Malware Analysis Report

2025-04-13 22:37

Sample ID 240326-tpnwrsdh78
Target Windows10Upgrade9252.exe
SHA256 c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
Tags
discovery
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79

Threat Level: Likely malicious

The file Windows10Upgrade9252.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Program crash

Enumerates physical storage devices

Uses Task Scheduler COM API

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

NTFS ADS

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-26 16:14

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-26 16:14

Reported

2024-03-26 16:20

Platform

win10v2004-20231215-en

Max time kernel

269s

Max time network

270s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"

Signatures

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\Windows10Upgrade9252.exe:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Users\Admin\Downloads\Windows10Upgrade9252.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4580 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
PID 4580 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
PID 4580 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3008 wrote to memory of 2756 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 4304 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 4304 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2756 wrote to memory of 2428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe

"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3160 -ip 3160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1836

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.0.2091672875\1488331608" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c645a77e-887b-4876-a337-b48cb8232bc2} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 1976 2db1c504758 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.1.381052438\1587933769" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc42d34a-8764-4064-bfda-8aac93755f79} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 2376 2db0ec72b58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.2.844022056\1356347077" -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 1668 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aedde831-eb45-47ae-87d6-4a831994d403} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 2972 2db1b75d058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.3.786309340\2062670356" -childID 2 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce21d679-6ddb-419a-b070-6c8ce2b0ac35} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 3780 2db0ec69958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.4.1661799743\1124917987" -childID 3 -isForBrowser -prefsHandle 4556 -prefMapHandle 4560 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83db835b-4d53-4f5e-b55b-ca74450b2242} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 4580 2db212f9958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.5.980791048\552792111" -childID 4 -isForBrowser -prefsHandle 4760 -prefMapHandle 5028 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf39f9d7-46b9-4f30-8fcf-f39f4c2e5705} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5012 2db0ec2d858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.6.1906329064\1636083328" -childID 5 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {879529dd-749c-4de8-b72c-d068aa08fadb} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5228 2db2193be58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.7.519108148\507594092" -childID 6 -isForBrowser -prefsHandle 5436 -prefMapHandle 5440 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3c899ea-da20-44de-bf11-2c23c9f28255} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5428 2db219f5b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.8.1983347368\31181186" -childID 7 -isForBrowser -prefsHandle 5932 -prefMapHandle 5976 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {134a0eb1-479b-4fa8-825c-68f7a7cd9961} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 4896 2db28a05558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.9.390071029\573138788" -parentBuildID 20221007134813 -prefsHandle 6992 -prefMapHandle 6996 -prefsLen 29694 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb5b5d72-55a6-4df1-b58e-4f55bfbab702} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10224 2db24bbc558 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.10.1312557247\1997271046" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6980 -prefMapHandle 6984 -prefsLen 29694 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bdd9a69-2520-4dc9-9fe3-9c3c12fd708d} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 6968 2db24bbda58 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.11.1924813743\648818122" -childID 8 -isForBrowser -prefsHandle 10172 -prefMapHandle 10176 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {068e2d23-e3ce-4048-8c94-a51b2cc30d71} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 6744 2db25283f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.12.1042585406\2006575561" -childID 9 -isForBrowser -prefsHandle 10144 -prefMapHandle 10140 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2555906d-5c5a-49c4-8e01-15b769684037} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10152 2db25284258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.13.937831735\1538381803" -childID 10 -isForBrowser -prefsHandle 6508 -prefMapHandle 6512 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {251c1cf6-8992-4a6d-8091-8471e4fb1c27} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 6524 2db25d47f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.14.483980115\1243123276" -childID 11 -isForBrowser -prefsHandle 6496 -prefMapHandle 6492 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e98d023-a9aa-42db-aafd-3125c524529e} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10204 2db28347858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.15.496213282\1218411724" -childID 12 -isForBrowser -prefsHandle 9816 -prefMapHandle 10600 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9df5d023-56ea-4080-8da4-1a63d148ebe1} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10576 2db270f9b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.16.2018710211\1276539024" -childID 13 -isForBrowser -prefsHandle 9780 -prefMapHandle 9784 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caeaf95f-1447-4eab-af84-545f57c6afec} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10696 2db28773a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.17.63646664\1710446068" -childID 14 -isForBrowser -prefsHandle 10888 -prefMapHandle 10892 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {812ad973-6476-4375-8588-cf7cd06330e0} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10884 2db28b2e958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.18.1149425469\1481467640" -childID 15 -isForBrowser -prefsHandle 9676 -prefMapHandle 9680 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75669659-151f-4d34-89cc-080a459b126a} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9664 2db28347558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.19.1491666194\1170825509" -childID 16 -isForBrowser -prefsHandle 9572 -prefMapHandle 9576 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6048ca7-9560-4951-be9a-7f379d677158} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9564 2db25d45258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.20.319878296\1693435455" -childID 17 -isForBrowser -prefsHandle 11244 -prefMapHandle 11252 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99d2447b-51aa-4ab8-92a9-0d3ae3d5bc74} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 11220 2db28c44b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.21.1899491014\1225994073" -childID 18 -isForBrowser -prefsHandle 9372 -prefMapHandle 9376 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7d4670b-f07f-466a-97df-10a400f61af0} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9364 2db28c44258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.22.4135606\1350016245" -childID 19 -isForBrowser -prefsHandle 9344 -prefMapHandle 9348 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a40c62a-345a-4393-a690-ef2f4dd2abda} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9172 2db28c46958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.23.1259620078\380085104" -childID 20 -isForBrowser -prefsHandle 5512 -prefMapHandle 9828 -prefsLen 29734 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b6cc526-42ba-443c-b915-faf4d0a642d7} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5596 2db29a89b58 tab

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 6252 -ip 6252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 1976

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5668 -ip 5668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 1972

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4480 -ip 4480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1948

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5416 -ip 5416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 1944

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5200 -ip 5200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 1948

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5828 -ip 5828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 1924

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5892 -ip 5892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 2236

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

"C:\Users\Admin\Downloads\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5124 -ip 5124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 1940

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.24.363755686\576763000" -childID 21 -isForBrowser -prefsHandle 11208 -prefMapHandle 11212 -prefsLen 29799 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6f13d76-a64f-4b70-baaa-f8026216bc6b} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 9496 2db1c503b58 tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 45.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
N/A 127.0.0.1:49205 tcp
N/A 127.0.0.1:49212 tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 44.239.148.246:443 shavar.services.mozilla.com tcp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 246.148.239.44.in-addr.arpa udp
US 8.8.8.8:53 69.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 ciscobinary.openh264.org udp
GB 88.221.134.209:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 209.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 216.58.212.238:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 r3---sn-aigl6ney.gvt1.com udp
GB 216.58.212.238:443 redirector.gvt1.com udp
GB 173.194.183.168:443 r3---sn-aigl6ney.gvt1.com tcp
US 8.8.8.8:53 r3.sn-aigl6ney.gvt1.com udp
GB 173.194.183.168:443 r3.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 168.183.194.173.in-addr.arpa udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 47.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.67.143:80 pastebin.com tcp
US 104.20.67.143:80 pastebin.com tcp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.67.143:443 pastebin.com tcp
US 104.20.67.143:80 pastebin.com tcp
US 104.20.67.143:443 pastebin.com tcp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 services.vlitag.com udp
US 104.22.59.199:443 services.vlitag.com tcp
US 8.8.8.8:53 services.vlitag.com udp
US 8.8.8.8:53 services.vlitag.com udp
US 104.22.59.199:443 services.vlitag.com udp
US 104.22.59.199:443 services.vlitag.com tcp
US 8.8.8.8:53 www-alv.google-analytics.com udp
US 8.8.8.8:53 www-alv.google-analytics.com udp
US 8.8.8.8:53 232.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 199.59.22.104.in-addr.arpa udp
US 104.22.59.199:443 services.vlitag.com udp
US 8.8.8.8:53 dsp.vlitag.com udp
US 8.8.8.8:53 cmp.inmobi.com udp
US 8.8.8.8:53 s3.vlitag.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 imasdk.googleapis.com udp
US 8.8.8.8:53 c.amazon-adsystem.com udp
US 172.67.21.227:443 s3.vlitag.com tcp
US 8.8.8.8:53 dsp.vlitag.com udp
US 8.8.8.8:53 d23sp3kzv1t6m5.cloudfront.net udp
US 8.8.8.8:53 imasdk.googleapis.com udp
GB 142.250.187.202:443 imasdk.googleapis.com tcp
US 104.22.59.199:443 dsp.vlitag.com tcp
US 104.22.59.199:443 dsp.vlitag.com tcp
US 104.22.59.199:443 dsp.vlitag.com udp
US 8.8.8.8:53 d23sp3kzv1t6m5.cloudfront.net udp
US 8.8.8.8:53 imasdk.googleapis.com udp
US 8.8.8.8:53 dsp.vlitag.com udp
US 8.8.8.8:53 securepubads46.g.doubleclick.net udp
US 8.8.8.8:53 s3.vlitag.com udp
US 8.8.8.8:53 d1ykf07e75w7ss.cloudfront.net udp
US 172.67.21.227:443 s3.vlitag.com udp
US 8.8.8.8:53 s3.vlitag.com udp
US 8.8.8.8:53 securepubads46.g.doubleclick.net udp
US 8.8.8.8:53 d1ykf07e75w7ss.cloudfront.net udp
US 172.67.21.227:443 s3.vlitag.com tcp
GB 142.250.187.202:443 imasdk.googleapis.com tcp
GB 18.244.114.102:443 d23sp3kzv1t6m5.cloudfront.net tcp
GB 172.217.169.34:443 securepubads46.g.doubleclick.net tcp
GB 18.245.144.237:443 d1ykf07e75w7ss.cloudfront.net tcp
US 8.8.8.8:53 178.38.239.216.in-addr.arpa udp
US 8.8.8.8:53 227.21.67.172.in-addr.arpa udp
US 8.8.8.8:53 34.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 102.114.244.18.in-addr.arpa udp
US 8.8.8.8:53 237.144.245.18.in-addr.arpa udp
GB 172.217.169.34:443 securepubads46.g.doubleclick.net udp
GB 18.245.144.237:443 d1ykf07e75w7ss.cloudfront.net tcp
GB 142.250.187.202:443 imasdk.googleapis.com udp
US 8.8.8.8:53 config.aps.amazon-adsystem.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 px.vliplatform.com udp
US 8.8.8.8:53 aax.amazon-adsystem.com udp
US 8.8.8.8:53 config.aps.amazon-adsystem.com udp
DE 141.101.120.10:443 px.vliplatform.com tcp
DE 141.101.120.10:443 px.vliplatform.com tcp
DE 141.101.120.10:443 px.vliplatform.com tcp
DE 141.101.120.10:443 px.vliplatform.com tcp
US 8.8.8.8:53 px.vliplatform.com udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
DE 141.101.120.10:443 px.vliplatform.com tcp
DE 141.101.120.10:443 px.vliplatform.com tcp
GB 18.245.185.228:443 aax.amazon-adsystem.com tcp
GB 18.245.185.228:443 aax.amazon-adsystem.com tcp
GB 18.245.185.228:443 aax.amazon-adsystem.com tcp
GB 18.245.185.228:443 aax.amazon-adsystem.com tcp
US 8.8.8.8:53 config.aps.amazon-adsystem.com udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
GB 18.245.185.228:443 aax.amazon-adsystem.com tcp
US 8.8.8.8:53 px.vliplatform.com udp
GB 18.245.185.228:443 aax.amazon-adsystem.com tcp
US 8.8.8.8:53 d1jvc9b8z3vcjs.cloudfront.net udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.120.101.141.in-addr.arpa udp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 228.185.245.18.in-addr.arpa udp
US 8.8.8.8:53 d1jvc9b8z3vcjs.cloudfront.net udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
DE 141.101.120.10:443 px.vliplatform.com udp
GB 52.84.90.86:443 config.aps.amazon-adsystem.com tcp
US 8.8.8.8:53 api.cmp.inmobi.com udp
DE 35.156.224.54:443 api.cmp.inmobi.com tcp
US 8.8.8.8:53 choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com udp
US 8.8.8.8:53 choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com udp
US 8.8.8.8:53 54.224.156.35.in-addr.arpa udp
US 8.8.8.8:53 script.4dex.io udp
US 8.8.8.8:53 prebid-eu.creativecdn.com udp
US 8.8.8.8:53 useast.quantumdex.io udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 ap.lijit.com udp
US 172.67.75.241:443 script.4dex.io tcp
US 8.8.8.8:53 script.4dex.io udp
US 8.8.8.8:53 prebid-eu.creativecdn.com udp
US 8.8.8.8:53 ib.anycast.adnxs.com udp
US 172.67.42.201:443 useast.quantumdex.io tcp
US 172.67.42.201:443 useast.quantumdex.io tcp
US 172.67.42.201:443 useast.quantumdex.io tcp
US 172.67.42.201:443 useast.quantumdex.io tcp
US 8.8.8.8:53 script.4dex.io udp
US 8.8.8.8:53 prebid-eu.creativecdn.com udp
US 8.8.8.8:53 ib.anycast.adnxs.com udp
US 8.8.8.8:53 useast.quantumdex.io udp
US 8.8.8.8:53 241.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 201.42.67.172.in-addr.arpa udp
US 8.8.8.8:53 blackbird-prd-ew1-alb-87915139.eu-west-1.elb.amazonaws.com udp
US 8.8.8.8:53 cadmus.script.ac udp
US 172.67.75.241:443 script.4dex.io tcp
US 8.8.8.8:53 useast.quantumdex.io udp
US 8.8.8.8:53 blackbird-prd-ew1-alb-87915139.eu-west-1.elb.amazonaws.com udp
US 104.18.22.145:443 cadmus.script.ac tcp
US 8.8.8.8:53 cadmus.script.ac udp
US 8.8.8.8:53 cadmus.script.ac udp
US 172.67.42.201:443 useast.quantumdex.io udp
US 172.67.75.241:443 script.4dex.io tcp
NL 185.184.8.90:443 prebid-eu.creativecdn.com tcp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
NL 185.184.8.90:443 prebid-eu.creativecdn.com tcp
IE 34.249.64.47:443 ap.lijit.com tcp
NL 185.184.8.90:443 prebid-eu.creativecdn.com tcp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
IE 34.249.64.47:443 ap.lijit.com tcp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
NL 185.184.8.90:443 prebid-eu.creativecdn.com tcp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 oa.openxcdn.net udp
US 8.8.8.8:53 static.criteo.net udp
US 8.8.8.8:53 cdn-ima.33across.com udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 950023dbaac38b1b03666b88514a356c.safeframe.googlesyndication.com udp
US 34.102.146.192:443 oa.openxcdn.net tcp
US 8.8.8.8:53 oa.openxcdn.net udp
US 8.8.8.8:53 static.nl3.vip.prod.criteo.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 a.teads.tv udp
US 8.8.8.8:53 oa.openxcdn.net udp
GB 216.58.204.65:443 950023dbaac38b1b03666b88514a356c.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 static.nl3.vip.prod.criteo.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
IE 34.249.64.47:443 ap.lijit.com tcp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
NL 185.184.8.90:443 prebid-eu.creativecdn.com tcp
US 8.8.8.8:53 cdn-ima.33across.com.cdn.cloudflare.net udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 34.102.146.192:443 oa.openxcdn.net udp
US 8.8.8.8:53 oajs.openx.net udp
US 8.8.8.8:53 cdn-ima.33across.com.cdn.cloudflare.net udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 pagead-googlehosted.l.google.com udp
US 8.8.8.8:53 e9957.b.akamaiedge.net udp
GB 216.58.204.65:443 pagead-googlehosted.l.google.com udp
US 8.8.8.8:53 pagead-googlehosted.l.google.com udp
US 8.8.8.8:53 oajs.openx.net udp
US 8.8.8.8:53 e9957.b.akamaiedge.net udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 145.22.18.104.in-addr.arpa udp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 65.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 oajs.openx.net udp
US 8.8.8.8:53 px.pocpoc.io udp
US 8.8.8.8:53 adsystem.pocpoc.io udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 104.26.15.167:443 adsystem.pocpoc.io tcp
US 8.8.8.8:53 px.pocpoc.io udp
US 8.8.8.8:53 adsystem.pocpoc.io udp
US 104.26.15.167:443 adsystem.pocpoc.io tcp
US 8.8.8.8:53 px.pocpoc.io udp
US 8.8.8.8:53 adsystem.pocpoc.io udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 s0.2mdn.net udp
US 8.8.8.8:53 s0.2mdn.net udp
US 104.26.15.167:443 adsystem.pocpoc.io tcp
US 8.8.8.8:53 s0.2mdn.net udp
US 104.26.15.167:443 adsystem.pocpoc.io tcp
US 104.26.15.167:443 adsystem.pocpoc.io udp
US 104.26.15.167:443 adsystem.pocpoc.io udp
US 8.8.8.8:53 static.vliplatform.com udp
DE 141.101.120.10:443 static.vliplatform.com tcp
US 8.8.8.8:53 static.vliplatform.com udp
US 8.8.8.8:53 csi.gstatic.com udp
US 8.8.8.8:53 static.vliplatform.com udp
DE 141.101.120.10:443 static.vliplatform.com udp
AR 142.251.133.227:443 csi.gstatic.com tcp
AR 142.251.133.227:443 csi.gstatic.com tcp
US 8.8.8.8:53 csi.gstatic.com udp
US 8.8.8.8:53 quantumsyndication.com udp
US 8.8.8.8:53 odb.outbrain.com udp
US 8.8.8.8:53 csi.gstatic.com udp
US 8.8.8.8:53 outbrain.map.fastly.net udp
GB 146.75.74.132:443 odb.outbrain.com tcp
US 172.67.71.198:443 quantumsyndication.com tcp
US 172.67.71.198:443 quantumsyndication.com tcp
US 8.8.8.8:53 quantumsyndication.com udp
US 8.8.8.8:53 outbrain.map.fastly.net udp
US 8.8.8.8:53 quantumsyndication.com udp
US 8.8.8.8:53 167.15.26.104.in-addr.arpa udp
US 8.8.8.8:53 132.74.75.146.in-addr.arpa udp
GB 18.245.143.118:443 tags.crwdcntrl.net tcp
NL 178.250.1.3:443 static.nl3.vip.prod.criteo.net tcp
US 104.18.35.167:443 cdn-ima.33across.com.cdn.cloudflare.net tcp
US 104.22.52.86:443 cdn.id5-sync.com tcp
US 34.120.107.143:443 oajs.openx.net tcp
GB 216.58.212.193:443 tpc.googlesyndication.com tcp
GB 142.250.179.230:443 s0.2mdn.net tcp
AR 142.251.133.227:443 csi.gstatic.com tcp
AR 142.251.133.227:443 csi.gstatic.com tcp
GB 142.250.179.230:443 s0.2mdn.net udp
US 172.67.71.198:443 quantumsyndication.com udp
AR 142.251.133.227:443 csi.gstatic.com tcp
AR 142.251.133.227:443 csi.gstatic.com tcp
US 8.8.8.8:53 rtb-useast.rtbserve.io udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
GB 216.58.212.193:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 www.google.com udp
NL 178.250.1.3:443 static.nl3.vip.prod.criteo.net tcp
US 104.22.52.86:443 cdn.id5-sync.com tcp
US 198.134.116.50:443 rtb-useast.rtbserve.io tcp
US 198.134.116.50:443 rtb-useast.rtbserve.io tcp
US 8.8.8.8:53 xapads.rtb-useast.ak-is2.net udp
IE 54.194.120.205:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 34.120.107.143:443 oajs.openx.net udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 8.8.8.8:53 images.outbrainimg.com udp
US 8.8.8.8:53 widgets.outbrain.com udp
US 8.8.8.8:53 log.outbrainimg.com udp
US 8.8.8.8:53 mcdp-chidc2.outbrain.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 xapads.rtb-useast.ak-is2.net udp
US 34.98.64.218:443 google-bidout-d.openx.net tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
GB 23.44.233.179:443 images.outbrainimg.com tcp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 8.8.8.8:53 e10883.g.akamaiedge.net udp
US 50.31.142.159:443 log.outbrainimg.com tcp
US 8.8.8.8:53 e15144.d.akamaiedge.net udp
GB 96.16.109.182:443 e10883.g.akamaiedge.net tcp
GB 96.16.109.182:443 e10883.g.akamaiedge.net tcp
AR 142.251.133.227:443 csi.gstatic.com tcp
AR 142.251.133.227:443 csi.gstatic.com tcp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 e15144.d.akamaiedge.net udp
US 8.8.8.8:53 e10883.g.akamaiedge.net udp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 34.98.64.218:443 google-bidout-d.openx.net udp
US 64.74.236.159:443 mcdp-chidc2.outbrain.com tcp
IE 52.50.52.56:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 chidc2.outbrain.org udp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 chidc2.outbrain.org udp
DE 162.19.138.119:443 id5-sync.com tcp
US 8.8.8.8:53 id5-sync.com udp
AR 142.251.133.227:443 csi.gstatic.com udp
US 8.8.8.8:53 198.71.67.172.in-addr.arpa udp
US 8.8.8.8:53 227.133.251.142.in-addr.arpa udp
US 8.8.8.8:53 193.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 118.143.245.18.in-addr.arpa udp
US 8.8.8.8:53 230.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 167.35.18.104.in-addr.arpa udp
US 8.8.8.8:53 143.107.120.34.in-addr.arpa udp
US 8.8.8.8:53 3.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 86.52.22.104.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 50.116.134.198.in-addr.arpa udp
US 8.8.8.8:53 218.64.98.34.in-addr.arpa udp
US 8.8.8.8:53 179.233.44.23.in-addr.arpa udp
US 8.8.8.8:53 182.109.16.96.in-addr.arpa udp
US 8.8.8.8:53 56.52.50.52.in-addr.arpa udp
US 8.8.8.8:53 159.142.31.50.in-addr.arpa udp
US 8.8.8.8:53 159.236.74.64.in-addr.arpa udp
DE 162.19.138.119:443 id5-sync.com tcp
US 8.8.8.8:53 id.a-mx.com udp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 acdn.adnxs.com udp
US 8.8.8.8:53 sync.quantumdex.io udp
NL 79.127.227.46:443 id.a-mx.com tcp
US 104.22.36.96:443 sync.quantumdex.io tcp
US 8.8.8.8:53 id.a-mx.com udp
US 151.101.1.108:443 acdn.adnxs.com tcp
US 8.8.8.8:53 sync.quantumdex.io udp
US 8.8.8.8:53 prod.appnexus.map.fastly.net udp
US 8.8.8.8:53 pubads.g.doubleclick.net udp
US 8.8.8.8:53 sync.quantumdex.io udp
US 8.8.8.8:53 prod.appnexus.map.fastly.net udp
US 8.8.8.8:53 id.a-mx.com udp
GB 142.250.200.2:443 pubads.g.doubleclick.net tcp
GB 142.250.200.2:443 pubads.g.doubleclick.net tcp
US 104.22.36.96:443 sync.quantumdex.io udp
US 8.8.8.8:53 gum.fr3.vip.prod.criteo.com udp
US 8.8.8.8:53 pubads46.g.doubleclick.net udp
US 8.8.8.8:53 119.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 108.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 46.227.127.79.in-addr.arpa udp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 ads.betweendigital.com udp
US 8.8.8.8:53 match.sharethrough.com udp
US 8.8.8.8:53 s.ad.smaato.net udp
US 8.8.8.8:53 96.36.22.104.in-addr.arpa udp
US 8.8.8.8:53 ssp.disqus.com udp
FR 178.250.7.13:443 gum.fr3.vip.prod.criteo.com tcp
US 8.8.8.8:53 ssum-sec.casalemedia.com udp
US 8.8.8.8:53 sync.adkernel.com udp
US 8.8.8.8:53 gum.fr3.vip.prod.criteo.com udp
US 8.8.8.8:53 pubads46.g.doubleclick.net udp
US 8.8.8.8:53 ads.pubmatic.com udp
US 8.8.8.8:53 eb2.3lift.com udp
GB 18.165.201.92:443 s.ad.smaato.net tcp
US 104.18.36.155:443 ssum-sec.casalemedia.com tcp
US 8.8.8.8:53 onetag-sys.com udp
US 44.219.176.157:443 ssp.disqus.com tcp
FR 178.250.7.13:443 gum.fr3.vip.prod.criteo.com tcp
US 8.8.8.8:53 match-eu-central-1-ecs.sharethrough.com udp
US 8.8.8.8:53 sync.1rx.io udp
US 8.8.8.8:53 ssp.ads.betweendigital.com udp
NL 77.245.57.72:443 sync.adkernel.com tcp
NL 77.245.57.72:443 sync.adkernel.com tcp
NL 77.245.57.72:443 sync.adkernel.com tcp
NL 77.245.57.72:443 sync.adkernel.com tcp
US 8.8.8.8:53 cs-server-s2s.yellowblue.io udp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
US 8.8.8.8:53 s.ad.smaato.net udp
DE 51.38.120.206:443 onetag-sys.com tcp
DE 51.38.120.206:443 onetag-sys.com tcp
US 8.8.8.8:53 match-eu-central-1-ecs.sharethrough.com udp
US 76.223.111.18:443 eb2.3lift.com tcp
GB 96.16.109.9:443 ads.pubmatic.com tcp
US 8.8.8.8:53 ssp.ads.betweendigital.com udp
NL 46.228.174.117:443 sync.1rx.io tcp
DE 141.95.98.65:443 lb.eu-1-id5-sync.com tcp
US 44.195.196.122:443 cs-server-s2s.yellowblue.io tcp
US 8.8.8.8:53 s.ad.smaato.net udp
US 8.8.8.8:53 ssum-sec.casalemedia.com udp
US 8.8.8.8:53 zeta-ssp-385516103.us-east-1.elb.amazonaws.com udp
US 8.8.8.8:53 ssum-sec.casalemedia.com udp
US 8.8.8.8:53 zeta-ssp-385516103.us-east-1.elb.amazonaws.com udp
US 8.8.8.8:53 1.cpm.ak-is2.net udp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
IE 34.249.64.47:443 ap.lijit.com tcp
NL 188.42.196.115:443 ssp.ads.betweendigital.com tcp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
DE 52.28.202.33:443 match-eu-central-1-ecs.sharethrough.com tcp
GB 142.250.200.2:443 pubads46.g.doubleclick.net udp
DE 51.38.120.206:443 onetag-sys.com udp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 eu-eb2.3lift.com udp
US 8.8.8.8:53 1.cpm.ak-is2.net udp
US 8.8.8.8:53 rtb2-useast.xaprio.net udp
US 8.8.8.8:53 rtb.mfadsrvr.com udp
US 8.8.8.8:53 sync.mathtag.com udp
US 8.8.8.8:53 pixel-eu.rubiconproject.com udp
US 8.8.8.8:53 ads.stickyadstv.com udp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
NL 185.89.210.20:443 ib.anycast.adnxs.com tcp
US 8.8.8.8:53 pixel.rubiconproject.com udp
US 8.8.8.8:53 eu-eb2.3lift.com udp
US 174.137.133.49:443 rtb2-useast.xaprio.net tcp
US 8.8.8.8:53 cs.admanmedia.com udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 t.adx.opera.com udp
US 8.8.8.8:53 ssbsync-global.smartadserver.com udp
US 8.8.8.8:53 image8.pubmatic.com udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
US 80.77.87.162:443 cs.admanmedia.com tcp
US 8.8.8.8:53 x.bidswitch.net udp
US 104.18.36.155:443 ssum-sec.casalemedia.com udp
US 8.8.8.8:53 sync.1rx.io udp
US 8.8.8.8:53 sync.1rx.io udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 80.77.87.162:443 cs.admanmedia.com tcp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
US 8.8.8.8:53 cs-server-s2s.yellowblue.io udp
DE 3.122.57.41:443 rtb.mfadsrvr.com tcp
US 216.200.232.249:443 sync.mathtag.com tcp
NL 213.19.162.80:443 pixel.rubiconproject.com tcp
NL 213.19.162.80:443 pixel.rubiconproject.com tcp
NL 82.145.213.8:443 t.adx.opera.com tcp
FR 5.135.209.101:443 ssbsync-global.smartadserver.com tcp
GB 185.64.190.79:443 image8.pubmatic.com tcp
GB 172.217.169.66:443 cm.g.doubleclick.net tcp
NL 35.214.149.91:443 x.bidswitch.net tcp
US 8.8.8.8:53 cs-server-s2s.yellowblue.io udp
GB 172.217.169.66:443 cm.g.doubleclick.net tcp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 8.8.8.8:53 13.7.250.178.in-addr.arpa udp
US 8.8.8.8:53 92.201.165.18.in-addr.arpa udp
US 8.8.8.8:53 155.36.18.104.in-addr.arpa udp
US 8.8.8.8:53 72.57.245.77.in-addr.arpa udp
US 8.8.8.8:53 206.120.38.51.in-addr.arpa udp
US 8.8.8.8:53 18.111.223.76.in-addr.arpa udp
US 8.8.8.8:53 117.174.228.46.in-addr.arpa udp
US 8.8.8.8:53 157.176.219.44.in-addr.arpa udp
US 8.8.8.8:53 65.98.95.141.in-addr.arpa udp
US 8.8.8.8:53 9.109.16.96.in-addr.arpa udp
US 8.8.8.8:53 122.196.195.44.in-addr.arpa udp
US 8.8.8.8:53 47.64.249.34.in-addr.arpa udp
US 8.8.8.8:53 115.196.42.188.in-addr.arpa udp
US 8.8.8.8:53 33.202.28.52.in-addr.arpa udp
US 8.8.8.8:53 20.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 49.133.137.174.in-addr.arpa udp
US 8.8.8.8:53 pixel-eu.rubiconproject.net.akadns.net udp
US 8.8.8.8:53 xaprio.rtb-as-useast.ak-is2.net udp
US 52.46.151.131:443 s.amazon-adsystem.com tcp
US 8.8.8.8:53 xaprio.rtb-as-useast.ak-is2.net udp
US 8.8.8.8:53 pixel-eu.rubiconproject.net.akadns.net udp
US 8.8.8.8:53 pixel-origin.mathtag.com udp
US 8.8.8.8:53 pixel-origin.mathtag.com udp
US 8.8.8.8:53 pixel.rubiconproject.net.akadns.net udp
US 8.8.8.8:53 cs.admanmedia.com udp
US 8.8.8.8:53 pixel.rubiconproject.net.akadns.net udp
GB 172.217.169.66:443 cm.g.doubleclick.net udp
US 8.8.8.8:53 cs.admanmedia.com udp
US 8.8.8.8:53 outspot2-ams.adx.opera.com udp
US 8.8.8.8:53 outspot2-ams.adx.opera.com udp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
US 8.8.8.8:53 ssbsync-euw2.smartadserver.com udp
NL 154.57.158.26:443 ads.stickyadstv.com tcp
US 8.8.8.8:53 imagesync-lhrc.pubmnet.com udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
US 8.8.8.8:53 imagesync-lhrc.pubmnet.com udp
US 8.8.8.8:53 ssbsync-euw2.smartadserver.com udp
US 8.8.8.8:53 elb-aws-fr-dorpat-283474803.eu-central-1.elb.amazonaws.com udp
US 8.8.8.8:53 user-data-eu.bidswitch.net udp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 8.8.8.8:53 79.190.64.185.in-addr.arpa udp
US 8.8.8.8:53 80.162.19.213.in-addr.arpa udp
US 8.8.8.8:53 66.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 41.57.122.3.in-addr.arpa udp
US 8.8.8.8:53 101.209.135.5.in-addr.arpa udp
US 8.8.8.8:53 8.213.145.82.in-addr.arpa udp
US 8.8.8.8:53 91.149.214.35.in-addr.arpa udp
US 8.8.8.8:53 249.232.200.216.in-addr.arpa udp
US 8.8.8.8:53 131.151.46.52.in-addr.arpa udp
US 8.8.8.8:53 26.158.57.154.in-addr.arpa udp
US 8.8.8.8:53 elb-aws-fr-dorpat-283474803.eu-central-1.elb.amazonaws.com udp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 8.8.8.8:53 user-data-eu.bidswitch.net udp
US 8.8.8.8:53 eu-west-dual.ads.stickyadstv.com.akadns.net udp
NL 154.57.158.26:443 eu-west-dual.ads.stickyadstv.com.akadns.net tcp
US 8.8.8.8:53 eu-west-dual.ads.stickyadstv.com.akadns.net udp
US 8.8.8.8:53 cs.yellowblue.io udp
IE 34.251.126.122:443 cs.yellowblue.io tcp
US 8.8.8.8:53 cs.yellowblue.io udp
US 8.8.8.8:53 cs.yellowblue.io udp
US 8.8.8.8:53 122.126.251.34.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 162.159.133.233:443 cdn.discordapp.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\WXU4E3F.tmp\appraiserxp.dll

MD5 cbb270591c9a1bfb1b10559ab672f705
SHA1 fed0d59d60709b5b05b9d31030ea7a5422767a7e
SHA256 770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f
SHA512 67c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a

C:\Users\Admin\AppData\Local\Temp\WXU4E3F.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css

MD5 5ad8ceea06e280b9b42e1b8df4b8b407
SHA1 693ea7ac3f9fed186e0165e7667d2c41376c5d61
SHA256 03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb
SHA512 1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

MD5 ab38a78503d8ad3ce7d69f937d71a99c
SHA1 00b6a6f09dd45e356ef9e2cacd554c728313fa99
SHA256 f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
SHA512 fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

C:\Program Files (x86)\WindowsInstallationAssistant\Downloader.dll

MD5 5b62ad6ae42f32806062ad1bcb3e2de5
SHA1 8d4a543eac9643931fcb620cd588e2cc1067920a
SHA256 96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3
SHA512 af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf

C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

MD5 ca22263c7a6f965df18f5c601f5db7ce
SHA1 e4b1a401ed497523a583ae8613646b03778a33a6
SHA256 299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c
SHA512 3cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm

MD5 b2a06af2867a2bb3d4b198a22f7936b3
SHA1 98a28e15abdd2d6989d667cc578bf6ab954c29f5
SHA256 40f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23
SHA512 eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css

MD5 7f5fcac447cc2150ac90020f8dc8c98b
SHA1 5710398d65fba59bd91d603fc340bf2a101df40a
SHA256 453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850
SHA512 b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif

MD5 1a276cb116bdece96adf8e32c4af4fee
SHA1 6bc30738fcd0c04370436f4d3340d460d25b788f
SHA256 9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618
SHA512 5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png

MD5 afeed45df4d74d93c260a86e71e09102
SHA1 2cc520e3d23f6b371c288645649a482a5db7ccd9
SHA256 f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f
SHA512 778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css

MD5 b81d1e97c529ac3d7f5a699afce27080
SHA1 0a981264db289afd71695b4d6849672187e8120f
SHA256 35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225
SHA512 e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png

MD5 0968430a52f9f877d83ef2b46b107631
SHA1 c1436477b4ee1ee0b0c81c9036eb228e4038b376
SHA256 b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96
SHA512 7a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\f441f24f-e7cd-43f6-bd8d-6557d165e5e1

MD5 61e4667ffdb647859ce0162753de343b
SHA1 4fa824303caae0495c3a6dcb29ded52a32c61d02
SHA256 6d047d88d274aa418f861252d256a4a6136e7940716488c78d6fb4b45f8c767c
SHA512 3be2837778d676c5ea67272b7e510d291e3818c9670dc7996c9f3a8696509a696da0a052df86132821d5dc57dfbd242a20e21f8e6019d97d1a5f8b622b694d8d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\8a6d8cf4-8492-4ed5-ab41-bf652998a09e

MD5 b9b908d6f19c6154cad36771953e773c
SHA1 cfb19f5804059e8698cf79f68adb74e3d9c881db
SHA256 4ae805a0d387ba420e8b5b6452b71aea9b3dee37d1ba0952bd0a81cb9bc9dd95
SHA512 a337185662cc578cebd2cc9ae61bc269a812ad3f6a266b5b1bb5f403bee3cdbcc493abcd609191c1c4f938d445ff4e84d21a74a70d98f8d6dfb19601a449a65f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\db\data.safe.bin

MD5 c68043fc3df5b8f8630635bae4fdc5e4
SHA1 6ccb5a5eca190b35cb871ed34a62a21b807f07bc
SHA256 2999c0c67f2904e7016962c74fa86e18481247efdf50a307f63bd35d2f25c7d5
SHA512 f4e89c6eb38044f1d540e60210197e8634285b501b875ea52aa832471550e9df8702e4327b04a93b7cd86c579eb4d7e05ba0e974546e6d21e5ffb7cd071f5a09

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

MD5 8da51a5f1084d796a2b14b5e737823db
SHA1 9f53af609b9bb70d1ac6d2cd73648dc84b6adc13
SHA256 2c5966f2db5a8bb99126f7b9bc8591d649168024434b2cbd03944b9b1eff31bd
SHA512 b903b8a5168c405cfcaaaf6e909878f3b877806941ceb7f65075d485fcdd98b94211c06727b4dcd3b13899b9ea15a14d9f3ef92323fa44fec229a722ad6f44af

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

MD5 381fbbe6093579702acff869f7b0e94a
SHA1 fd663103fcea584236ebbf828df1cdc17645d0dc
SHA256 979e882e58acec7629382692aba0a6ee9c55bdc9cba68ea56036afe88a884dee
SHA512 d26f7b3ed5ca270371627ede886f516c23cd029cd21d59bb5b1ab32fa7aa969e5f992565c2ce1425b82621d26f6f4fbbd0f176506a39dad66a8afd5f96bd0e41

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 9d365d9d7e0cb7fd4290b7d2d1142ba0
SHA1 569f36f3ae8bcd529a3da71fe2c327e94fd22187
SHA256 81aa674db1ec349ea3550cba159de944cf62bb54de618d23b532f8cfb5665f61
SHA512 27a9a577c5035e008c426b512e25e860a953de9d07d93a7249c94d609ab4a9927ea4afb3dcd6f06888a29c196187f9d5e564a4c6e71d58e0772054a67f3cd165

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

MD5 6bcaea6844fa12ca3a6953a7b917b1e5
SHA1 490324d6bdec38c9bfddf75652b8b35e06693530
SHA256 de60a4a5588ba9a4aa97c5be91ed30ce8ba319c2056b9813e249e1c3b225c658
SHA512 f7ae973a2c467afcf3eaa84c54a3846efa6dc88cebd60023d7bb7363828113d0d2a1651e798e184835816ab31d5069419f7b211e0e5f7323471f6d01605b3bf2

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\A72798DEF4F924983D5A0DB82D383C613B515FF2

MD5 25a1a4d015fa5e8f68ad5b6402ed2e45
SHA1 aefb5286a696410e2bcab01d8887a318ad3274d3
SHA256 197e124dd2b73affbe2a182f17fdf6ee208f27968ee0c92183bbd6561fdc73b3
SHA512 cc652319020bd1f96919e503b8ec3bcd633c369445ec66855cf2e84e3b07b90ba88f37939f95f0bff6291559cd7528dca3a9414b4c7abee05b5595531fc4ab4f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

MD5 bb76f6e723e78f59636420aff839125b
SHA1 1f72c57d4b5efdf638777e80d97fb8811a638dd1
SHA256 162e4910e9ecb7f0ca279fff56e7e0f9a434680d413f2c749e1f407cf9c04142
SHA512 7c12cc82a5b3db922a1f902f3d10f19e75dd6db35e3dd40141ee1857a7c420b1f25c445e193f253ea05c2c7f0fef3df03ffc1c2bea1ba4bc1a60f81a8fc9dbfd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 2157ce3a68098a860b6335c93ccfd5ff
SHA1 f9a2df5a28a5526b5d990954075740f9b3cf24b5
SHA256 9e5e74b13ff203484a6463ae2d2300a8b6a20c0c8faa269f88a85ca08c587765
SHA512 5a03c67cffef71100dd92edff698e1e2c0b6d1e121213470d810daef0ba2dea496711b9cbba85cd57bfb62827c7910226fdb994ced5b37b0a4ff69fbc1d3d550

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

MD5 7331a66f651346d99a43720d380f8722
SHA1 92589811ba5250dae6324d710ab989070e617133
SHA256 0d88c667a6c938d253fea01421be4ccc8954a4db8cdf4abbb1c154818d6d516c
SHA512 348884bc36e31eaca99a23d1fcade745c0a522da5e3f98fb2e711ee158101e45040ec850fe861a0f387b5f3d66c0d71c3647112c98ccff8554c5b0d88c277341

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 ffea31aa8eda46ee8ce6ae931f4028d5
SHA1 7be7a42992dc49be28a28da42f4e601ce6d63f55
SHA256 fcd15e2cc50ed048e7cd04a82005a6e85bef2b128dde83b001b6c62b54daeb03
SHA512 f19aa167e4528e4389a2420071ae6bec89e2e05f7a012a43d4107a8f3f7e33d4a911e092ee207db3a4fbd436db78caed073bfd6a5cb62e62cd4d72351322bfcc

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\thumbnails\b1b557eda59743b28a0e020c845fb289.png

MD5 9baf85bbf2544c70cf20796d9acb292b
SHA1 357777a36738c0cad508246da490aac65a88960a
SHA256 8b8cacb7435b012d62aa6aae25e8c1de9e20c798e8ea98046d971aada86d0dd1
SHA512 3bcb1d38116135d8e2ece03ecb982c10561b0150fa14492fc368cea77066d07244771800a80fc131b93ffc127812a63d0e6b989570349869a41a1fc1196e6103

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\21A7D5731DFA23DF1F2B625219D1B9B7A118D4C4

MD5 f6dbb2ef84c0e0acee5f4952a62667ef
SHA1 72c55392307a31d696d835bf31ebe5c35085cc2a
SHA256 c58d74b3529c6de0a4e433e548d08207014ca6cd6badba872560e35ac11e64cb
SHA512 53c956fed4f83d331f7b3bb13e7cdb1a8212969f4542f85fdd6d9502d08e74ceb3f1ea732e9ed5c7e652da1ba3f4dd3487724f273baedf7986589f60de506965

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 0e3bb405d9304adc7d66eda423dc5f00
SHA1 617bf613c846615766027665f949a27134d5dd9c
SHA256 a5c9342ee57721a585e33f2b7fbaff79efef4760616881de7e0d86b135ce4dd9
SHA512 604a8f40c785b6ec54fbef485b53f2b1ff48f19adaf2728900af64f8a31ad46dc7d2e0309212c639eedcc51b94c2fdd566ee67ba5d1fbb1a8c77af3a4665ab8d

C:\Users\Admin\Downloads\Windows10Upgrade9252.ZA1OLnjZ.exe.part

MD5 a44f1339c2cdfeb175f69f7553e427d9
SHA1 5c60d53ae39fed505f210730e222eca52ca60c2d
SHA256 665cdb2fe09854ff3e3ca54689842884f22bb3b798e944933f9f0a0f123a1b37
SHA512 d10632c4d4e86a73f9d8898f7376685539aa651535c0856d195c5970e9df0549c4a59addcb9bd03e103fa7ebc875e3309d92da59c811c1942b9f5d72cfda57d7

C:\Users\Admin\Downloads\Windows10Upgrade9252.exe

MD5 c0b25def4312fbddbcc4f01c6c0f5ba6
SHA1 8d16a183d61233e7d6b6af7b3cafc6645ac2acb1
SHA256 c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
SHA512 8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e

C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\GetCurrentOOBE.dll

MD5 c062b03a177cf1d25b91d0a911784533
SHA1 dd96534252e07bb6db047bf990a3caed70e05cc3
SHA256 396df40adac039f8a6847b7c8efff7dfead7a77b93e12b0b141a4cfa808c0035
SHA512 27850b93c3f33e1c6672cea4e0a1d572375f0dd8c9f2d3521f1060123eacdc9da456447afcc23ca751222941e09d611fdd80d236b7620b15b12c16f133d6e41c

C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\resources\ux\block.png

MD5 a132f4d4f23f1bc40cfdb88223b1c74a
SHA1 11fc3eea08765c7dfa697cd9cacd18f7a9900181
SHA256 35825ad138cec97d3cff27cd8d139377e6ba4d0a55b473b59fb4f5f4b9508be6
SHA512 c5284f403c6617947545b0282d935d7e3b2ccb30c67d85920907b7cbd00c01e4c560824c3e7d77a51e97a646aff806879f76e418973a66e2fe1086b8288326b3

C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\resources\ux\Microsoft.WinJS\css\ui-dark.css

MD5 c9674190d140117be506a070c4ef5be2
SHA1 51db8cf46f6ecac6cab85a52402fd66c035e837f
SHA256 1e8e74e5a29f269157c043718b43c10c6f8beb806a6d2b3f3f2dd542731fd196
SHA512 9d41b784a377dc9a1bb61e337ade6acf7f841a672609626697925ace30f8fc574e58ee54388a76b446a84d4ba6de46d72e0b7cad64ada5bf5664c28df09ca585

C:\Users\Admin\AppData\Local\Temp\WXU3402.tmp\resources\ux\Microsoft.WinJS\js\base.js

MD5 221c534deb612992681b0a2fb55bc5ed
SHA1 1ac3eb5a4ea6a0d876f8077e87357fccba472323
SHA256 7b67ab12bd5dcc229ea7f197fcb7723b1c41a517e198fad31020d8fea42e9715
SHA512 c9bd493fad305eb4c881eb6c9aa1daf672ec3531ca4871c44f3383b48389db24232b6dfe35ab6e82a5c8bc1a38f68b57fd30e2fab35bd6237d751285fd74444e

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll

MD5 87bc3d50a51cae672f2e3ed50691e5b5
SHA1 8da385a349012cb8e2e56b320d04fe4a1e56e14d
SHA256 896994df8e63229dc8c860f40cfd92c6fcea6e684ec0d51f111c812eee7349ba
SHA512 504d89b40935dc266af46438fb391f9e3d9a925fdce6c5daebc34e5c7fc33ced01ebd32f8da083c41f01a2766dafb9102b02b2800b1cb1ab3057413a6d9ca8ec

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png

MD5 5a7499645619886bfe949250e1807415
SHA1 152295cf08fcf1e21e26f05969cbb02bd22a8af6
SHA256 db27bad6e59128d58031706c83210ae780a9261e01af6fde6323bd30f7a97b12
SHA512 201fc4fa1aa035cf09872d6f335d94c97433b79af343d532d0dd5c6ab6ba60b5a3a3b60f466e2c7107c19e04ffcdfa8a016842b4f29ea3ee6dd3d60304d8d8dc

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js

MD5 b02d15ec9159d708837121c9685fa551
SHA1 577edd3d56f6a92d5248b35cd76a442b2c1caf37
SHA256 d23519634fa23488b7151ff1c31cc81e9531033f669d10c119f375198d02e22b
SHA512 60305cd9baa19a7e526f4ee9eac425f17563ab4dda0c861cc163b64495e72b547258ff7e804dd7c9820bd3543b2158109b1f72775096a2ba36ce02ad908f8a0a

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css

MD5 415d4bb726c52bd91be8f3afd81e50cc
SHA1 9732e1e6aeb13a6f180b21bb5bd8a4acf7d96dbd
SHA256 c6dd0940a263382fb735f1cdc8550234f9c081625bfe2e5363cb8bb65cc06440
SHA512 c7a8b805027906d8b67d50773a7e362f2e87d3af61b23fab33aec929e21f42610a35f857ede9a17772c5f2b42c1382f8daf7240b76f3996aa65988a87c367847

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm

MD5 66b63e270cc9186f7186b316606f541f
SHA1 35468eeefc8d878f843bbf0bb0b4b1d43b843cdf
SHA256 00f8f3e4534146858326d6d2524f3360dfc9e5d149e207d61cabac17ad7a5f9f
SHA512 b9d1b4b201cabf087a44d958584ecb1c110807b9bd9865f1e76bf9d989d7d000ee84f07558bcae5e05d11f7121fe2c402fcf916b00ff5d8eac7eaf05e21a29f2

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png

MD5 062f3f1fff1deb4e8abe7a16c8aa6398
SHA1 c943234ce3e553a05be711da23cbafbe459c5988
SHA256 f67ac334038896e37ca126ac4dbd1fff51cd0ffe8c99ed1cb709d64864b72392
SHA512 c6bf7e63476f4ba36aa09a133bff02c6d68503361d9487d598b28a0bda631a496810bb9b0ba8c89efbfe16bb53693a6a81c93da1d00fc923b655a070d5dbdd2d

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE

MD5 d705a34a869ac46e3f07c9be3ea1693a
SHA1 b21847a23ed6d0b7c04c0519ef0e11b5e422c3b1
SHA256 0436deda2dbbd46d74e4a83b5897ba26a3ec35a9ab77d4b46e7477d9cdd213b8
SHA512 cfe243ab1385ee1086c50f434a934654b5bbc6fb4e9b562bf1738c2f7b50a49f22e748d2b71d9f69bad505272de70e4be09d8cf13475121defec1e6aeb923479

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll

MD5 410fac98056ab0be74e4539a4c0eaaff
SHA1 10a66618bd67f26b3b6e418df4aeb93f0e599c2b
SHA256 09ec6dc5cb94160b2c4d9f1f4224a7dc1951f227dd311acb1bc4335f23db9b24
SHA512 84999daecb8fce1c4c76ac2527278ca7896c5e90ec37754bb0f10f3cb391adc338cde923c51a3ffa90d49ebbf0516f7632889970efb20ee6ea797185edf74222

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll

MD5 c61dcf4db82482a4498fcca646a6c640
SHA1 981bf318813c54e94efe04cc20dc6ac070adcfe9
SHA256 c98289454cdcb2266e82204af73a799b09458a899cdd8366e24fbb613273c0ff
SHA512 6b26c8e4c1c15f224a5d196524f35583f1e2f878fa2532a199be068d89c06bdbafd2ca3e740b1ed104844d760e62b25d8a6d589c511ed6fe2713b925949ab2af

\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

MD5 51ddd33b146cc550591608dfd8bd5852
SHA1 5f3c2e218369bbe6ea3302348cb6f79df1b1b744
SHA256 1dbee252f9d0765ad4203577e0c7d67678f4406f94f60fa2b6b5a2a642ecc649
SHA512 4d25994b063dc6662d90f7c75199f66c695968f258afb80007a7d4700019211f6045e3834b7c34de93659b965bb4ce6b229c1db57b9dd5d4ec7c9555e653af51

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d23e63956a6602f61fdf3dcb726cd218
SHA1 82df39b52f80cfd2a42da3339a26c9b4a2ae6107
SHA256 a6c59cbd144e6a592d4bdaaf2d28eb5348156e20c8b3bd53c1c05b26bc192280
SHA512 f17a43f7972e596957244998ecc52fef5e174278eea23c873dff346dcea0bf4cd533d07b2ff844e56e3c3529e47d9c7fbcd5b6e754e2a61be24ba07eb7b79c49

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\strings[1]

MD5 1e1f71d6643ad3cfc44879d4309551f4
SHA1 2da6d2cf306b4fd61de219f7dcafe5b6d58e05d5
SHA256 7a8d46866bf0ec208669cf22241af8fcacd027f09e59aa1d844314abbb5be2d0
SHA512 d2de717d0e3f75d2abc4783e79aacd4ed50cc1a3bbaccdb3d86dfd5104ee06075762ba9f8044e81a469d55fdf2e5be8d385d26738be6905771c2aa31bf6e8319

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\dnserrordiagoff[1]

MD5 7e81a79f38695e467a49ee41dd24146d
SHA1 035e110c36bf3072525b05394f73d1ba54d0d316
SHA256 a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536
SHA512 53c5f2f2b9ad8b555f9ae6644941cf2016108e803ea6ab2c7418e31e66874dea5a2bc04be0fa9766e7206617879520e730e9e3e0de136bae886c2e786082d622

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\NewErrorPageTemplate[1]

MD5 dfeabde84792228093a5a270352395b6
SHA1 e41258c9576721025926326f76063c2305586f76
SHA256 77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
SHA512 e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\errorPageStrings[1]

MD5 d65ec06f21c379c87040b83cc1abac6b
SHA1 208d0a0bb775661758394be7e4afb18357e46c8b
SHA256 a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
SHA512 8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\httpErrorPagesScripts[1]

MD5 9234071287e637f85d721463c488704c
SHA1 cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA256 65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
SHA512 87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 adfb35ef0b5d8b48fc2c61e4b08b011d
SHA1 54c9560408dccd38d3f0eb06bf7ae8ae4a77fcb4
SHA256 b4390fcc79ae70b3ef92d1dbeaa2e796932fbd29905cf18768f69cb5df33e895
SHA512 d9bb264b62815f28a31fe94bb5622e46990a9f24f9442e65cbf3eebe6a012252f8f8a961182635cd58b4e28fedd4d99219472698c0c221207031772c582bd93f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\DE23CF9E01AA6278843163311B343B07086E02FC

MD5 5687316730aa837c8db841f2f7b93c8f
SHA1 36c094fe8bb314d90c8ecab56033c36e7a83cc58
SHA256 1fa1ab6387d46aedeccce99a66b2e4ad1b506c3168e80e6b30d932e8be32187d
SHA512 ac9f0e69b8f2bedde24d96ed6938644913340998b09e1d0303d138c14f74ad885abd7c062b6d0dfa68a17c40a2eb928e1c48b9019f61e7ec90c032f67b66be14

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 2dc978a70d50d3693c73926f22d9bff2
SHA1 dbf0b3d674d75b3a3a844a188b461711f05d0050
SHA256 94362d8976153bd1d8a75fc1ede9cd403ae327dfd9814b93d6b707214d96994a
SHA512 5bb94c54a342c728f6d12b0a7989a35bfa15de4cb630e03fca2a06486aa3d8a722bbd5363de82acdf90f0189ce8173e7840f24288b8ac30b42a51ee30040b041

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-26 16:14

Reported

2024-03-26 16:19

Platform

win11-20240221-en

Max time kernel

201s

Max time network

211s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4588 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
PID 4588 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
PID 4588 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
PID 844 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe

"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4356 -ip 4356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://java.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcfb6c3cb8,0x7ffcfb6c3cc8,0x7ffcfb6c3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1

Network

Country Destination Domain Proto
GB 92.123.128.154:443 tcp
US 20.189.173.9:443 browser.pipe.aria.microsoft.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.135:443 r.bing.com tcp
GB 92.123.128.139:443 www.java.com tcp
GB 92.123.128.139:443 www.java.com tcp
US 8.8.8.8:53 c.oracleinfinity.io udp
US 8.8.8.8:53 static.ocecdn.oraclecloud.com udp
GB 147.154.230.206:443 dc.oracleinfinity.io tcp
GB 173.222.14.94:443 www.oracle.com tcp
GB 92.123.128.157:443 c.oracleinfinity.io tcp
GB 104.103.246.175:443 static.ocecdn.oraclecloud.com tcp
GB 173.222.12.168:443 s.go-mpulse.net tcp
GB 173.222.14.94:443 www.oracle.com tcp
GB 173.222.14.94:443 www.oracle.com tcp
GB 92.123.128.157:443 c.oracleinfinity.io tcp
N/A 224.0.0.251:5353 udp
GB 52.84.90.84:443 consent.trustarc.com tcp
GB 52.84.90.84:443 consent.trustarc.com tcp
GB 18.165.227.33:443 consent-pref.trustarc.com tcp
GB 52.84.90.125:443 consent-st.trustarc.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\WXU5D72.tmp\appraiserxp.dll

MD5 cbb270591c9a1bfb1b10559ab672f705
SHA1 fed0d59d60709b5b05b9d31030ea7a5422767a7e
SHA256 770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f
SHA512 67c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a

C:\Users\Admin\AppData\Local\Temp\WXU5D72.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css

MD5 5ad8ceea06e280b9b42e1b8df4b8b407
SHA1 693ea7ac3f9fed186e0165e7667d2c41376c5d61
SHA256 03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb
SHA512 1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

MD5 ab38a78503d8ad3ce7d69f937d71a99c
SHA1 00b6a6f09dd45e356ef9e2cacd554c728313fa99
SHA256 f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
SHA512 fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

MD5 c6e416d0abe48eeaa038b3875ab93b06
SHA1 d2a49e6a50984f0cf36ffcce7c3c782e27cc7247
SHA256 6e5d556725b784999ee6b718bd7078f243790d3d6a085b766082b938d2ebd308
SHA512 d35ebd510c1a818b749e1d45f15002a208c0f3f4b70314518aff8efed1d21a8fd1267f905ec3cfbd345a64d25b1dfa7bfbb0d5fb62fe313c3ddf7661745c7030

C:\Program Files (x86)\WindowsInstallationAssistant\Downloader.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll

MD5 5b62ad6ae42f32806062ad1bcb3e2de5
SHA1 8d4a543eac9643931fcb620cd588e2cc1067920a
SHA256 96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3
SHA512 af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf

C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

MD5 ca22263c7a6f965df18f5c601f5db7ce
SHA1 e4b1a401ed497523a583ae8613646b03778a33a6
SHA256 299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c
SHA512 3cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm

MD5 b2a06af2867a2bb3d4b198a22f7936b3
SHA1 98a28e15abdd2d6989d667cc578bf6ab954c29f5
SHA256 40f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23
SHA512 eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif

MD5 1a276cb116bdece96adf8e32c4af4fee
SHA1 6bc30738fcd0c04370436f4d3340d460d25b788f
SHA256 9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618
SHA512 5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css

MD5 7f5fcac447cc2150ac90020f8dc8c98b
SHA1 5710398d65fba59bd91d603fc340bf2a101df40a
SHA256 453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850
SHA512 b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png

MD5 afeed45df4d74d93c260a86e71e09102
SHA1 2cc520e3d23f6b371c288645649a482a5db7ccd9
SHA256 f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f
SHA512 778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css

MD5 b81d1e97c529ac3d7f5a699afce27080
SHA1 0a981264db289afd71695b4d6849672187e8120f
SHA256 35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225
SHA512 e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png

MD5 0968430a52f9f877d83ef2b46b107631
SHA1 c1436477b4ee1ee0b0c81c9036eb228e4038b376
SHA256 b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96
SHA512 7a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0e10a8550dceecf34b33a98b85d5fa0b
SHA1 357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
SHA256 5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
SHA512 fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3b1e59e67b947d63336fe9c8a1a5cebc
SHA1 5dc7146555c05d8eb1c9680b1b5c98537dd19b91
SHA256 7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
SHA512 2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dcd154c582751b43e2aaca75526da71f
SHA1 e0685b835b4782e7e7f3d574394fffd0a2bf4913
SHA256 9ff2e33808aacb7d27198112440cbe6f76c9f5ee3109f658d2f7de16268afe6a
SHA512 1413c0d29507eef791f23b1e6d3f4abce2b26ab111d6374aafb564bf3582fa2f05f0b30e7ba531704e60d13630541d028f1631c1412458027c2a35735732feb3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d695a6e6095ff379d110053f29379ff8
SHA1 0ce71b52b79b3383663f96bfdd696f9f77daa1f6
SHA256 e8d34949fc423470957a8fc477389ff146cac41082c4743cf0a3fb298c17c767
SHA512 b5e7f2785b69e6b14baa94089578ad9892df2d2f552528a177b9fb0706e22a1609789de658f5dbc67dac868c2466ad518400c356e3be7a0d42b56e6e18a24ae6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ea1ad392d29b4e17783c0f3ddb480c15
SHA1 32a9819136f25e5c4f1fc0e3d6fcf7b98f4657ac
SHA256 4f3e857005d780d2f395d87e31117c5d8eeb6abbd7ab7436b91effb5339fe6d3
SHA512 31f94f65bc5a4c7a6e1cea14c59fb39c90f91627b467b83952015aedf9e445621e01343ccf2fbdfb9639bc12b0a29989d0f5475d0878dab850ae05631348c1a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c22fe3573b38b5ffb020aef936428d82
SHA1 8644862b6e5d03f58a5f6df815d9cee15b29bef0
SHA256 63aa2ba2d242578640981d44ec27e269ba912e247df4a6e054a9df12f86d9b79
SHA512 7aadd5497a05ecc6781110416853b242f5391922e15a82e33d28a586b23e3ffcb2f0a738b376f2fe91f5c2f7e661f2c004690345214c3f0c016340122199e242

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a36e8e61046232463b4d771a564c8875
SHA1 3e8ee1a329433fe3451f4b12ce2890dfc6e63bf7
SHA256 1fa797759c5e02547f24fad71872ffab0461ca296bd1c06f3d113df9f30c8011
SHA512 f530a831b96e6e0b955db24114abb8e070e6e4a534aaddfa86b17a68405a0ea247569c70c113da843089b1e807da0d03c4aa1dfc5c63d5dbdcc667b3728f5ca1