Resubmissions

26/03/2024, 16:24

240326-twshjahb5y 10

26/03/2024, 16:14

240326-tpnwrsdh78 8

Analysis

  • max time kernel
    201s
  • max time network
    211s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26/03/2024, 16:14

General

  • Target

    Windows10Upgrade9252.exe

  • Size

    3.2MB

  • MD5

    c0b25def4312fbddbcc4f01c6c0f5ba6

  • SHA1

    8d16a183d61233e7d6b6af7b3cafc6645ac2acb1

  • SHA256

    c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79

  • SHA512

    8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e

  • SSDEEP

    98304:GgjXlctych4cCzJ8k2omX8sUf0ht5f/LyXtcH/:JjKtych9CzJqXM32jyX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
      "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4356
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 1860
        3⤵
        • Program crash
        PID:2628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4356 -ip 4356
    1⤵
      PID:344
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://java.com/
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:844
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcfb6c3cb8,0x7ffcfb6c3cc8,0x7ffcfb6c3cd8
        2⤵
          PID:2804
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
          2⤵
            PID:2184
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:660
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
            2⤵
              PID:3464
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:4188
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                2⤵
                  PID:652
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4748
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
                  2⤵
                    PID:3344
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
                    2⤵
                      PID:1332
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                      2⤵
                        PID:280
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1148
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
                        2⤵
                          PID:3888
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7984227933555269764,10021694063458683883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
                          2⤵
                            PID:4056
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3848
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:420

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

                              Filesize

                              27B

                              MD5

                              ca22263c7a6f965df18f5c601f5db7ce

                              SHA1

                              e4b1a401ed497523a583ae8613646b03778a33a6

                              SHA256

                              299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c

                              SHA512

                              3cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8

                            • C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

                              Filesize

                              368KB

                              MD5

                              c6e416d0abe48eeaa038b3875ab93b06

                              SHA1

                              d2a49e6a50984f0cf36ffcce7c3c782e27cc7247

                              SHA256

                              6e5d556725b784999ee6b718bd7078f243790d3d6a085b766082b938d2ebd308

                              SHA512

                              d35ebd510c1a818b749e1d45f15002a208c0f3f4b70314518aff8efed1d21a8fd1267f905ec3cfbd345a64d25b1dfa7bfbb0d5fb62fe313c3ddf7661745c7030

                            • C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

                              Filesize

                              3.5MB

                              MD5

                              ab38a78503d8ad3ce7d69f937d71a99c

                              SHA1

                              00b6a6f09dd45e356ef9e2cacd554c728313fa99

                              SHA256

                              f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782

                              SHA512

                              fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

                            • C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll

                              Filesize

                              197KB

                              MD5

                              5b62ad6ae42f32806062ad1bcb3e2de5

                              SHA1

                              8d4a543eac9643931fcb620cd588e2cc1067920a

                              SHA256

                              96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3

                              SHA512

                              af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf

                            • C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css

                              Filesize

                              82B

                              MD5

                              b81d1e97c529ac3d7f5a699afce27080

                              SHA1

                              0a981264db289afd71695b4d6849672187e8120f

                              SHA256

                              35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

                              SHA512

                              e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

                            • C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css

                              Filesize

                              5KB

                              MD5

                              7f5fcac447cc2150ac90020f8dc8c98b

                              SHA1

                              5710398d65fba59bd91d603fc340bf2a101df40a

                              SHA256

                              453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850

                              SHA512

                              b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff

                            • C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm

                              Filesize

                              60KB

                              MD5

                              b2a06af2867a2bb3d4b198a22f7936b3

                              SHA1

                              98a28e15abdd2d6989d667cc578bf6ab954c29f5

                              SHA256

                              40f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23

                              SHA512

                              eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5

                            • C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif

                              Filesize

                              16KB

                              MD5

                              1a276cb116bdece96adf8e32c4af4fee

                              SHA1

                              6bc30738fcd0c04370436f4d3340d460d25b788f

                              SHA256

                              9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

                              SHA512

                              5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

                            • C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png

                              Filesize

                              2KB

                              MD5

                              afeed45df4d74d93c260a86e71e09102

                              SHA1

                              2cc520e3d23f6b371c288645649a482a5db7ccd9

                              SHA256

                              f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

                              SHA512

                              778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

                            • C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png

                              Filesize

                              420B

                              MD5

                              0968430a52f9f877d83ef2b46b107631

                              SHA1

                              c1436477b4ee1ee0b0c81c9036eb228e4038b376

                              SHA256

                              b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96

                              SHA512

                              7a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              0e10a8550dceecf34b33a98b85d5fa0b

                              SHA1

                              357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

                              SHA256

                              5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

                              SHA512

                              fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              3b1e59e67b947d63336fe9c8a1a5cebc

                              SHA1

                              5dc7146555c05d8eb1c9680b1b5c98537dd19b91

                              SHA256

                              7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

                              SHA512

                              2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              696B

                              MD5

                              c22fe3573b38b5ffb020aef936428d82

                              SHA1

                              8644862b6e5d03f58a5f6df815d9cee15b29bef0

                              SHA256

                              63aa2ba2d242578640981d44ec27e269ba912e247df4a6e054a9df12f86d9b79

                              SHA512

                              7aadd5497a05ecc6781110416853b242f5391922e15a82e33d28a586b23e3ffcb2f0a738b376f2fe91f5c2f7e661f2c004690345214c3f0c016340122199e242

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              285252a2f6327d41eab203dc2f402c67

                              SHA1

                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                              SHA256

                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                              SHA512

                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              577B

                              MD5

                              a36e8e61046232463b4d771a564c8875

                              SHA1

                              3e8ee1a329433fe3451f4b12ce2890dfc6e63bf7

                              SHA256

                              1fa797759c5e02547f24fad71872ffab0461ca296bd1c06f3d113df9f30c8011

                              SHA512

                              f530a831b96e6e0b955db24114abb8e070e6e4a534aaddfa86b17a68405a0ea247569c70c113da843089b1e807da0d03c4aa1dfc5c63d5dbdcc667b3728f5ca1

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              dcd154c582751b43e2aaca75526da71f

                              SHA1

                              e0685b835b4782e7e7f3d574394fffd0a2bf4913

                              SHA256

                              9ff2e33808aacb7d27198112440cbe6f76c9f5ee3109f658d2f7de16268afe6a

                              SHA512

                              1413c0d29507eef791f23b1e6d3f4abce2b26ab111d6374aafb564bf3582fa2f05f0b30e7ba531704e60d13630541d028f1631c1412458027c2a35735732feb3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              ea1ad392d29b4e17783c0f3ddb480c15

                              SHA1

                              32a9819136f25e5c4f1fc0e3d6fcf7b98f4657ac

                              SHA256

                              4f3e857005d780d2f395d87e31117c5d8eeb6abbd7ab7436b91effb5339fe6d3

                              SHA512

                              31f94f65bc5a4c7a6e1cea14c59fb39c90f91627b467b83952015aedf9e445621e01343ccf2fbdfb9639bc12b0a29989d0f5475d0878dab850ae05631348c1a4

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              d695a6e6095ff379d110053f29379ff8

                              SHA1

                              0ce71b52b79b3383663f96bfdd696f9f77daa1f6

                              SHA256

                              e8d34949fc423470957a8fc477389ff146cac41082c4743cf0a3fb298c17c767

                              SHA512

                              b5e7f2785b69e6b14baa94089578ad9892df2d2f552528a177b9fb0706e22a1609789de658f5dbc67dac868c2466ad518400c356e3be7a0d42b56e6e18a24ae6

                            • C:\Users\Admin\AppData\Local\Temp\WXU5D72.tmp\appraiserxp.dll

                              Filesize

                              363KB

                              MD5

                              cbb270591c9a1bfb1b10559ab672f705

                              SHA1

                              fed0d59d60709b5b05b9d31030ea7a5422767a7e

                              SHA256

                              770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f

                              SHA512

                              67c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a

                            • C:\Users\Admin\AppData\Local\Temp\WXU5D72.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css

                              Filesize

                              39KB

                              MD5

                              5ad8ceea06e280b9b42e1b8df4b8b407

                              SHA1

                              693ea7ac3f9fed186e0165e7667d2c41376c5d61

                              SHA256

                              03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb

                              SHA512

                              1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84