b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
Size

14.0MB
MD5

07c12f253c2eb528a7ce50a45459b56d
SHA1

f26bd6e51fe41a1dbf5e25a0b5e7131f2cc2fe64
SHA256

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2
SHA512

e9fd384857a4b5b85415087479d76e1681104440de2f5ab0b381e1e2f9487e455fbe511c657abf6ab9e8d1c29916ebe80531b1df6fea62ee619040778ba8a9f0
SSDEEP

196608:bOLauYdxpOWdSOE2phiZ0/wONHLDrd6TYPQo8V+8Cs6cpqVVymDdh+yESGIqDMaL:CLBYdS6SUhQcwALDMXnIVnECatIZW

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

Executes dropped EXE 9 IoCs

Processes:

wimlib.EXEQiibiosinfo.exeQiibiosinfo.exeQiibiosinfo.exeQiiPECMD.execxdir.execxdir.execxdir.execxdir.exe

pid process

1660 wimlib.EXE
992 Qiibiosinfo.exe
2944 Qiibiosinfo.exe
2900 Qiibiosinfo.exe
1488 QiiPECMD.exe
1948 cxdir.exe
920 cxdir.exe
1632 cxdir.exe
1640 cxdir.exe

pid	process
1660	wimlib.EXE
992	Qiibiosinfo.exe
2944	Qiibiosinfo.exe
2900	Qiibiosinfo.exe
1488	QiiPECMD.exe
1948	cxdir.exe
920	cxdir.exe
1632	cxdir.exe
1640	cxdir.exe

Loads dropped DLL 18 IoCs

Processes:

cmd.exewimlib.EXEb23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.execmd.execmd.execmd.execmd.execmd.execmd.exe

pid	process
2180	cmd.exe
2180	cmd.exe
1660	wimlib.EXE
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
576	cmd.exe
2108	cmd.exe
960	cmd.exe
960	cmd.exe
2516	cmd.exe
908	cmd.exe
1720	cmd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Temp\UjyQii\Qiibiosinfo.exe	upx
behavioral1/memory/992-179-0x000000013FBB0000-0x0000000141405000-memory.dmp	upx
behavioral1/memory/992-178-0x000000013FBB0000-0x0000000141405000-memory.dmp	upx
behavioral1/memory/2944-182-0x000000013FEA0000-0x00000001416F5000-memory.dmp	upx
behavioral1/memory/2900-185-0x000000013F4F0000-0x0000000140D45000-memory.dmp	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exeQiiPECMD.exe

description	ioc	process
File opened (read-only)	\??\H:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\S:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\X:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\Z:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\T:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\U:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\E:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\G:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\I:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\M:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\O:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\Q:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\R:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\V:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\A:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\B:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\J:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\K:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\P:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\W:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\L:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\N:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\Y:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\F:	QiiPECMD.exe

Modifies boot configuration data using bcdedit 1 IoCs

Processes:

bcdedit.exe

pid process

2572 bcdedit.exe

pid	process
2572	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

cxdir.execxdir.execxdir.execxdir.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid process

480
480
480
480
480
480

pid	process
480
480
480
480
480
480

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

wimlib.EXEQiibiosinfo.exeQiibiosinfo.exeQiibiosinfo.exeQiiPECMD.exe

description	pid	process
Token: SeBackupPrivilege	1660	wimlib.EXE
Token: SeSecurityPrivilege	1660	wimlib.EXE
Token: SeRestorePrivilege	1660	wimlib.EXE
Token: SeSecurityPrivilege	1660	wimlib.EXE
Token: SeTakeOwnershipPrivilege	1660	wimlib.EXE
Token: SeManageVolumePrivilege	1660	wimlib.EXE
Token: SeSystemEnvironmentPrivilege	992	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	2944	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	2900	Qiibiosinfo.exe
Token: SeBackupPrivilege	1488	QiiPECMD.exe
Token: SeRestorePrivilege	1488	QiiPECMD.exe
Token: 33	1488	QiiPECMD.exe
Token: SeIncBasePriorityPrivilege	1488	QiiPECMD.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe

pid	process
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2208 wrote to memory of 2852	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2852	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2852	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2852	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2852 wrote to memory of 2572	2852	cmd.exe	bcdedit.exe
PID 2852 wrote to memory of 2572	2852	cmd.exe	bcdedit.exe
PID 2852 wrote to memory of 2572	2852	cmd.exe	bcdedit.exe
PID 2852 wrote to memory of 2572	2852	cmd.exe	bcdedit.exe
PID 2208 wrote to memory of 2180	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2180	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2180	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2180	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2180 wrote to memory of 1660	2180	cmd.exe	wimlib.EXE
PID 2180 wrote to memory of 1660	2180	cmd.exe	wimlib.EXE
PID 2180 wrote to memory of 1660	2180	cmd.exe	wimlib.EXE
PID 2180 wrote to memory of 1660	2180	cmd.exe	wimlib.EXE
PID 2208 wrote to memory of 576	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 576	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 576	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 576	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 576 wrote to memory of 992	576	cmd.exe	Qiibiosinfo.exe
PID 576 wrote to memory of 992	576	cmd.exe	Qiibiosinfo.exe
PID 576 wrote to memory of 992	576	cmd.exe	Qiibiosinfo.exe
PID 576 wrote to memory of 992	576	cmd.exe	Qiibiosinfo.exe
PID 2208 wrote to memory of 1692	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 1692	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 1692	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 1692	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 1692 wrote to memory of 2944	1692	cmd.exe	Qiibiosinfo.exe
PID 1692 wrote to memory of 2944	1692	cmd.exe	Qiibiosinfo.exe
PID 1692 wrote to memory of 2944	1692	cmd.exe	Qiibiosinfo.exe
PID 1692 wrote to memory of 2944	1692	cmd.exe	Qiibiosinfo.exe
PID 2208 wrote to memory of 840	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 840	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 840	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 840	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 840 wrote to memory of 2900	840	cmd.exe	Qiibiosinfo.exe
PID 840 wrote to memory of 2900	840	cmd.exe	Qiibiosinfo.exe
PID 840 wrote to memory of 2900	840	cmd.exe	Qiibiosinfo.exe
PID 840 wrote to memory of 2900	840	cmd.exe	Qiibiosinfo.exe
PID 2208 wrote to memory of 2108	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2108	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2108	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2108	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2108 wrote to memory of 1488	2108	cmd.exe	QiiPECMD.exe
PID 2108 wrote to memory of 1488	2108	cmd.exe	QiiPECMD.exe
PID 2108 wrote to memory of 1488	2108	cmd.exe	QiiPECMD.exe
PID 2108 wrote to memory of 1488	2108	cmd.exe	QiiPECMD.exe
PID 2208 wrote to memory of 960	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 960	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 960	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 960	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 960 wrote to memory of 1948	960	cmd.exe	cxdir.exe
PID 960 wrote to memory of 1948	960	cmd.exe	cxdir.exe
PID 960 wrote to memory of 1948	960	cmd.exe	cxdir.exe
PID 960 wrote to memory of 1948	960	cmd.exe	cxdir.exe
PID 2208 wrote to memory of 2516	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2516	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2516	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2208 wrote to memory of 2516	2208	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2516 wrote to memory of 920	2516	cmd.exe	cxdir.exe
PID 2516 wrote to memory of 920	2516	cmd.exe	cxdir.exe
PID 2516 wrote to memory of 920	2516	cmd.exe	cxdir.exe
PID 2516 wrote to memory of 920	2516	cmd.exe	cxdir.exe

C:\Users\Admin\AppData\Local\Temp\b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
"C:\Users\Admin\AppData\Local\Temp\b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Windows\sysnative\bcdedit.exe /enum {current}
2⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\system32\bcdedit.exe
C:\Windows\sysnative\bcdedit.exe /enum {current}
3⤵
- Modifies boot configuration data using bcdedit
PID:2572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismcjksh\
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180

C:\Temp\UjyQii\wimlib.EXE
C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismcjksh\
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576

C:\Temp\UjyQii\Qiibiosinfo.exe
C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --uefi
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Temp\UjyQii\Qiibiosinfo.exe
C:\Temp\UjyQii\\Qiibiosinfo.exe --uefi
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
2⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Temp\UjyQii\Qiibiosinfo.exe
C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108

C:\Temp\UjyQii\QiiPECMD.exe
C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960

C:\Temp\UjyQii\cxdir.exe
C:\Temp\UjyQii\\cxdir.exe -mohong
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516

C:\Temp\UjyQii\cxdir.exe
C:\Temp\UjyQii\\cxdir.exe -mohong
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
2⤵
- Loads dropped DLL
PID:908

C:\Temp\UjyQii\cxdir.exe
C:\Temp\UjyQii\\cxdir.exe -mohong
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
2⤵
- Loads dropped DLL
PID:1720

C:\Temp\UjyQii\cxdir.exe
C:\Temp\UjyQii\\cxdir.exe -mohong
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\UjyQii\HwRwDrvx64.sys
Filesize
22KB

MD5
d89dc4c1ccfa3553b5c92770251cf2f1

SHA1
15ec7bbf464b705441acf3bf3e4f49382cc18119

SHA256
3331af898ebe81cde9903f9f2f4dbf56f2684230ef01ef6f5cf59ad28b63c214

SHA512
b54db8d2af103fe250ab6eb7231eb7f6c3cbf2fdf696e090cea9846594db7aab580ffa4f876f9b80f13e0acd8e9dff57edbc766067e9f131486b153d785a9f60

Download Submit
C:\Temp\UjyQii\QiiPECMD.exe
Filesize
1.3MB

MD5
d644f12f9a642f3fe5dcbf315ec9094a

SHA1
c01eb2b8be44d6711c9af10ca7cc6c4310aed34c

SHA256
4dcc19a5d571c5fe1e0f2e5b9134815200220a86535282f242789146fde3706f

SHA512
f7d0f6fb7f6ad8f405083250a6530c60a624a4cd734ae53240d6789d7b9e740209e226f8821745f592895fcb14f89fc97aeabd3388beb1a60165117aedbfdcef

Download Submit
C:\Temp\UjyQii\Qiibiosinfo.exe
Filesize
314KB

MD5
fac53f717a9cd5109ee0d96feeca2408

SHA1
31b0c7eeea65a23bac3631daefd2ba60fbcb6ce9

SHA256
b4aee8bcbf7df15080872eead1421f24b31ff358f10fe216ecf395814ad1c2fe

SHA512
6225e37e812de3d77e1a5867f95095200c4a621026995b3874d7ee9d0c4719fe17f6e27a025655dc866db935c98206d64c0e2bd0565fb76fd976a5abdb0d262c

Download Submit
C:\Temp\UjyQii\config.dll
Filesize
258B

MD5
4350db50102c53cb755715a28f2f6e41

SHA1
9a9c45635aa6a9bae103250d925b80e0e2ef746a

SHA256
12527cf2a5166135af342153671ee70aab2d683fbb601dc0c686de122758d3a9

SHA512
610f2315fd3930412aa78cde43f2fe9530e58b2f5679e5afd90b150af167bd424744a25a21e7c876666dbef783b17ae0a29ea80a04a99ab00b65fb497dc0f6dc

Download Submit
C:\Temp\UjyQii\cxdir.exe
Filesize
42KB

MD5
2aa80509e9840822a3b6799a356efe90

SHA1
3dc558c97b209c91b7b45f90624f80c05c9094d0

SHA256
301ccb6e3f8a5118d7882963715e215140f0b7528039cab3fcd7ace02a48da0d

SHA512
9d4e5f95ef444424857e55c345d56ac679005a0bdfddf59fb96f078a5913e7be5ba07cd16993878815dc9d2364d909f20d8b7d65b09bd2ec687622f5812c6bc2

Download Submit
C:\Temp\UjyQii\dism.wim
Filesize
3.1MB

MD5
cd6a67b7fa1958f0b6879009f38c3e3b

SHA1
f92f534dd6c7ba3d9edd7bec292d0a489afbe50c

SHA256
14e348aa7e8dcd4094993102a09e8309ea8f327d57febd73034b19f792cf6090

SHA512
225fc4d92976cc1236db77215a36a3a1977ac396c8146cd54a5984569483d3c96d6f345c07d961b5318d4d1dd85b1a7096cd091b2e5bce3a5cdbb774604109b8

Download Submit
C:\Temp\UjyQii\libwim-15.dll
Filesize
471KB

MD5
e00fa5e9967055c31a62410fa4a758a2

SHA1
334b69f34bb6eb3c4dcd4a3a5ff570642b672ef6

SHA256
b8f1f4a0a74bf2b009dcfa8854fd9146cd061ad39b78da24abbed5d9396759f0

SHA512
1f0db54b043da9749bda9902b71d9755d6b425856874a00f4005bc0d1ec09c99bd4d84321944ac20f04a0708afaf38f2b67256c06892828781655c7c92052458

Download Submit
C:\Temp\UjyQii\wimlib.EXE
Filesize
136KB

MD5
c297992a7e8a207508fe30c71bf2691c

SHA1
bdbf4936b0450cbaeb679f79bcbd1e719e13f813

SHA256
a2fabc32d5c405c013e29d5b5f553067aeed6896098945e490726269f415d1a2

SHA512
9662eee3563be1b9da683353b6b57091f96bce339d8732f1b9031867ac1ec5dbbc939f8adf297afd5c786347eecb5f801766a0f52edafb5e5c47803b87b58299

Download Submit
\Temp\UjyQii\QiiImagex.EXE
Filesize
845KB

MD5
dcd13e8935cd5a235d6d3124fc9d8bc2

SHA1
41426a7d1c5932ac6853186e41797f94c043e7dc

SHA256
3d68842a89267810e4fbfa73e57d4a6519ae3269190c066cfab3e7650542465e

SHA512
c06569b6080161d26776cda16aadcb5b8c5038b1809d57bc5c6c016710736368ab4f658c6d7b71fbfafb945b045d69c5f89592b537a048458622e521da1f7c5e

Download Submit
\Temp\UjyQii\dismcjksh\X64\dism.exe
Filesize
329KB

MD5
f350e791f2ed95fb4a6fc50a0ea32b37

SHA1
472a3de24cd10913354798d51082d20fb166b2b1

SHA256
3c63ddb1e3f10ad6aa96ad7e35a080495e32cd748dbdbc0460f3f93beeee6b7f

SHA512
4b50aa71bec1aea7e18bd6b4c930942f513e2e8f55e7de217e5f7e19e0363f8f202dd75c9efb4a9b3f5046a90315a99614595ca13fffc4b3c80f9e2a44f5f51b

Download Submit
memory/576-177-0x0000000002310000-0x0000000003B65000-memory.dmp

Filesize
24.3MB

Download
memory/920-196-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/992-209-0x000000013FBB0000-0x0000000141405000-memory.dmp

Filesize
24.3MB

Download
memory/992-179-0x000000013FBB0000-0x0000000141405000-memory.dmp

Filesize
24.3MB

Download
memory/992-178-0x000000013FBB0000-0x0000000141405000-memory.dmp

Filesize
24.3MB

Download
memory/1632-199-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1640-202-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1660-127-0x000007FEF7730000-0x000007FEF77CF000-memory.dmp

Filesize
636KB

Download
memory/1660-126-0x000000013F780000-0x000000013F7AA000-memory.dmp

Filesize
168KB

Download
memory/1948-193-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2208-0-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2208-4-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2208-2-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2208-207-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2208-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2208-212-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2900-185-0x000000013F4F0000-0x0000000140D45000-memory.dmp

Filesize
24.3MB

Download
memory/2944-182-0x000000013FEA0000-0x00000001416F5000-memory.dmp

Filesize
24.3MB

Download