Analysis

  • max time kernel
    135s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2023, 06:25

General

  • Target

    Windows10Upgrade9252.exe

  • Size

    6.0MB

  • MD5

    7da0f1dd7b0e8e883568b42f5184cbec

  • SHA1

    fb9ec929827606da12fb3d7594be1837577a5993

  • SHA256

    d972e967b79e3a5eaac3f2670c3022cfc85fdae953661093159866129fc36b31

  • SHA512

    c8b8d4922754a1d1d54b2d03dd00daace8e3ef3bc593b7910f180f7d9e1cd976da5fb73c8bf8cd3cc91f27c6996e936feee29b9300c0d5360c76b0e5ab15efe3

  • SSDEEP

    98304:9vGPYCQkTuGpNF4/E0bGz+KkfUHFJ3codBd9V0TomHzAzYkhxph7vH3Ckht5fDCK:9+PYC9qGp/4MmGz+K6QD9dBd9VKomkzb

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Windows10Upgrade\Windows10UpgraderApp.exe
      "C:\Windows10Upgrade\Windows10UpgraderApp.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /x {139493B2-F1BC-4F05-A974-B49297C1EB04} /q
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3008
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:412

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\2052\DWINTL20.DLL

          Filesize

          109KB

          MD5

          6ecb02e195cf345d72ff5eb73d250ec3

          SHA1

          2c5a797c406fa29bd19cecf6ea94abb8a11a1f10

          SHA256

          41a35d57a1ae29ae41a5150208363f7346d302ede90b3d0039e38a3d402c83b3

          SHA512

          f69372428d5a472d857317b72b90526fd40d7b53fe9070f34d3a5d870e8ffcbd69646ae2a38288a9672d397f6c393e0ddf906fdb596b8a46f8a82b0f68b3b15d

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\DW20.EXE

          Filesize

          622KB

          MD5

          1f72306a11d4de3233ea19250469a9ee

          SHA1

          07471b35406605a3bf58e2ed1229e66ba5b01584

          SHA256

          25181a5fdb5893a95a668445d1f22e759139ef2ac01070c7eb0a23a7a3a0c322

          SHA512

          4d2fdc410616c39a1cd450c0018c79bc9c3e7e63bb84b29944565a83ac505223c52ea778031ebb9865b7d9a0fce49b2c255c5b5966e3ca5867e58d21f80defa5

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\DWDCW20.DLL

          Filesize

          42KB

          MD5

          6b6877c1d58f5010b6a8210b79dffc75

          SHA1

          ae50de287daed93b3bf06706bfed9f62618fc22c

          SHA256

          0325555b3de0b0c3695be1a0c0b303ae4019506ca17ba40636e04963199284c1

          SHA512

          3fe61dd3a453a501cf5da9d75a7fc29d5b95cd38983b7e2d4eeb308b6306c29ac7417966766c60d1ca1458457e15c21f3331d74ce488610b9c4c287543b5a2ae

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\DWTRIG20.EXE

          Filesize

          38KB

          MD5

          0ae71ec7b6dd4a4eb8ccd133542c52c3

          SHA1

          f63f65e883ca31d4fa0c371e2ce03687c847749e

          SHA256

          8c7b8ec98299ae949a8715f50a26883da92990a8feca422c91d1ccab2a08fcb5

          SHA512

          d10de6378f1cff8b48d080386d78bc3ddeed029278d7c1aca08309acdb037178166123049a71a280d269edb6c9f1f16fa425b16a9bacb54256f93d05eeabe6ae

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\DevInv.dll

          Filesize

          315KB

          MD5

          261ac59f28e83677d1df6236e6af5a9b

          SHA1

          b5477f42bbbd7603929390c96c14a19165d0b5fe

          SHA256

          bc2e719379f802179269c52d2436eb8408e51e4245b37d3ad68eab06860764c3

          SHA512

          6fa80b335c1edc6e1f140f0943f332899041267edb5658cbf18956631c5f699cb21e1140f89be9369eed805add8459251631407591fa93e843d50255fa6374a9

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\ESDHelper.dll

          Filesize

          67KB

          MD5

          0b224516ab0f45b45482268ecf37d8fe

          SHA1

          19ad333d521b25c46d1653a19dafc7f2f78d5cbe

          SHA256

          9afafcc11a14107122a7e584778ea834f484ea468c587f1ddc35225e55a0050b

          SHA512

          e72cc3f9c5c171e8717180f5ab583a1d60dc82af902888ce470e0952e02e2f4000a56c2727e0c3826b2621ad383df1d5bdb521890769b7f2c9446ce48dfdd553

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\GatherOSState.EXE

          Filesize

          551KB

          MD5

          c8f114021cbabfb4bf0e0ea27b6da833

          SHA1

          5db624d446b7287e4976ad4034876d472c6a4ff0

          SHA256

          528ea7bf0db30f9942727f6ab171695dcef8c6e22bfaaf0d6b1edd5af0eb334e

          SHA512

          d213af4ea21dc419044e4e09378727a905182e576fb1c02910f6e34e4af475b004eff9851efdbd0d575c03c8c2a5e27c98e246ac17f35e0726ecce45d027a85a

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\GetCurrentDeploy.dll

          Filesize

          535KB

          MD5

          03e13a32575fbddda792d19720898fab

          SHA1

          499b05c56c8a57e35dcafaf4709f63325b71d496

          SHA256

          bac0443cd7ee7dc77bdc5ec72a8afe2c08598b8db869ed1e7d25c04323da8e6d

          SHA512

          0a54b2074e4e6332812e17669a9feac1082c4676b8d199dad42a0b67e6e58f276220de7edd791abdb6ac6271c31ca9ca47dc270ede626382c34cd5eb2e4b77e1

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\GetCurrentOOBE.dll

          Filesize

          145KB

          MD5

          3cea6defe779dc61b19103a745d558f1

          SHA1

          872832d616155b3f57e97b2032d2da19f7df11c6

          SHA256

          535582b8385115e6f8fd963de93f3fad4e70e66c5dc047e073958c3684a41f49

          SHA512

          bd3061e104fc6d92e869bb4020864772ec4d472ed2eaaabb5403093b7e02c38997ade948af2f92e059d1148f16e6ab0134e27627bc2dc734e4d409cc429217a4

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\GetCurrentRollback.EXE

          Filesize

          71KB

          MD5

          ed8e9ef12fb12cb4b9be0a3a1ce633b1

          SHA1

          80c9d33bada568eeb737577b084d8c99fbf9e141

          SHA256

          68cbd6ec391040fb6185ef690f24591740edce8efc2ad6cd8e10cef77eeeaba1

          SHA512

          f7b91fb68ddb624bf6149059a8fe30a7397fe38b4790f7b46dbcfe3d6eabf54d6c48155f0b3a97f3a2ef2d92fe59b62df56cc0c06cde1346b630deea82a7a0fc

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\HttpHelper.exe

          Filesize

          27KB

          MD5

          3c7f4ba723ae59684df773751909e179

          SHA1

          c4d402e9e258a6068b051825a2454033142e04c0

          SHA256

          0b319c3c17d6f9adfd745c8d8fa20f7b69580a5d70287f27f23897ea86e1d099

          SHA512

          3858c0c2037d56854d1b9861febb632d9fc05fc20135075d194434c6ac45475cb338469f84731344becc83892c532d208172cf72d635ed73df794fbc9aeef8ec

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\WinREBootApp32.exe

          Filesize

          24KB

          MD5

          4b964676e6708dfb9c47b561392997f2

          SHA1

          b2ea7c2e63abb638d5659e307c5c02b8e3cadce4

          SHA256

          a3d9472c3070108214d27ef232e69a48b51a5adc02036b1a1187685cc8a0b3c9

          SHA512

          85f8bb8bd60d4dbcdc9a4ea32164341ab65ae2cbc0b4caa9bd9a3099987623c0a237c4d88c0f12c89d53f1bdc96bda0e8a8404eb962329159e2bd674d64c1801

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\WinREBootApp64.exe

          Filesize

          25KB

          MD5

          2ab775549e90ae4a096442e338a7376c

          SHA1

          2bc3f18a25bfca6e9d8e361391d6cf37b6bf53c6

          SHA256

          81dfc2b7fe01a957317142526f15e742138f6a25e1ef96d5c4424f53a9f5f455

          SHA512

          e551547e572b552aa7e225c4636d280660ee799f80311a0a6a186c7ec368dd276a46a8139e93f75cbc2ee2f20f1c5a7703bfc8b7e1426f77be08e954d5940305

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\appraiserxp.dll

          Filesize

          461KB

          MD5

          f07db10f6c22c6129de4721935f95a1e

          SHA1

          9fcb00a9e12d1df2344bec73c9a945c7acf80eb1

          SHA256

          f43f8d1054d89f99b16c58326da6c4d89a12efe498ddbc09b1a9673e95a25836

          SHA512

          38991668e4a1998d61a0513bba225108df64a4b94752f988447c103f07bbaa0bc78877c48949413a557f040ce928ca020cda61ba504d43e473d6c6e9dbec9c80

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\bootsect.exe

          Filesize

          115KB

          MD5

          807cee9bf0bd780789b2d8645a8f8d77

          SHA1

          59925ad276958aca6acd892b14fb137b8eb55389

          SHA256

          064ea165785bd5e54d3dc6b025ccb8f672224252b7f0b41dd3f9f0c08da05f00

          SHA512

          f8f1c534c134b549058d35c68e0233ec408f9116a559c553321fb329e02dac7452c4d87594384b951240ddafc2d6509b7392960311317e25dc895584ba3dd5a9

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\cosquery.dll

          Filesize

          53KB

          MD5

          f6f6913be848f72ff7d012fe77ab07ee

          SHA1

          9eba51b5bb996f7ef037af162ddb16281bc0f448

          SHA256

          8ff89a9e090b58661414f50635f231d82884ffdc329e61265a440d9e224b747e

          SHA512

          fbf07472dab0eb970ffc082b54af4161eba214bf875648749886d62b55ca8caa07c1ccf2c472927fd42336f19e8699d57cd0e61a4c5910a1b3fac6056773f56d

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\dll1\cosqueryxp.dll

          Filesize

          122KB

          MD5

          26ab402471180ec58471a8145d8bdd2f

          SHA1

          4a06263663c602e6b1bc735e4b0698fc4bb26baa

          SHA256

          b583eba2a2b92ecd76f29ccdade41c5c9faa2540b7774c9fac1dacb08531cc11

          SHA512

          cb67effd451be3a748fe14c129ae200cf82f3d8c5991c08553a1dc1c6c30ed6d05015f4f9d19a9c5b5a3a3e3dc4c2ae27187d15eb5fbc4b9ae72618a68382ffd

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\dll1\wdscore.dll

          Filesize

          229KB

          MD5

          24a2b21c1934267fd0ead244404aad05

          SHA1

          b07b973b4b8f3f900a897cfd74d664945bb530d5

          SHA256

          3591c8b58e18f4f7e38b3443d692fa8659a64d23b9784ea09f5a45f1de4ea100

          SHA512

          684edaf071aa8922d9c6eb72e177801b79c0b9512844f4822d415fc7a9099e795e0b87c6aa03ca802c77493f4832651a310409ecf36962df53e40a32ea33f88e

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\dll1\webservices.dll

          Filesize

          929KB

          MD5

          b5a27237f69262c57468aaa2044daefd

          SHA1

          36ea601ec4e9266f4e6f4eeb3b8fe936f6580679

          SHA256

          e6396713849b869f0befd7646594726b821d87034267023338b1cc1170f74c5a

          SHA512

          869ef06d00105601972c389c412e150b9c9548f62fc82ea4220793ad950a7817a4c29bf8631042de49b9c8c49004d26a41f5ae8c14d31c2372caa7ff79b43498

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\dll2\webservices.dll

          Filesize

          737KB

          MD5

          e4783742790b2084efcbf6ae8968a73d

          SHA1

          ff6de8227741cf029562fe82de1d30fc0944c9c1

          SHA256

          e59e798bf0f02a85601cc2c938418d98ca5c51753617e7bb0aedd8f7fcb841c4

          SHA512

          45e20d023b26bd910564dd33167073eea67f9958941b01f38af732caf4e48ffebcdbb1e3fee246a9108d239766a6f333aad7e6294620622ac8e7feddfd59505f

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\downloader.dll

          Filesize

          207KB

          MD5

          1326de2d29a53697c0ae274b05a90f69

          SHA1

          ebad0bb520631339f2a213da626527d452e4e1fc

          SHA256

          9e70d0bda80b060213d2c5d255d6b98016657d67f065bfd85042143a1171cc71

          SHA512

          ec0e1c9c48480b98206796865b6dc9583468fee9eb5dfa92e1648c4fb732f4996743108719e4e501372ebbfc090f2401501dcbca821c9d509b4303539fe02425

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\esdstub.dll

          Filesize

          39KB

          MD5

          0b967efb2ca72fa81ab44c58dec0a551

          SHA1

          778932f602c0d2103e4d095c3a878be762f0afe4

          SHA256

          018ae9394d90e0780cb222ea84e2bd72e3d9539cd70fbbc80091bc51a56d1088

          SHA512

          cfe157f2b76d8484d27792669ac058aa3b64b4a15eb3f6b4366d2694a4ae1d0c3d750b73e0631400671a5d3fb1951b4cec18c69a9612109f38ccc39642e675c1

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\amd64\BiosBlocks.xml

          Filesize

          91KB

          MD5

          d47ade3e102969b4067d7eee385f74d2

          SHA1

          b5dc07ad38b66fb15603bc581ebb2755ddda48a2

          SHA256

          b2a22d7da2950b5d47d740702cfc44f7036cef5bb8396586d8182d5dd09da76b

          SHA512

          d80671ecf56e36f70d02c2af72674e4e30028615f4b25a19a856fa1dfcb7bca5386296522a9b95dd7843015d489b854d5952ab7effc3ac16673e92eb5550eb52

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\amd64\NXQuery.sys

          Filesize

          20KB

          MD5

          354bec8655766c0dde073852cc5341a7

          SHA1

          64e3d6ae28424cdc2e4837f5b730d9d62026002a

          SHA256

          053839096974f0f8b5ae65c67926322d8bce218382300db029ee5cf77023288e

          SHA512

          e36e2b01f8ed9c9f52ae271212526ff31b49fdde77ec4081fa841b59eabd612fbdc2e5fd6b3ea54127bbb5d23ff8c16fceadc0d1f375a541e3cb75e51d42811a

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\amd64\hwcompat.txt

          Filesize

          71KB

          MD5

          ae3768413e4a6c718749e8800b839bca

          SHA1

          55debcd5d806dd8252de5f9495408d3892847aec

          SHA256

          914a0f9fd3308dff166eb531269fe98d1bd05043acc23f1759100249d09cc85f

          SHA512

          07b3ea312a775793e0cee75c6f916d0cd40ce7a19a1b900143cd2d842419647cb513cf2af28e8de9e16bd6f82be09b93cd3f5ce43cb7c5383d3c1a125cde572f

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\amd64\hwexclude.txt

          Filesize

          2KB

          MD5

          fdc3b5f41f8a28ea6a8f2e34f872463a

          SHA1

          6fc6a0c9abf4e7bee8f8d967c1b433d31e6195ca

          SHA256

          4797ed0a33984a8a532c91835a837f539a57227ec47ae233e25d37b09f79b4f1

          SHA512

          c343afda4342cba9adcfeb7c1319988dd378a5329adff5bb5a1e13fbb788c4e486a2b0fb8531fe23cd63892a121e2fe5e0a81352d569d140b4699fce1c61fca1

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\amd64\nxquery.cat

          Filesize

          9KB

          MD5

          81ca33a6984e478a9b6ccfe53be39142

          SHA1

          a3b058db3d6cf3fb685616169d9a8fabf7c6f600

          SHA256

          2f4caa03e1e447ba729c54f6997ba5d89a28114b545d6929b3279a24b7b79878

          SHA512

          cb6281d5812065461cbd419c2a8f99d3fe0dda73b35246af09597111e84ca945b9902d7cc3cf916cf6889bdbbff552cbd7c400ec328de3a9f94d0cc908867a75

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\amd64\nxquery.inf

          Filesize

          1KB

          MD5

          ae8053b0e0ed71b40da08ec58a9fd95a

          SHA1

          9ca4b71eae874fb37554d7c8898722160b2eb183

          SHA256

          563dc06f3f4a15860c2107181f6660aeff256b587748b6ce9df72c3ae1118d04

          SHA512

          5042ba84216bb312dbb91f9cc1be4e376105fa1a608a4b99cd7495afb7088243dcc701944da48751416a290c37ff71a153cbd2561fb2bff04bb5361e5c335dc5

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\hwcompatShared.txt

          Filesize

          806KB

          MD5

          e887a3b1d82ebfbe7e6166e6bac52786

          SHA1

          f8229586473ee80af1a9a78dfac3f5057cdb6545

          SHA256

          1f85075837dda52968cadb113a574c200a293df11cee3c47dabc4c245cc3421e

          SHA512

          79a78c826513b49fe917f335f94fdfc999023dbacc12ad49cb23238abea42ff9203e61eee0b4179804e27dd6e58232cf0bdca410688de0288c1053fe8f62e039

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\i386\NXQuery.sys

          Filesize

          19KB

          MD5

          16e552b1a35f5323db573e958c8ead5a

          SHA1

          a6a29be474867112f84afc7654e8a65a3ab467d7

          SHA256

          23067136b40895732111ee3b119712feee602d0c6f6bf7fa4dbab925f02d7011

          SHA512

          8805625ac49351ed36c653eb9df780188c052de72d092dbcf2fbc37f5955cae8f54624e3566d41943a26fd140c4d95ec2ab48d58e9d0d497a4addd5884675d17

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\i386\hwcompat.txt

          Filesize

          16KB

          MD5

          105d0230b1fbdf2b33bb82c3ffb78766

          SHA1

          758e189d8b9a745457e3870a3a01355b9d0cc3b5

          SHA256

          101111776c9c119001493be06fc0d4f60cc0269ec59569cfeca7b637b0765fb1

          SHA512

          d9c3eba679a87266a54248e1fce7a221570f83820fb37dee785e471fd707aff1d6fb5a19dacf67eff01172a36b4c647dcbad06ea022d6d76fdc9cb5a29b8114f

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\i386\hwexclude.txt

          Filesize

          2KB

          MD5

          caf9ae1755cc6051e645d941fc78d302

          SHA1

          b3b6b780f559d4f7e0321247ce41db12a842b8ea

          SHA256

          6b7f1334092a5b3b71fcdbd76abe0334d442adc0729c47a01e11b93ef9ddc26c

          SHA512

          3845a7b1e1e932ac534b105ca1cadf794e4f34809349d7676a1d2833e69f5154fab82bcd0ac025dbadd6fe93fcaa1492fdcd13b8b807c44a4331ba065739e128

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\i386\nxquery.cat

          Filesize

          9KB

          MD5

          57bd8965ef08a34f48084de9e8b8c492

          SHA1

          67e63213d1c8fa8a42daa0ecf2a4567c1adb735b

          SHA256

          a3b6373b1c6252286469db02769d3e80aa9f7aa6f95a047e65e6a485ea9e5694

          SHA512

          4b1b5fc847e5aeefd1caf7e312605aeca74c13e416eed7909e5cac917e9d055f6b1263debf247fdc0a7f6d4f18b02542ab1be6c127720297e35a1655525cca17

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_ar-sa.htm

          Filesize

          107KB

          MD5

          adcf832fe954e497f5900def6d9a42aa

          SHA1

          965ca32b702dad2b2127187ca3a298c9fec602a3

          SHA256

          42c0dd5f1ddc238450f9e55df2916716933c127da46a56b287e5ba99281d9139

          SHA512

          fe3a51279250db32c148aaaf7a173d6681abb870ceef3da05990e182847aac3a635d69a2381c592112a4fb4342d1dfa9236812b67a9bf1a82ba5bbaedf3da05c

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_bg-bg.htm

          Filesize

          247KB

          MD5

          2ba7737eca28174496ff3f15b4b08759

          SHA1

          a781168a24f391e5f025a860ef4d26e615a8aaff

          SHA256

          8d086a361a942ae291472a59454559c5707d57cce5e0f5177a55a364f044307b

          SHA512

          86099e8a54c6a0f29c1d1daf59cde243e954040aa74ae8bb4d0cc86542ba87042ddb26b4379a1d60b3cff1b3d6a1c9ef875fd4d614c964a664b0db14fb675023

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_cs-cz.htm

          Filesize

          81KB

          MD5

          0646b30f24800c1787b0d09834d9b3f5

          SHA1

          3a44d911b992050e004f7218d9ae328db085e367

          SHA256

          ca68e13fb346d53fb08fb2033c4fad8f026a3aacf0711043d3d865336edfc4e5

          SHA512

          404a220c9aa698f172f8873204e5dd2f73b99bb07f346cc326eff74379f207685db3edc89fd88e8937482825de7721a9018ce7d4f345742ba36491afb6737d1f

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_da-dk.htm

          Filesize

          63KB

          MD5

          5fcd04743f75cd95314b41985764693f

          SHA1

          c1ccf7ecb9305fcf222d8d0cdc1762a3bee395ec

          SHA256

          6ee00705f4fb3e9bf8b1f5f73d8fd68729f178754807b062b59f1f8872c8fefb

          SHA512

          a1b5eafd44420034776f1c7dddface52b55bde60c72ac05dd360ee47961e778f0582ffe5e14ba3f8b359e78e07da0e285f46fba7893f7bba505e83c89bdc7788

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_de-de.htm

          Filesize

          68KB

          MD5

          f85441063ba38afc61d591987912e010

          SHA1

          05e5212cc5a76d95d302eacf23243f5b87fdcfe9

          SHA256

          ab1be6dcb94ba1afc4af0784a897813b710312d71522c8f6612bbad3aef7c04a

          SHA512

          2a705c925d4b17aa08a2602678fd9fa5282db6ae9d639353642c40634604efd7f8b9342998e344f2289e553c6c9848f8dc843d6f1ad2a2b3a9c6f93daee847b8

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_el-gr.htm

          Filesize

          233KB

          MD5

          fe246bf280b9f3c976e6dbe8e21b4c73

          SHA1

          d10d057bafbf5d68513e908906806600b845ff5d

          SHA256

          3a39108313fe47b530a735ac5ddb2d2fe5c7362d2d26962505a09d5a2e5685ab

          SHA512

          59ed878b96dd13f4165e3a20f1dca59a1784e73f60ec2ba6b1287e02336ce7d5a88cac4739cfacf70f3814a0ed1816fbe488e91d6041708ae4a98e455c2cce48

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_en-gb.htm

          Filesize

          57KB

          MD5

          7c109a8b0471d8e9e30cc79e6cb5924e

          SHA1

          f29901be4eadee321d2054a95b95cc6bb0d8d05f

          SHA256

          4d57b34f6a5b7f54222a4660985dfbd0085aec044d304c33d3f45bd51a5a4b38

          SHA512

          55fe987593b5536b0aad4f0d2e762464a76e1102e42b5cc1c86e0324158dd15f93125bff756243d4c511395bf1f5762c81c35940d59cea0dff84215560044e0d

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_es-es.htm

          Filesize

          68KB

          MD5

          0c51b01fbe3482e4b45971f0d3aeb50b

          SHA1

          4b747adbce3c297eaec01ad9978fd274bacba9ba

          SHA256

          2e1db75000aac4df4765a74d3f763e3b1e2ccfb7f2ff04894899de735fda459e

          SHA512

          ed8ee1dbf1bc6a801fdcd32ad61ec9b558b192cd519d2b10550c600dcf9a8107ce5f908ccf3f175314d33cc065fa9046fe212504c6252e2d6b526458b370a7fa

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_et-ee.htm

          Filesize

          61KB

          MD5

          6ffc6557dc0a3b861478bdfea0a92048

          SHA1

          a535f8b74b7197da969660b541927f1c2ee00d9a

          SHA256

          255601999fc41e2ea5c24438f02bf1f24078b9c116f5ecdcf15acad079eaf869

          SHA512

          e70e4b3d615d5fe36a34632660a025ff89d162a83c70fb2e86a4c872ef95f415899ba84c02a105b094c8a522f7ec65d0c4efd63b15db4f224c62bf033d7d1fcc

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_fi-fi.htm

          Filesize

          69KB

          MD5

          a3718a8d48cae7e709a1c0b83043c345

          SHA1

          892fd1f041dbb1c982a0661bbed99ed87f2cf281

          SHA256

          ddc8f64334fe3de276b745520034fe9699ff4a13bbad502a75b9102a2a6fb146

          SHA512

          ad1c46a5d2922f4104bd5026559868f1099262b4d649d361de1da056969394f1f8d9d6fe89fae7e7bf693f3750cf270919de55390656fd4526cd9798bfac97e1

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_fr-ca.htm

          Filesize

          67KB

          MD5

          d01ab717aeda0f9ce5d71797e08dfb47

          SHA1

          535196ade3ada94262020612fea2442701e6c78a

          SHA256

          0fdcb589ffe9926017123e53f5d453aac8df8d222901d25efa30b7d027c944bd

          SHA512

          957b26b79bfd28094060365ae42b46e6937d063c4bff34c2781938ba6b434f5af7182accbb00860b167b236ac4bf0e3ebcc4cebad5aa7fa8a431239319ef622e

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_he-il.htm

          Filesize

          844KB

          MD5

          690a8161fe3f3233c1cbc66407477d68

          SHA1

          ae2f8ceca80ef6b87e2cb53f99ca7496be21d969

          SHA256

          8d018b1d34fb56e56019ca27ffa80b64ca8b601262f1f56b8808d2901aa91aef

          SHA512

          8c00ca03d6ad8f2c2995c81a5186688f8c8b00846ad10fbeb81d9771db453138fc7c545489e9ae303501eca7e0829cab697025a3c7a12c62f4316e694aa111c2

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_hr-hr.htm

          Filesize

          63KB

          MD5

          17b4682fcb3fc6229afdc03ab9486913

          SHA1

          46225efe646ba3a0878c75257f5341be534747ff

          SHA256

          b1d7ca778d56c33b195c40c78ee906457392be70014c226ea1bbc51bb0b3c473

          SHA512

          8ccead478f29d8ad1ca0791c4d9594ad54581241df25b8cf9b6017b7724ab46f569ec1af168b584989eef0cad3be89c6ed1dc095eee8a8dbfb043ad5aa3f914a

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_hu-hu.htm

          Filesize

          82KB

          MD5

          a3c4310561ac11b9c7c3390c9f139985

          SHA1

          33e416bddd22a33a0b392b022fb89c40b1d389c9

          SHA256

          dc528aad67a9bdb497c48d7306b8259c8b6fc3d83a0de608689884d3e9f84196

          SHA512

          78d87b4fabde107776b8c8f05a0c37e7b40850963c65fc46dc719e8c85fdbfd4179407e67990de4c0dbcebb344541705878a58df8061dd172f8c0cd73b2ec674

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_it-it.htm

          Filesize

          67KB

          MD5

          066d2cea13dfcea9837eb22ca980527c

          SHA1

          ae010fa1fc307ebb35436549d30ba0688a023529

          SHA256

          0720f481ac66c33cb37d28c84cca27e25fb03701be1d2cb18b887dc42c260d95

          SHA512

          8dda0c1f7b36a5009a23adaa5785ea77eef0207650b57b808a72a51505d51be32ddc768b047cbbbf71a5d57117d4d55ef2e65d5e793bb15d380250c79c0f443e

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_ja-jp.htm

          Filesize

          205KB

          MD5

          2d43099e7d9239f9029d01899b1c1855

          SHA1

          e0edf186f28eb75ee34dff582677c756cee9630f

          SHA256

          e11651fd4abe450410455838ed243245f193a0cf213d037b04e981f026e04ccc

          SHA512

          6cc06d35776bab92d89f13b75adf3590935f40bc3f8f3244e88dd9239259eba8e6725cf9e22967e7eb7cd5ce6384019872155600962f5a095290a59c5ceceded

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_ko-kr.htm

          Filesize

          619KB

          MD5

          350aa1fe24dcbe7faf07cdbbec717cf8

          SHA1

          2c30c32495b8f19e0e63104526061829b571b017

          SHA256

          e91f8682dd804ba1938db3d57ebbdd3b3a697d95090b4ded9a0d46edae78afda

          SHA512

          5ef7905e0ecfd1ec9b82d22733c77a8f234513e731af98e1dbb28f4e0e7001579cf918e5aa99a2cefb1002ad044b98888b718c9dc730c4f2c90e78a2397edb30

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_lt-lt.htm

          Filesize

          74KB

          MD5

          72625a95a93368c76c2d45c67f379dfb

          SHA1

          426be4a834982ccb8b86afbdcfa2b43e3c2f7346

          SHA256

          7f2e031028feac2a81575078c4abc161b638e611678215d41daa26eae3139a9d

          SHA512

          8a4854c88363a3a73672132322995baede210e919783c1232b6567fd356973c79c6b7af07146a1bed453a770a9c38653ef2006d50c204e464875c03fcbd1a999

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_lv-lv.htm

          Filesize

          81KB

          MD5

          8071b37aff4b7f5622c2fee01ec4d1a1

          SHA1

          5dac4f9e002cd4cffdb3032b4a6d6f7bda3bff35

          SHA256

          5bc765dd2672da3dd8e95a2f01e9d56aaed94476cf87128217591aa060dc4c55

          SHA512

          90cb2d30cbb5a0c3407c165dfc6648e26f72a35cbc7fd96852c98c1b17fd21a20fef5debbe9b6a33955184988af18b82df45654ffc67090ddca2c7513dfe7870

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_nb-no.htm

          Filesize

          65KB

          MD5

          e0cd671be672bc06d9cc6310df0b3e72

          SHA1

          fb81a26ce58a21ef12218a2d1df816e73490c39a

          SHA256

          f146fcaed93f1795b119370b4f51140a7225b27a273634d81895a22a7056941c

          SHA512

          a9408d188187b3f5e5b7f89068342f850cf558a5a3d8096a90ecd18fbf36229762c00db7469906a2c039e83c5cc239f47f3d355ec52342d5387747fd82b090d7

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_nl-nl.htm

          Filesize

          65KB

          MD5

          906c927fddb772cbd6fea9b080e5b9cd

          SHA1

          ed64dcafed3e40a9e49ab5ba8dea192fd280a25c

          SHA256

          2cc13b76ba20afd7c4bd959181f83e78d39b424841e762059e6c7a1c58f539af

          SHA512

          56948b99fbb6642b845a018d60bf08c4e1a3da034e6d21fcaacaadf52573b635c34661c87adc3f3107ef32a8482c78f36b500bb81c46f38d6639e1bb3849ed9e

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_pl-pl.htm

          Filesize

          79KB

          MD5

          22bd698c822dff830f879b9288d08ac6

          SHA1

          22a51aa86c2e361f84cf06904960a6f0699ad672

          SHA256

          e4f7f4232b57a2b61bdccf1ab7960e945fac87efb54c809642648965bed9ca12

          SHA512

          2ee1e3bfd95b4faec8473162ccb0fec98b7799c873b9fdc5b652eb432eae2af0ce0af755201ccc363a70c5c4b8c632546d77a534ef689256169b0887fd8dd613

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_pt-br.htm

          Filesize

          66KB

          MD5

          f6b380cf9f4f555f686d995915dc0a5d

          SHA1

          418057c5c6b81f8cf680d3dba9409a23bda27636

          SHA256

          d3b114750fbeeafa5a2b8ab813271a63a1b2c3755e4ced23f0cca4a75a659342

          SHA512

          6e2592f8d3f1d4f5816231e14b633c5f4f544bcd9d414c184fc87d45f4730b95576103fe4935dea76b3db9448b15e8505370dc725700d4f2aab316bd7cf545ea

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_pt-pt.htm

          Filesize

          69KB

          MD5

          95fc75239fed1b07e672c05b47667438

          SHA1

          15b97dc03a483752ac32e4685d637383008bd6fc

          SHA256

          028b75f93966fc69a5d41872184e5a770ebd5c1025615c913d40b5cb871cb547

          SHA512

          21f14fb66bb3a4fd010fa62517437cc78fd78c0c7e65d6120adfadcf2d0578ab667b10f094ec5babf3f3f94aa5667f100fb1669abab8bb6c2ea35336ba968156

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_ro-ro.htm

          Filesize

          76KB

          MD5

          9ec883b2382ddbdfacf17969bee8610c

          SHA1

          ec91b25631c9152ace8b9a799cd54f8151929a54

          SHA256

          3454d35ccca8c0d8ad32dee0583f7b9947569615f0107a50c05f696d2d78c3fa

          SHA512

          d55e59d8d538daaa2f701145e857e2c46cdd2f241bb06d6229dc5166122345aea88278cd923c365b9de42baa70f24fb3c4844ed8d05e0b772dbdf0b64ed44d39

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_ru-ru.htm

          Filesize

          277KB

          MD5

          8700e023c4bd10016bbf3208ea29ddab

          SHA1

          16a8d1ba565622239d9a7c1008a844e3a59920b8

          SHA256

          2acadf196a15aa3c34cddf59815457dc6cfdd6085b541bfc4f750f39b05814ea

          SHA512

          c2a4780addcf235809877fce0c6b20557aedb8aef0255e27ae8560e6dd6478bf3cbd98560df43703d3169f3da211492e1fc5d28003440c9bd027c47af8d5a077

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_sk-sk.htm

          Filesize

          80KB

          MD5

          cda500f2f6e636bb49c636e1ce1a26d3

          SHA1

          f691bfaba22d102cfd038b585578e96bd99b2b5a

          SHA256

          2c525c4f3675a86bb333a386bfca229bb2895a031ed55d194b80a4b3fb1cca27

          SHA512

          a7322779e7d29e41e51f77be5d9966cc9f6bdf82a77809cf66196dac90df57fa95097cebeec06ab4a39663ceacd68fbd1bbabd2b0b02873cd2ce6f76146bfd0c

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_sl-si.htm

          Filesize

          64KB

          MD5

          c6405b057d4dd1bf6d211a8e2c97da89

          SHA1

          83deebee59c563a723ccafe0c3099cf50229e9f3

          SHA256

          b222bc659ce6a5325d387a2687875df6df0f54e11746ca26f2dd598700878ae8

          SHA512

          3d6bd77f4ae78814ba499ef083e27a200c3e336148638b53d5c1c40d22f95213ef46c8da34b53a3ec2a37433ab1bfa0e5fd0eb67a35cf39ea3ee5a4b2bb2f584

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_sr-latn-cs.htm

          Filesize

          73KB

          MD5

          74894579ed39de648c6fb9bacfaf081b

          SHA1

          b62abc87020592ddc779a89df06ae2425c86cf17

          SHA256

          5b0e34107a0656ad99a54b29f02f1e96bffd7e257841125aa7a080df4026b7b9

          SHA512

          93c786785759bdabb324dfb1e207708ad6bdae9e1971666718f8d839c201b2fe5899f71ffd507149070425630326d7f705850f07653f19ca7b8b481bb1b62c69

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_sv-se.htm

          Filesize

          68KB

          MD5

          96503f775cf678279f08f40b303628ac

          SHA1

          caa772cd2e0dcb282acd231859c761b7ded8f469

          SHA256

          c92b49edf44aaaacff48d56ea4c9c816ae783fad86b87e2b17af9aa7b21f4e25

          SHA512

          b86410572f8804816f534cac6245cc5fadcdd76fcf0550066dcc1ea4fc6ff3a8398ad76907e8d38adfc48a2009aa71b6aadbfa9b46ed0cbf903a42d3447d27a8

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_th-th.htm

          Filesize

          248KB

          MD5

          f33e3647f358d8fd18783ffeef56c7ef

          SHA1

          9c0b0f1fbfd314afc0ca054921487ab67e0dd042

          SHA256

          f59fec28f2135f11656d004cbea241f7a77aa5f16f66478064700863f1285de8

          SHA512

          b1510f5c6db278da7074e162223c731cd2d9a27498c8bd9f0e5b070611a8107fe5d04b82131e748b9b49d0dfee490821a1430358e2956c55a5d927d19895def7

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_tr-tr.htm

          Filesize

          73KB

          MD5

          88f75395b64cbad0188573419becca1a

          SHA1

          2c28b3300dfdcacf36021889d4a2dbc83d07b101

          SHA256

          afdd7acadafcf731dfbc4e5aed6a084f9ff47c69deac301027d0d17e5ddfb174

          SHA512

          7a663f38bca19868f0d59aba9b2b3bc790b17aab1e8460cafa2e10c79f851703a0d9615c4d0228ed2cf86d1a4bc35dfd285deb06e41fc2a91daa1dc4e924e005

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_uk-ua.htm

          Filesize

          260KB

          MD5

          ee5d7e138c36ed119b16af47dc8da717

          SHA1

          c828c9e497456b0d54bae0e31daa386593678e20

          SHA256

          e6fa82ce0ffbae8474c9d846fd85aa1a753c8419fd1f685429f0dc7d47107281

          SHA512

          ab1285b821cb7b15dca3635873dce1f30d1b346f2262f01e1b061e85ebf519b934d13b1cd203fde416f0c33bd1bf2c316e325d228377d8f77647abcf6bf06ebc

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_zh-cn.htm

          Filesize

          123KB

          MD5

          a94de6c2dec836de2c785077532708bf

          SHA1

          f7a5e475d61e30bc597d6445bcc0663d65dc4e00

          SHA256

          b0ab73641092afe81c99fa3ab561caeb79d74004e74b7972b8cafb045fb2ace7

          SHA512

          8528d3861bcdfa228e99507b72b628ad22d88708134dc40494dd966224d3e223d8c172418dbaf6595340e0185ec209b032138678b4486618daaafc2e7f95425a

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\EULA\EULA_zh-hk.htm

          Filesize

          143KB

          MD5

          5a48a6e0569768bf3e27ea2afb7c5c93

          SHA1

          3cd66bc29ff79b79fddc41afc1be92efc7203ab7

          SHA256

          0e8d3db5a662ed19d4dafce5bca4ef399a637c705e226718e3804f9664a1deb9

          SHA512

          f0a622baad0e30c66ac3422c49aa7074654cb6c246ecd7d69d5a8c198bd55e9bccd4cc2f89a9adf5b5f485892dbad2cbb97d15dc4a110b37b5fdb09a00fd505d

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css

          Filesize

          39KB

          MD5

          5ad8ceea06e280b9b42e1b8df4b8b407

          SHA1

          693ea7ac3f9fed186e0165e7667d2c41376c5d61

          SHA256

          03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb

          SHA512

          1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Microsoft.WinJS\css\ui-dark.css

          Filesize

          262KB

          MD5

          c9674190d140117be506a070c4ef5be2

          SHA1

          51db8cf46f6ecac6cab85a52402fd66c035e837f

          SHA256

          1e8e74e5a29f269157c043718b43c10c6f8beb806a6d2b3f3f2dd542731fd196

          SHA512

          9d41b784a377dc9a1bb61e337ade6acf7f841a672609626697925ace30f8fc574e58ee54388a76b446a84d4ba6de46d72e0b7cad64ada5bf5664c28df09ca585

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Microsoft.WinJS\js\base.js

          Filesize

          1.2MB

          MD5

          221c534deb612992681b0a2fb55bc5ed

          SHA1

          1ac3eb5a4ea6a0d876f8077e87357fccba472323

          SHA256

          7b67ab12bd5dcc229ea7f197fcb7723b1c41a517e198fad31020d8fea42e9715

          SHA512

          c9bd493fad305eb4c881eb6c9aa1daf672ec3531ca4871c44f3383b48389db24232b6dfe35ab6e82a5c8bc1a38f68b57fd30e2fab35bd6237d751285fd74444e

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Microsoft.WinJS\js\ui.js

          Filesize

          2.9MB

          MD5

          bafbf40fc2ca693b24494faeac904027

          SHA1

          587fb2aece577924c9cca1e3754aa9eb6ed5bbff

          SHA256

          d6569b9229f3f9543b22d3f92bc6b52585237a43313f44a06a2cd91d2e5e1739

          SHA512

          6281210da64cf4f6b52a1965e8eaba81f9fff6d1ff944a0b5c226961234357288d0b8e0fa6bc9a8c61a2f19b1c6a70e951b33b991efe6baee35fda205a0c6b3f

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\MicrosoftLogo.scale-100.png

          Filesize

          587B

          MD5

          f1742ca19d62a0badad844d9da7c0a40

          SHA1

          9da2a86e3693ca6572f7565579d31de74f64d097

          SHA256

          12d48884b72f28d9d194bc2766880a540522b243f4c442fa58d2f8d5edb3b7ab

          SHA512

          5f3f1f0ecdb4ca6f9ebecf11dce9a3e1c08bd2b68de7d86fb103563cdba5e3cf9e0c4f8e8dfd3d1cfbb2e7ca3834626852ebfb8b41397551a20a3b5fec6354ae

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Network.scale-100.png

          Filesize

          292B

          MD5

          f95f616d6c1a4f6309c09db1aecf3efe

          SHA1

          67fdbc77baeb4771b7b5394faaf3ddd786d46c7b

          SHA256

          f7bf4eab75913d9bc98e56db5e80723c7665da12e56eca28b74a8d84905c068b

          SHA512

          b96ea6e407a1ab3618f75bb00d26f5ca5802a478c7ae1f1f2e40c5815fba7de5e70ed444c8d64d4f655cd32fe71c063919af99fe5d231fbc9e084787984dc3f4

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Plug.scale-100.png

          Filesize

          160B

          MD5

          059224594f5d9beb01dd28d332198eee

          SHA1

          26594e4d55fa7ff51a3c887e5ac503f0989649ef

          SHA256

          20c8c9dc5a7ff666307822c772e8c6141142f1bd8e496405554b6b2c22021bec

          SHA512

          bcb2ed1e37587cec4b87f01520399cce158b70f89125f28b3b052d30ff64772512e197fc55a09615a93f645ae85829f0681ba4ee0c4e7fe31c2e42d2f228e24a

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Power.scale-100.png

          Filesize

          276B

          MD5

          24f494a3e3f76bc0870d589f4b7f8fac

          SHA1

          19b007c05d23774e1c255f93e2c52d9ad0eb89f9

          SHA256

          c19ef4a5d73739dca09a83a1f744d312b3689919ad98ab476457147e53646924

          SHA512

          bc0ec7f7a98b0cb919628a641ba90ee05e9d499e040d221a43018fbc9492eb5cff9574c8b2f53e99021b690c3f8b883a3e7b8213ddb4a00740179df4ea13aae8

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\Save.scale-100.png

          Filesize

          161B

          MD5

          6a18d1691592447cc43dedcf09bf3788

          SHA1

          93de5465d122ac037a4e352df05887c262d5e6c9

          SHA256

          5ad3c14700a55853f613aae5aa94cbc0a2ec32d5c160d76fade2eeb73cd934c7

          SHA512

          ea09ca85178ba9e0650b46671cf1fba8129f5bfc9f16b2553414f6bb8757bd929b056004974295c7ce4c9c17566c1d3c7ed3458ed5056803238cb5efc77285e1

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\ShieldError.scale-100.png

          Filesize

          2KB

          MD5

          7856a64b74fae6da743a5ed2b44dd5cd

          SHA1

          a6de3113973af500e93398658a18d388a4a9012d

          SHA256

          f7f650d2c96c377a2414bf9c4fde81c3f940204054ed186d18a7b10d5b179a66

          SHA512

          695294ae367f5b2721912cad089166af3a4ffe00cedc5e6e044e9ce601e4248648ba69b397fdcc96bdef93b4491cf0e0c87742a4a5cd6654347821b6031f73e3

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\block.png

          Filesize

          919B

          MD5

          a132f4d4f23f1bc40cfdb88223b1c74a

          SHA1

          11fc3eea08765c7dfa697cd9cacd18f7a9900181

          SHA256

          35825ad138cec97d3cff27cd8d139377e6ba4d0a55b473b59fb4f5f4b9508be6

          SHA512

          c5284f403c6617947545b0282d935d7e3b2ccb30c67d85920907b7cbd00c01e4c560824c3e7d77a51e97a646aff806879f76e418973a66e2fe1086b8288326b3

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\bluelogo.png

          Filesize

          6KB

          MD5

          eaee0451e79d9b030382468d7fb30bb1

          SHA1

          4ab6a1786fee143dd582be15e023dfcbdfb25960

          SHA256

          b385980d51521b6b161528af8a2fc3e850bfd8255e3673e69911f2bf9f59e39a

          SHA512

          fc9aae8fb60c82fc774fe4db84d76dc8751e3ddf83c84ea3153b6c10bd01c07dd734c76ca0af092e75c4189bc19787855a11c8afb7dccb79c148f4c4272c2309

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\bullet.png

          Filesize

          221B

          MD5

          baaa93b2584336c8e2fd561ccaab5391

          SHA1

          0523f0a835781e2f499f166d405bcdaf48c89a3a

          SHA256

          d548b0a3da3f8aa61aa880b2af3ba7997304253d763de1b8b1e3906b9adb5363

          SHA512

          7ca20ee57a778ed02a1771a9b622aa7b0859cee55036ec323e00e0ab1f6be4defad45bd48aab62f54645fa13c3d49b30fd68c0318e3d83465b42e20d05f6c391

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default.css

          Filesize

          5KB

          MD5

          75dc1deb03880b98eea8c7aaa0290c48

          SHA1

          37e8ff2edb6a606c8455f2cef8d34e87c4ce22e0

          SHA256

          e5d182eb14246c3551bec763bfea90aaacb1338c3a41316502d4204eead79900

          SHA512

          09e2554785bf6494f64f6e0fe01ef048d8ed7ff9a6d88e9c490fb6815f934bb677880e8176b9131e037133840f96f157be7d226907fdc37142e7eee3f0f61125

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default.htm

          Filesize

          60KB

          MD5

          c2ae355a35fa5b9a521f47258a96275f

          SHA1

          f462df90222f164831345dd371fa5a60e16ebdcb

          SHA256

          702ce5c74e48ceebe13fe074df8f98a4ed6198a593b1fbaaa13fe726581f5fd7

          SHA512

          737cf240b4ea31e5c9b3788c3e7fc7b18a4efa902a5f0eb69237e5482b7ec336eb8cc1ae631ed54ae99bf4f34e2f1abb7188d089ea37bb22dd7541d79924aa45

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default_eos.css

          Filesize

          6KB

          MD5

          8321e5e5481567e5ddf7c94ce938a2fc

          SHA1

          6248b1602d906765045f495f1c0fc67f2cd1d4eb

          SHA256

          9522d87bb367aaf32da9bbbf8c2752d49af85bd4938740a6b7776430fea231b3

          SHA512

          475cd71ca116a01f24ed614472408a914ae90dc1cac073169925e447779f03cc89a98824c222d16068c800e998cfce05041584f2ee58c227624d379ee8dcdc0b

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default_eos.htm

          Filesize

          54KB

          MD5

          4c66196b9a4db23d1b44768e502aa379

          SHA1

          c64ff634797a68dbe7fd60b1b3e1df768907869a

          SHA256

          cba6baa57e7b1418e08129940f4ea28a2461cc0e2fcca278399a43ddc836d7c4

          SHA512

          360c7d25f8adffbe72f1b499c577adae45714033f8b7234c7de66e597e876b9c64b54851f50c0425a9b4ebdf610702ecff889a326f1cc8ee4f14050002d75d19

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default_oobe.css

          Filesize

          5KB

          MD5

          534c5b313f34f22e010fb2998866ba7d

          SHA1

          a1b72d72fe071a0f749eb4e70606ba0f8f97336b

          SHA256

          2f8e81160bf54af4a6ad781b1da325ad27312a71119e59931b5312427a9410dd

          SHA512

          c124d04c8aa36d72b234d87075d3bf6e1b81460ce0f4ef87c23ebc49102f4c423db813e25bc46bb95a9e1d5b203ab498a3837894601888c97e6a8d20254edaee

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default_oobe.htm

          Filesize

          61KB

          MD5

          b519b5e743fdfb9167124bb27e546bb5

          SHA1

          bffd6c3f8e41584757776c9c7075ea5625e9d560

          SHA256

          9f88f37e8dff125f7129a4e5f5694fbdc3e71d393b015de2a2b0b9a4dccf24f3

          SHA512

          a3ec626d9331ed90478729cd6f0d60765aaef51a4425f45f5dc086ce76769c7891c8a0e6fab5fc78b0449e5a9959bc4071621d53992032bfd14fe8cc37d3cee0

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default_posteos.css

          Filesize

          7KB

          MD5

          af20ae58a295000df2b459c50ba3254a

          SHA1

          e13e30352e9fe5927506dc8701dbb859ff59d2cf

          SHA256

          a807423b8e15b9412b47bc6e0db96a63d3b037c7aaa134232888a7ab54fc207d

          SHA512

          18e2e774f159a568fb7a6a8da422509a7e9548bf93c2cc333c658d31d5884a09af7ccdfc582a22b8687635d0c41c7bdbaf3fff131762dea64250592c0420db96

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\default_posteos.htm

          Filesize

          55KB

          MD5

          738600608b5c044c68d80ccefdff447f

          SHA1

          37762e975eeeeb2d1546eb9d64a496b77cafbc7e

          SHA256

          517a8686ee75b3c951d4788313bff231439602f4101eb2497e9f197734c9b7ae

          SHA512

          cb2d03069e72b25c97daa446177418dadf7eee144c5a65de935a2f33485a998fa7161e08b25d104bfc950f2ec89788a8f3e60f4242ace06b4b9d36ba5bc828a6

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\eula.css

          Filesize

          82B

          MD5

          b81d1e97c529ac3d7f5a699afce27080

          SHA1

          0a981264db289afd71695b4d6849672187e8120f

          SHA256

          35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

          SHA512

          e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\loading.gif

          Filesize

          16KB

          MD5

          1a276cb116bdece96adf8e32c4af4fee

          SHA1

          6bc30738fcd0c04370436f4d3340d460d25b788f

          SHA256

          9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

          SHA512

          5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\lock.png

          Filesize

          3KB

          MD5

          e4455765199462015f6baa09631787f5

          SHA1

          35deae71602de6983b741796d9c126a4156cb39e

          SHA256

          d30a058a0a301e3553c615744d9a06cbde84c5ffe0e6d5e5929ba5b09e0686c0

          SHA512

          1c9f5b8cd65eb50fad59905ab8470cc7101dadfe99432e83de67450127c932829b06b7948b10e01f95c13cb7829e5381a40744d75fa9885ff3782ec6c52f05f7

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\logo.png

          Filesize

          2KB

          MD5

          afeed45df4d74d93c260a86e71e09102

          SHA1

          2cc520e3d23f6b371c288645649a482a5db7ccd9

          SHA256

          f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

          SHA512

          778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\marketing.png

          Filesize

          493B

          MD5

          1c53c2d567ba6050d9a23d86cfba84cc

          SHA1

          3bc38656cadf574c377ec39733ebce9e8de75138

          SHA256

          81f5372b0875476184f7c4d04eb4c805706e41bd979a9acd1f1d55105e17e530

          SHA512

          3ed2dd645af7d3bd0026a253ac2c5a0503b04f88629012dd479d8068a8e6c07a916350f8ce54c0e21faf97b27a9e607eafe86edd28976b168914e3379bf272df

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\resources\ux\pass.png

          Filesize

          1KB

          MD5

          5a7499645619886bfe949250e1807415

          SHA1

          152295cf08fcf1e21e26f05969cbb02bd22a8af6

          SHA256

          db27bad6e59128d58031706c83210ae780a9261e01af6fde6323bd30f7a97b12

          SHA512

          201fc4fa1aa035cf09872d6f335d94c97433b79af343d532d0dd5c6ab6ba60b5a3a3b60f466e2c7107c19e04ffcdfa8a016842b4f29ea3ee6dd3d60304d8d8dc

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\wimgapi.dll

          Filesize

          544KB

          MD5

          04e7f9ff0c778aa2faed949f8247d5ab

          SHA1

          e5cefd98d48e87df2d6076047c399959f446031f

          SHA256

          346f01ab2b03d12201551302ce65d9bec6bbe2bd4fb33efed53b3c387141a11c

          SHA512

          8070e88bf93d6b1ee905265626406f19b8a94be808879ff06a1d99011f3c826b24603fa41829c288855001f9a773d932749a3e8751444434171cfbdbee93bb9f

        • C:\Users\Admin\AppData\Local\Temp\WXUAB96.tmp\windlp.dll

          Filesize

          894KB

          MD5

          e7337572ea254aeb42122959fcd5f58f

          SHA1

          79572a5cab6274ebc871ed603f31ad360b8cb81c

          SHA256

          0a695c89f9009c5462c13b5d40a65f849da703a320b2c46aee41e62eecaf5e02

          SHA512

          89c9db0564350a7e7bcdee0122a2fa0b639c85d18b5f991dfa438745b1dbf8b7f6fe10ceb26d9d12d2b0aa5eba91b18fe3b5b52b1ee22b5b7a4aa558463eb5e5

        • C:\Users\Admin\AppData\Local\Temp\Windows10UpgradeVersion.txt

          Filesize

          14B

          MD5

          b0148e6864dd056a75e1ac4ffa744c93

          SHA1

          dc27113b9da8673eddc65796696a0a0968f32ca8

          SHA256

          fbab2f3d224dc1aec3f23c7f969f87844b2e7e2bb267e257c391dabb02f6b4cd

          SHA512

          ae84e4702868c3b614a81517c39acb3c0922e680c39d176835c68eb3d5c2d3ed99b9732f2a5e13187ff78cb840eabbb2f38ba2f294db4163ebd5e0009cba996a

        • C:\Windows10Upgrade\Configuration.ini

          Filesize

          27B

          MD5

          ca22263c7a6f965df18f5c601f5db7ce

          SHA1

          e4b1a401ed497523a583ae8613646b03778a33a6

          SHA256

          299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c

          SHA512

          3cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8

        • C:\Windows10Upgrade\Configuration.ini

          Filesize

          40B

          MD5

          51ddd33b146cc550591608dfd8bd5852

          SHA1

          5f3c2e218369bbe6ea3302348cb6f79df1b1b744

          SHA256

          1dbee252f9d0765ad4203577e0c7d67678f4406f94f60fa2b6b5a2a642ecc649

          SHA512

          4d25994b063dc6662d90f7c75199f66c695968f258afb80007a7d4700019211f6045e3834b7c34de93659b965bb4ce6b229c1db57b9dd5d4ec7c9555e653af51

        • C:\Windows10Upgrade\Downloader.dll

          Filesize

          207KB

          MD5

          1326de2d29a53697c0ae274b05a90f69

          SHA1

          ebad0bb520631339f2a213da626527d452e4e1fc

          SHA256

          9e70d0bda80b060213d2c5d255d6b98016657d67f065bfd85042143a1171cc71

          SHA512

          ec0e1c9c48480b98206796865b6dc9583468fee9eb5dfa92e1648c4fb732f4996743108719e4e501372ebbfc090f2401501dcbca821c9d509b4303539fe02425

        • C:\Windows10Upgrade\Windows10UpgraderApp.exe

          Filesize

          1.9MB

          MD5

          895aca91dfc5e44feb233039d52aaea4

          SHA1

          5b6455fa89344bddb68180fadf2fff4ba484383d

          SHA256

          7a269ee93427bb9cf8f0059140958d6cdc0eeafcff92cff35f7fef753fd06075

          SHA512

          eeaf389e144403439ba5271816bba2cc98b5653f9ff1ce1bf82b0f0c26853bd8d3f1690c86bd20aa3205278e10007103f73ce767f0154c0a410a9ceba561bb01

        • C:\Windows10Upgrade\Windows10UpgraderApp.exe

          Filesize

          1.9MB

          MD5

          895aca91dfc5e44feb233039d52aaea4

          SHA1

          5b6455fa89344bddb68180fadf2fff4ba484383d

          SHA256

          7a269ee93427bb9cf8f0059140958d6cdc0eeafcff92cff35f7fef753fd06075

          SHA512

          eeaf389e144403439ba5271816bba2cc98b5653f9ff1ce1bf82b0f0c26853bd8d3f1690c86bd20aa3205278e10007103f73ce767f0154c0a410a9ceba561bb01

        • C:\Windows10Upgrade\Windows10UpgraderApp.exe

          Filesize

          1.9MB

          MD5

          895aca91dfc5e44feb233039d52aaea4

          SHA1

          5b6455fa89344bddb68180fadf2fff4ba484383d

          SHA256

          7a269ee93427bb9cf8f0059140958d6cdc0eeafcff92cff35f7fef753fd06075

          SHA512

          eeaf389e144403439ba5271816bba2cc98b5653f9ff1ce1bf82b0f0c26853bd8d3f1690c86bd20aa3205278e10007103f73ce767f0154c0a410a9ceba561bb01

        • C:\Windows10Upgrade\downloader.dll

          Filesize

          207KB

          MD5

          1326de2d29a53697c0ae274b05a90f69

          SHA1

          ebad0bb520631339f2a213da626527d452e4e1fc

          SHA256

          9e70d0bda80b060213d2c5d255d6b98016657d67f065bfd85042143a1171cc71

          SHA512

          ec0e1c9c48480b98206796865b6dc9583468fee9eb5dfa92e1648c4fb732f4996743108719e4e501372ebbfc090f2401501dcbca821c9d509b4303539fe02425

        • C:\Windows10Upgrade\resources\ux\EULA.css

          Filesize

          82B

          MD5

          b81d1e97c529ac3d7f5a699afce27080

          SHA1

          0a981264db289afd71695b4d6849672187e8120f

          SHA256

          35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

          SHA512

          e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

        • C:\Windows10Upgrade\resources\ux\EULA\EULA_en-us.htm

          Filesize

          57KB

          MD5

          7c109a8b0471d8e9e30cc79e6cb5924e

          SHA1

          f29901be4eadee321d2054a95b95cc6bb0d8d05f

          SHA256

          4d57b34f6a5b7f54222a4660985dfbd0085aec044d304c33d3f45bd51a5a4b38

          SHA512

          55fe987593b5536b0aad4f0d2e762464a76e1102e42b5cc1c86e0324158dd15f93125bff756243d4c511395bf1f5762c81c35940d59cea0dff84215560044e0d

        • C:\Windows10Upgrade\resources\ux\bullet.png

          Filesize

          221B

          MD5

          baaa93b2584336c8e2fd561ccaab5391

          SHA1

          0523f0a835781e2f499f166d405bcdaf48c89a3a

          SHA256

          d548b0a3da3f8aa61aa880b2af3ba7997304253d763de1b8b1e3906b9adb5363

          SHA512

          7ca20ee57a778ed02a1771a9b622aa7b0859cee55036ec323e00e0ab1f6be4defad45bd48aab62f54645fa13c3d49b30fd68c0318e3d83465b42e20d05f6c391

        • C:\Windows10Upgrade\resources\ux\default.css

          Filesize

          5KB

          MD5

          75dc1deb03880b98eea8c7aaa0290c48

          SHA1

          37e8ff2edb6a606c8455f2cef8d34e87c4ce22e0

          SHA256

          e5d182eb14246c3551bec763bfea90aaacb1338c3a41316502d4204eead79900

          SHA512

          09e2554785bf6494f64f6e0fe01ef048d8ed7ff9a6d88e9c490fb6815f934bb677880e8176b9131e037133840f96f157be7d226907fdc37142e7eee3f0f61125

        • C:\Windows10Upgrade\resources\ux\default.htm

          Filesize

          60KB

          MD5

          c2ae355a35fa5b9a521f47258a96275f

          SHA1

          f462df90222f164831345dd371fa5a60e16ebdcb

          SHA256

          702ce5c74e48ceebe13fe074df8f98a4ed6198a593b1fbaaa13fe726581f5fd7

          SHA512

          737cf240b4ea31e5c9b3788c3e7fc7b18a4efa902a5f0eb69237e5482b7ec336eb8cc1ae631ed54ae99bf4f34e2f1abb7188d089ea37bb22dd7541d79924aa45

        • C:\Windows10Upgrade\resources\ux\loading.gif

          Filesize

          16KB

          MD5

          1a276cb116bdece96adf8e32c4af4fee

          SHA1

          6bc30738fcd0c04370436f4d3340d460d25b788f

          SHA256

          9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

          SHA512

          5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

        • C:\Windows10Upgrade\resources\ux\logo.png

          Filesize

          2KB

          MD5

          afeed45df4d74d93c260a86e71e09102

          SHA1

          2cc520e3d23f6b371c288645649a482a5db7ccd9

          SHA256

          f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

          SHA512

          778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

        • C:\Windows10Upgrade\resources\ux\marketing.png

          Filesize

          493B

          MD5

          1c53c2d567ba6050d9a23d86cfba84cc

          SHA1

          3bc38656cadf574c377ec39733ebce9e8de75138

          SHA256

          81f5372b0875476184f7c4d04eb4c805706e41bd979a9acd1f1d55105e17e530

          SHA512

          3ed2dd645af7d3bd0026a253ac2c5a0503b04f88629012dd479d8068a8e6c07a916350f8ce54c0e21faf97b27a9e607eafe86edd28976b168914e3379bf272df