| Artifact | Typical Value / Indicator | |----------|----------------------------| | boot.wim index | 1 or 2 (WinPE) | | version.txt inside WIM | 10.0.19042.985 (modified) | | Custom winpeshl.ini | Launches explorer.exe + custom tools | | Added directory | \Program Files\BobombsTools\ | | Registry changes | HKLM\SYSTEM\Setup\SystemSetupInProgress set to 0 to allow installation of unsigned .inf | | Network profiles | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles pre-filled | | Unattend.xml | Often contains admin password hashes (weak: bobomb or password ) |
Once loaded, you will be in a Windows 10 environment with a suite of utilities: bobombs modified win10pex64 v4985 patched