b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
Size

14.0MB
MD5

07c12f253c2eb528a7ce50a45459b56d
SHA1

f26bd6e51fe41a1dbf5e25a0b5e7131f2cc2fe64
SHA256

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2
SHA512

e9fd384857a4b5b85415087479d76e1681104440de2f5ab0b381e1e2f9487e455fbe511c657abf6ab9e8d1c29916ebe80531b1df6fea62ee619040778ba8a9f0
SSDEEP

196608:bOLauYdxpOWdSOE2phiZ0/wONHLDrd6TYPQo8V+8Cs6cpqVVymDdh+yESGIqDMaL:CLBYdS6SUhQcwALDMXnIVnECatIZW

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

Processes:

wimlib.EXEQiibiosinfo.exeQiibiosinfo.exeQiibiosinfo.exeQiiPECMD.execxdir.execxdir.execxdir.execxdir.exewimlib.EXE

pid	process
2216	wimlib.EXE
2356	Qiibiosinfo.exe
3788	Qiibiosinfo.exe
4976	Qiibiosinfo.exe
3004	QiiPECMD.exe
4316	cxdir.exe
4536	cxdir.exe
4840	cxdir.exe
5072	cxdir.exe
3108	wimlib.EXE

Loads dropped DLL 2 IoCs

Processes:

wimlib.EXEwimlib.EXE

pid process

2216 wimlib.EXE
3108 wimlib.EXE

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Temp\UjyQii\Qiibiosinfo.exe	upx
behavioral2/memory/2356-173-0x00007FF615810000-0x00007FF617065000-memory.dmp	upx
behavioral2/memory/2356-172-0x00007FF615810000-0x00007FF617065000-memory.dmp	upx
behavioral2/memory/3788-176-0x00007FF615810000-0x00007FF617065000-memory.dmp	upx
behavioral2/memory/3788-175-0x00007FF615810000-0x00007FF617065000-memory.dmp	upx
behavioral2/memory/4976-178-0x00007FF615810000-0x00007FF617065000-memory.dmp	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exeQiiPECMD.exe

description	ioc	process
File opened (read-only)	\??\V:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\W:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\Y:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\Z:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\B:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\H:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\I:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\P:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\F:	QiiPECMD.exe
File opened (read-only)	\??\A:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\J:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\K:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\S:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\T:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\U:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\X:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\G:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\N:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\O:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\Q:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\E:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\L:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\M:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
File opened (read-only)	\??\R:	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

cxdir.execxdir.execxdir.execxdir.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

652
652
652
652
652

pid	process
652
652
652
652
652

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

wimlib.EXEQiibiosinfo.exeQiibiosinfo.exeQiibiosinfo.exeQiiPECMD.exewimlib.EXE

description	pid	process
Token: SeBackupPrivilege	2216	wimlib.EXE
Token: SeSecurityPrivilege	2216	wimlib.EXE
Token: SeRestorePrivilege	2216	wimlib.EXE
Token: SeSecurityPrivilege	2216	wimlib.EXE
Token: SeTakeOwnershipPrivilege	2216	wimlib.EXE
Token: SeManageVolumePrivilege	2216	wimlib.EXE
Token: SeSystemEnvironmentPrivilege	2356	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	3788	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	4976	Qiibiosinfo.exe
Token: SeBackupPrivilege	3004	QiiPECMD.exe
Token: SeRestorePrivilege	3004	QiiPECMD.exe
Token: 33	3004	QiiPECMD.exe
Token: SeIncBasePriorityPrivilege	3004	QiiPECMD.exe
Token: SeBackupPrivilege	3108	wimlib.EXE
Token: SeSecurityPrivilege	3108	wimlib.EXE
Token: SeRestorePrivilege	3108	wimlib.EXE
Token: SeSecurityPrivilege	3108	wimlib.EXE
Token: SeTakeOwnershipPrivilege	3108	wimlib.EXE
Token: SeManageVolumePrivilege	3108	wimlib.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe

pid	process
2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2184 wrote to memory of 2676	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2676	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2676	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2676 wrote to memory of 2216	2676	cmd.exe	wimlib.EXE
PID 2676 wrote to memory of 2216	2676	cmd.exe	wimlib.EXE
PID 2184 wrote to memory of 3752	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 3752	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 3752	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 3752 wrote to memory of 2356	3752	cmd.exe	Qiibiosinfo.exe
PID 3752 wrote to memory of 2356	3752	cmd.exe	Qiibiosinfo.exe
PID 2184 wrote to memory of 4564	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 4564	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 4564	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 4564 wrote to memory of 3788	4564	cmd.exe	Qiibiosinfo.exe
PID 4564 wrote to memory of 3788	4564	cmd.exe	Qiibiosinfo.exe
PID 2184 wrote to memory of 2816	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2816	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2816	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2816 wrote to memory of 4976	2816	cmd.exe	Qiibiosinfo.exe
PID 2816 wrote to memory of 4976	2816	cmd.exe	Qiibiosinfo.exe
PID 2184 wrote to memory of 4500	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 4500	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 4500	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 4500 wrote to memory of 3004	4500	cmd.exe	QiiPECMD.exe
PID 4500 wrote to memory of 3004	4500	cmd.exe	QiiPECMD.exe
PID 2184 wrote to memory of 1072	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 1072	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 1072	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 1072 wrote to memory of 4316	1072	cmd.exe	cxdir.exe
PID 1072 wrote to memory of 4316	1072	cmd.exe	cxdir.exe
PID 2184 wrote to memory of 1340	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 1340	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 1340	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 1340 wrote to memory of 4536	1340	cmd.exe	cxdir.exe
PID 1340 wrote to memory of 4536	1340	cmd.exe	cxdir.exe
PID 2184 wrote to memory of 2448	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2448	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2448	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2448 wrote to memory of 4840	2448	cmd.exe	cxdir.exe
PID 2448 wrote to memory of 4840	2448	cmd.exe	cxdir.exe
PID 2184 wrote to memory of 4844	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 4844	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 4844	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 4844 wrote to memory of 5072	4844	cmd.exe	cxdir.exe
PID 4844 wrote to memory of 5072	4844	cmd.exe	cxdir.exe
PID 2184 wrote to memory of 2308	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2308	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2184 wrote to memory of 2308	2184	b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe	cmd.exe
PID 2308 wrote to memory of 3108	2308	cmd.exe	wimlib.EXE
PID 2308 wrote to memory of 3108	2308	cmd.exe	wimlib.EXE

C:\Users\Admin\AppData\Local\Temp\b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe
"C:\Users\Admin\AppData\Local\Temp\b23cb07410639298a3fbdd3d04872c97732c1949968903feabc9d6f8d6439af2.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismgywpc\
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Temp\UjyQii\wimlib.EXE
    C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismgywpc\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --uefi
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --uefi
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Temp\UjyQii\QiiPECMD.exe
    C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE info "C:\Recovery\WindowsRE\Winre.wim" --header
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Temp\UjyQii\wimlib.EXE
    C:\Temp\UjyQii\\wimlib.EXE info "C:\Recovery\WindowsRE\Winre.wim" --header
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\UjyQii\HwRwDrvx64.sys

Filesize
22KB

MD5
d89dc4c1ccfa3553b5c92770251cf2f1

SHA1
15ec7bbf464b705441acf3bf3e4f49382cc18119

SHA256
3331af898ebe81cde9903f9f2f4dbf56f2684230ef01ef6f5cf59ad28b63c214

SHA512
b54db8d2af103fe250ab6eb7231eb7f6c3cbf2fdf696e090cea9846594db7aab580ffa4f876f9b80f13e0acd8e9dff57edbc766067e9f131486b153d785a9f60

Download Submit
C:\Temp\UjyQii\QiiImagex.EXE

Filesize
845KB

MD5
dcd13e8935cd5a235d6d3124fc9d8bc2

SHA1
41426a7d1c5932ac6853186e41797f94c043e7dc

SHA256
3d68842a89267810e4fbfa73e57d4a6519ae3269190c066cfab3e7650542465e

SHA512
c06569b6080161d26776cda16aadcb5b8c5038b1809d57bc5c6c016710736368ab4f658c6d7b71fbfafb945b045d69c5f89592b537a048458622e521da1f7c5e

Download Submit
C:\Temp\UjyQii\QiiPECMD.exe

Filesize
1.3MB

MD5
d644f12f9a642f3fe5dcbf315ec9094a

SHA1
c01eb2b8be44d6711c9af10ca7cc6c4310aed34c

SHA256
4dcc19a5d571c5fe1e0f2e5b9134815200220a86535282f242789146fde3706f

SHA512
f7d0f6fb7f6ad8f405083250a6530c60a624a4cd734ae53240d6789d7b9e740209e226f8821745f592895fcb14f89fc97aeabd3388beb1a60165117aedbfdcef

Download Submit
C:\Temp\UjyQii\Qiibiosinfo.exe

Filesize
314KB

MD5
fac53f717a9cd5109ee0d96feeca2408

SHA1
31b0c7eeea65a23bac3631daefd2ba60fbcb6ce9

SHA256
b4aee8bcbf7df15080872eead1421f24b31ff358f10fe216ecf395814ad1c2fe

SHA512
6225e37e812de3d77e1a5867f95095200c4a621026995b3874d7ee9d0c4719fe17f6e27a025655dc866db935c98206d64c0e2bd0565fb76fd976a5abdb0d262c

Download Submit
C:\Temp\UjyQii\config.dll

Filesize
258B

MD5
4350db50102c53cb755715a28f2f6e41

SHA1
9a9c45635aa6a9bae103250d925b80e0e2ef746a

SHA256
12527cf2a5166135af342153671ee70aab2d683fbb601dc0c686de122758d3a9

SHA512
610f2315fd3930412aa78cde43f2fe9530e58b2f5679e5afd90b150af167bd424744a25a21e7c876666dbef783b17ae0a29ea80a04a99ab00b65fb497dc0f6dc

Download Submit
C:\Temp\UjyQii\cxdir.exe

Filesize
42KB

MD5
2aa80509e9840822a3b6799a356efe90

SHA1
3dc558c97b209c91b7b45f90624f80c05c9094d0

SHA256
301ccb6e3f8a5118d7882963715e215140f0b7528039cab3fcd7ace02a48da0d

SHA512
9d4e5f95ef444424857e55c345d56ac679005a0bdfddf59fb96f078a5913e7be5ba07cd16993878815dc9d2364d909f20d8b7d65b09bd2ec687622f5812c6bc2

Download Submit
C:\Temp\UjyQii\dism.wim

Filesize
3.1MB

MD5
cd6a67b7fa1958f0b6879009f38c3e3b

SHA1
f92f534dd6c7ba3d9edd7bec292d0a489afbe50c

SHA256
14e348aa7e8dcd4094993102a09e8309ea8f327d57febd73034b19f792cf6090

SHA512
225fc4d92976cc1236db77215a36a3a1977ac396c8146cd54a5984569483d3c96d6f345c07d961b5318d4d1dd85b1a7096cd091b2e5bce3a5cdbb774604109b8

Download Submit
C:\Temp\UjyQii\dismgywpc\X64\dism.exe

Filesize
329KB

MD5
f350e791f2ed95fb4a6fc50a0ea32b37

SHA1
472a3de24cd10913354798d51082d20fb166b2b1

SHA256
3c63ddb1e3f10ad6aa96ad7e35a080495e32cd748dbdbc0460f3f93beeee6b7f

SHA512
4b50aa71bec1aea7e18bd6b4c930942f513e2e8f55e7de217e5f7e19e0363f8f202dd75c9efb4a9b3f5046a90315a99614595ca13fffc4b3c80f9e2a44f5f51b

Download Submit
C:\Temp\UjyQii\libwim-15.dll

Filesize
471KB

MD5
e00fa5e9967055c31a62410fa4a758a2

SHA1
334b69f34bb6eb3c4dcd4a3a5ff570642b672ef6

SHA256
b8f1f4a0a74bf2b009dcfa8854fd9146cd061ad39b78da24abbed5d9396759f0

SHA512
1f0db54b043da9749bda9902b71d9755d6b425856874a00f4005bc0d1ec09c99bd4d84321944ac20f04a0708afaf38f2b67256c06892828781655c7c92052458

Download Submit
C:\Temp\UjyQii\wimlib.EXE

Filesize
136KB

MD5
c297992a7e8a207508fe30c71bf2691c

SHA1
bdbf4936b0450cbaeb679f79bcbd1e719e13f813

SHA256
a2fabc32d5c405c013e29d5b5f553067aeed6896098945e490726269f415d1a2

SHA512
9662eee3563be1b9da683353b6b57091f96bce339d8732f1b9031867ac1ec5dbbc939f8adf297afd5c786347eecb5f801766a0f52edafb5e5c47803b87b58299

Download Submit
memory/2184-6-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2184-5-0x00000000027B1000-0x00000000027B2000-memory.dmp

Filesize
4KB

Download
memory/2184-3-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2184-2-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2184-1-0x00000000027B1000-0x00000000027B2000-memory.dmp

Filesize
4KB

Download
memory/2184-201-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2184-196-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2184-0-0x0000000000400000-0x00000000027CC000-memory.dmp

Filesize
35.8MB

Download
memory/2216-127-0x00007FF65E300000-0x00007FF65E32A000-memory.dmp

Filesize
168KB

Download
memory/2216-128-0x00007FF8406D0000-0x00007FF84076F000-memory.dmp

Filesize
636KB

Download
memory/2356-173-0x00007FF615810000-0x00007FF617065000-memory.dmp

Filesize
24.3MB

Download
memory/2356-172-0x00007FF615810000-0x00007FF617065000-memory.dmp

Filesize
24.3MB

Download
memory/2356-203-0x00007FF615810000-0x00007FF617065000-memory.dmp

Filesize
24.3MB

Download
memory/3108-199-0x00007FF65E300000-0x00007FF65E32A000-memory.dmp

Filesize
168KB

Download
memory/3108-200-0x00007FF8406D0000-0x00007FF84076F000-memory.dmp

Filesize
636KB

Download
memory/3788-175-0x00007FF615810000-0x00007FF617065000-memory.dmp

Filesize
24.3MB

Download
memory/3788-176-0x00007FF615810000-0x00007FF617065000-memory.dmp

Filesize
24.3MB

Download
memory/4316-185-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4536-187-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4840-189-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4976-178-0x00007FF615810000-0x00007FF617065000-memory.dmp

Filesize
24.3MB

Download
memory/5072-191-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download