512
348884bc36e31eaca99a23d1fcade745c0a522da5e3f98fb2e711ee158101e45040ec850fe861a0f387b5f3d66c0d71c3647112c98ccff8554c5b0d88c277341

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

Filesize
6KB

MD5
8da51a5f1084d796a2b14b5e737823db

SHA1
9f53af609b9bb70d1ac6d2cd73648dc84b6adc13

SHA256
2c5966f2db5a8bb99126f7b9bc8591d649168024434b2cbd03944b9b1eff31bd

SHA512
b903b8a5168c405cfcaaaf6e909878f3b877806941ceb7f65075d485fcdd98b94211c06727b4dcd3b13899b9ea15a14d9f3ef92323fa44fec229a722ad6f44af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

Filesize
6KB

MD5
6bcaea6844fa12ca3a6953a7b917b1e5

SHA1
490324d6bdec38c9bfddf75652b8b35e06693530

SHA256
de60a4a5588ba9a4aa97c5be91ed30ce8ba319c2056b9813e249e1c3b225c658

SHA512
f7ae973a2c467afcf3eaa84c54a3846efa6dc88cebd60023d7bb7363828113d0d2a1651e798e184835816ab31d5069419f7b211e0e5f7323471f6d01605b3bf2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

Filesize
6KB

MD5
bb76f6e723e78f59636420aff839125b

SHA1
1f72c57d4b5efdf638777e80d97fb8811a638dd1

SHA256
162e4910e9ecb7f0ca279fff56e7e0f9a434680d413f2c749e1f407cf9c04142

SHA512
7c12cc82a5b3db922a1f902f3d10f19e75dd6db35e3dd40141ee1857a7c420b1f25c445e193f253ea05c2c7f0fef3df03ffc1c2bea1ba4bc1a60f81a8fc9dbfd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
ffea31aa8eda46ee8ce6ae931f4028d5

SHA1
7be7a42992dc49be28a28da42f4e601ce6d63f55

SHA256
fcd15e2cc50ed048e7cd04a82005a6e85bef2b128dde83b001b6c62b54daeb03

SHA512
f19aa167e4528e4389a2420071ae6bec89e2e05f7a012a43d4107a8f3f7e33d4a911e092ee207db3a4fbd436db78caed073bfd6a5cb62e62cd4d72351322bfcc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
9d365d9d7e0cb7fd4290b7d2d1142ba0

SHA1
569f36f3ae8bcd529a3da71fe2c327e94fd22187

SHA256
81aa674db1ec349ea3550cba159de944cf62bb54de618d23b532f8cfb5665f61

SHA512
27a9a577c5035e008c426b512e25e860a953de9d07d93a7249c94d609ab4a9927ea4afb3dcd6f06888a29c196187f9d5e564a4c6e71d58e0772054a67f3cd165

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
0e3bb405d9304adc7d66eda423dc5f00

SHA1
617bf613c846615766027665f949a27134d5dd9c

SHA256
a5c9342ee57721a585e33f2b7fbaff79efef4760616881de7e0d86b135ce4dd9

SHA512
604a8f40c785b6ec54fbef485b53f2b1ff48f19adaf2728900af64f8a31ad46dc7d2e0309212c639eedcc51b94c2fdd566ee67ba5d1fbb1a8c77af3a4665ab8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d23e63956a6602f61fdf3dcb726cd218

SHA1
82df39b52f80cfd2a42da3339a26c9b4a2ae6107

SHA256
a6c59cbd144e6a592d4bdaaf2d28eb5348156e20c8b3bd53c1c05b26bc192280

SHA512
f17a43f7972e596957244998ecc52fef5e174278eea23c873dff346dcea0bf4cd533d07b2ff844e56e3c3529e47d9c7fbcd5b6e754e2a61be24ba07eb7b79c49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
adfb35ef0b5d8b48fc2c61e4b08b011d

SHA1
54c9560408dccd38d3f0eb06bf7ae8ae4a77fcb4

SHA256
b4390fcc79ae70b3ef92d1dbeaa2e796932fbd29905cf18768f69cb5df33e895

SHA512
d9bb264b62815f28a31fe94bb5622e46990a9f24f9442e65cbf3eebe6a012252f8f8a961182635cd58b4e28fedd4d99219472698c0c221207031772c582bd93f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
2dc978a70d50d3693c73926f22d9bff2

SHA1
dbf0b3d674d75b3a3a844a188b461711f05d0050

SHA256
94362d8976153bd1d8a75fc1ede9cd403ae327dfd9814b93d6b707214d96994a

SHA512
5bb94c54a342c728f6d12b0a7989a35bfa15de4cb630e03fca2a06486aa3d8a722bbd5363de82acdf90f0189ce8173e7840f24288b8ac30b42a51ee30040b041

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
728KB

MD5
2157ce3a68098a860b6335c93ccfd5ff

SHA1
f9a2df5a28a5526b5d990954075740f9b3cf24b5

SHA256
9e5e74b13ff203484a6463ae2d2300a8b6a20c0c8faa269f88a85ca08c587765

SHA512
5a03c67cffef71100dd92edff698e1e2c0b6d1e121213470d810daef0ba2dea496711b9cbba85cd57bfb62827c7910226fdb994ced5b37b0a4ff69fbc1d3d550

Download Submit
C:\Users\Admin\Downloads\Windows10Upgrade9252.ZA1OLnjZ.exe.part

Filesize
43KB

MD5
a44f1339c2cdfeb175f69f7553e427d9

SHA1
5c60d53ae39fed505f210730e222eca52ca60c2d

SHA256
665cdb2fe09854ff3e3ca54689842884f22bb3b798e944933f9f0a0f123a1b37

SHA512
d10632c4d4e86a73f9d8898f7376685539aa651535c0856d195c5970e9df0549c4a59addcb9bd03e103fa7ebc875e3309d92da59c811c1942b9f5d72cfda57d7

Download Submit
C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

Filesize
3.2MB

MD5
c0b25def4312fbddbcc4f01c6c0f5ba6

SHA1
8d16a183d61233e7d6b6af7b3cafc6645ac2acb1

SHA256
c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79

SHA512
8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

Filesize
40B

MD5
51ddd33b146cc550591608dfd8bd5852

SHA1
5f3c2e218369bbe6ea3302348cb6f79df1b1b744

SHA256
1dbee252f9d0765ad4203577e0c7d67678f4406f94f60fa2b6b5a2a642ecc649

SHA512
4d25994b063dc6662d90f7c75199f66c695968f258afb80007a7d4700019211f6045e3834b7c34de93659b965bb4ce6b229c1db57b9dd5d4ec7c9555e653af51

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll

Filesize
59KB

MD5
c61dcf4db82482a4498fcca646a6c640

SHA1
981bf318813c54e94efe04cc20dc6ac070adcfe9

SHA256
c98289454cdcb2266e82204af73a799b09458a899cdd8366e24fbb613273c0ff

SHA512
6b26c8e4c1c15f224a5d196524f35583f1e2f878fa2532a199be068d89c06bdbafd2ca3e740b1ed104844d760e62b25d8a6d589c511ed6fe2713b925949ab2af

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll

Filesize
404KB

MD5
410fac98056ab0be74e4539a4c0eaaff

SHA1
10a66618bd67f26b3b6e418df4aeb93f0e599c2b

SHA256
09ec6dc5cb94160b2c4d9f1f4224a7dc1951f227dd311acb1bc4335f23db9b24

SHA512
84999daecb8fce1c4c76ac2527278ca7896c5e90ec37754bb0f10f3cb391adc338cde923c51a3ffa90d49ebbf0516f7632889970efb20ee6ea797185edf74222

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE

Filesize
64KB

MD5
d705a34a869ac46e3f07c9be3ea1693a

SHA1
b21847a23ed6d0b7c04c0519ef0e11b5e422c3b1

SHA256
0436deda2dbbd46d74e4a83b5897ba26a3ec35a9ab77d4b46e7477d9cdd213b8

SHA512
cfe243ab1385ee1086c50f434a934654b5bbc6fb4e9b562bf1738c2f7b50a49f22e748d2b71d9f69bad505272de70e4be09d8cf13475121defec1e6aeb923479

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll

Filesize
1.0MB

MD5
87bc3d50a51cae672f2e3ed50691e5b5

SHA1
8da385a349012cb8e2e56b320d04fe4a1e56e14d

SHA256
896994df8e63229dc8c860f40cfd92c6fcea6e684ec0d51f111c812eee7349ba

SHA512
504d89b40935dc266af46438fb391f9e3d9a925fdce6c5daebc34e5c7fc33ced01ebd32f8da083c41f01a2766dafb9102b02b2800b1cb1ab3057413a6d9ca8ec

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css

Filesize
40KB

MD5
415d4bb726c52bd91be8f3afd81e50cc

SHA1
9732e1e6aeb13a6f180b21bb5bd8a4acf7d96dbd

SHA256
c6dd0940a263382fb735f1cdc8550234f9c081625bfe2e5363cb8bb65cc06440

SHA512
c7a8b805027906d8b67d50773a7e362f2e87d3af61b23fab33aec929e21f42610a35f857ede9a17772c5f2b42c1382f8daf7240b76f3996aa65988a87c367847

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js

Filesize
2.9MB

MD5
b02d15ec9159d708837121c9685fa551

SHA1
577edd3d56f6a92d5248b35cd76a442b2c1caf37

SHA256
d23519634fa23488b7151ff1c31cc81e9531033f669d10c119f375198d02e22b

SHA512
60305cd9baa19a7e526f4ee9eac425f17563ab4dda0c861cc163b64495e72b547258ff7e804dd7c9820bd3543b2158109b1f72775096a2ba36ce02ad908f8a0a

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png

Filesize
174B

MD5
062f3f1fff1deb4e8abe7a16c8aa6398

SHA1
c943234ce3e553a05be711da23cbafbe459c5988

SHA256
f67ac334038896e37ca126ac4dbd1fff51cd0ffe8c99ed1cb709d64864b72392

SHA512
c6bf7e63476f4ba36aa09a133bff02c6d68503361d9487d598b28a0bda631a496810bb9b0ba8c89efbfe16bb53693a6a81c93da1d00fc923b655a070d5dbdd2d

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm

Filesize
54KB

MD5
66b63e270cc9186f7186b316606f541f

SHA1
35468eeefc8d878f843bbf0bb0b4b1d43b843cdf

SHA256
00f8f3e4534146858326d6d2524f3360dfc9e5d149e207d61cabac17ad7a5f9f

SHA512
b9d1b4b201cabf087a44d958584ecb1c110807b9bd9865f1e76bf9d989d7d000ee84f07558bcae5e05d11f7121fe2c402fcf916b00ff5d8eac7eaf05e21a29f2

Download Submit
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png

Filesize
1KB

MD5
5a7499645619886bfe949250e1807415

SHA1
152295cf08fcf1e21e26f05969cbb02bd22a8af6

SHA256
db27bad6e59128d58031706c83210ae780a9261e01af6fde6323bd30f7a97b12

SHA512
201fc4fa1aa035cf09872d6f335d94c97433b79af343d532d0dd5c6ab6ba60b5a3a3b60f466e2c7107c19e04ffcdfa8a016842b4f29ea3ee6dd3d60304d8d8dc

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads