1bbdaab9c5cbae7dfb00697afde5aeaba7ba42c3fcf8fbfa5e719d15f1507d65

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Device/HarddiskVolume4/SB Laptop/SUKUMARANS BACKUP/C Drive/Downloads/Business-in-a-Box_Setup (1).exe
Size

727KB
MD5

5cee8fd584a087e48cfed410c1441ff8
SHA1

3d68443e8ed4d922973d6fd5b56dc9b03c68bfb2
SHA256

b1a37f81545b33e6f5a5ef513ee5c94fd3057fdf82d883ce642bf2423791913b
SHA512

43f644d6b4c84adf77f068f6892a82cd4b51ca4eaf13c5198dd24563f945ad166ae7714772d7ba3a1dd0ad9f1421e6f12b85ae296d9123931ca57b7cf5098a49
SSDEEP

12288:r1KuFgYd+X772hRixPc2s6G4ifpog70kea6A+D7CL/npu6BAisaxn0noSptA:r1vFI7yWPXsvrQVWn9u+deA

Score

7^/10

discovery evasion persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0002000000022a9f-21.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Business-in-a-Box_Setup (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	BIB.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
7560	adxregistrator.exe
8264	BIBLauncher.exe
8668	BIB.exe
6156	BIBLauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
1088	regsvr32.exe
7260	regsvr32.exe
7312	regsvr32.exe
7396	regsvr32.exe
7560	adxregistrator.exe
7560	adxregistrator.exe
7560	adxregistrator.exe
7560	adxregistrator.exe
7560	adxregistrator.exe
7560	adxregistrator.exe
7560	adxregistrator.exe
7560	adxregistrator.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7576	RegAsm.exe
7576	RegAsm.exe
7576	RegAsm.exe
7576	RegAsm.exe
7528	RegAsm.exe
7528	RegAsm.exe
7528	RegAsm.exe
7528	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7600	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
7652	RegAsm.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BIBLauncher = "C:\\Program Files (x86)\\Business-in-a-Box 2019\\BIBLauncher.exe"	Business-in-a-Box_Setup (1).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	adxregistrator.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4028-0-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-1-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-5-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-13-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-18-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/files/0x0002000000022a9f-21.dat	upx
behavioral2/memory/4028-24-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4028-4556-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-4567-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4028-5133-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-5136-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4028-9850-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4028-9849-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-9948-0x0000000000710000-0x000000000088D000-memory.dmp	upx
behavioral2/memory/4028-9886-0x0000000000710000-0x000000000088D000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\es\DevExpress.XtraLayout.v18.1.resources.dll	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Affidavits\Affidavit_Petition for Dissolution.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Copyrights, Patents & Trademarks\Checklist_FAQ About Patents.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Operations & Logistics\Shipping Merchandise\Demand for Shipping Instructions.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Operations & Logistics\Receiving Merchandise\Request for Repair of Enclosed Merchandise.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Finance & Accounting\Guaranties & Collateral\Unlimited Guaranty.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\it\DevExpress.Mvvm.v18.1.DataModel.resources.dll	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\zh-CN\DevExpress.Spreadsheet.v18.1.Core.resources.dll	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\fr\DevExpress.XtraTreeList.v18.1.resources.dll	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Other Agreements\Pledge Agreement_Advance.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Finance & Accounting\Invoices & Billing\Sales Invoice - Excel.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Consultants & Contractors\Services Agreement_With Royalties or Commission.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Planning & Management\Procedures\How to Implement Customer Service Training.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Planning & Management\Board Resolutions\Board Resolution Approving Dissolution of Subsidiary.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Planning & Management\Starting a Business\Checklist_Start-Up.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Deeds\Deed Granting Easement.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Sales & Marketing\Customer Relations\Thank You for Payment After Phone Call.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Finance & Accounting\Debts & Default\Notice to Account Debtor of Assignment.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Finance & Accounting\Collection\Return of Late Payment and Denial of Discount.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Job Descriptions\Software Engineer Job Description.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Job Descriptions\Team Assembler Job Description.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\LanguageES.dll	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\Web\es\index.html	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Sales & Marketing\Customer Relations\Apology Regarding Inability to Submit Tender.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Policies & Documentation\Environmental Policy.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Internet & Technology\Web Development\Website Design Non-Disclosure Agreement.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Purchase & Sale Agreements\Agreement to Rescind Contract of Sale.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Operations & Logistics\Receiving Merchandise\Notice of Error in Shipment and Request for Return Authorization.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Copyrights, Patents & Trademarks\Trade Mark License_License Agreement_Long Form.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Surveys & Evaluations\Employee Complaint Form.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Purchase & Sale Agreements\Equipment Purchase Agreement.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Purchase & Sale Agreements\Option to Buy Agreement.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Sales & Marketing\Customer Relations\Spontaneous Good Customer Relations Letter.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Sales & Marketing\Customer Service\You Are Absolutely Right - You Owe Us Nothing.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\pt\DevExpress.Mvvm.v18.1.DataModel.resources.dll	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Internet & Technology\Website Notices & Checklists\Online Sales Disclaimer.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Real Estate\Other Agreements\Non-Disturbance Agreement.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Policies & Documentation\Sick Pay Policy.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Internet & Technology\Web Development\Checklist_Drafting Web Site Development Agreements.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Policies & Documentation\Dress Code Policy.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Partnership Agreements\Limited Partnership Agreement_Long Form.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Purchase & Sale Agreements\Share Purchase Agreement_Deemed Dividend.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Planning & Management\Board Resolutions\Board Resolution Establishing Performance Committee.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\License Agreements\Consent to Sub-License.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Planning & Management\Procedures\How to Improve Customer Relationship.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Sales & Marketing\Sales Letters\Letter Announcing New Product.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Planning & Management\Shareholders\Pre-Incorporation Designation of Directors.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\AddinExpress.WD.2005.dll	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\es\DevExpress.XtraSpreadsheet.v18.1.resources.dll	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Firing & Termination\Acknowledgment Of Obligations.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Confidentiality Agreements\Non-Disclosure and Non-Compete Agreement.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Operations & Logistics\Ordering Merchandise\Notice to Suspend Deliveries and Request for Release.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Sales & Marketing\Purchase Orders & Price Quotes\Sales Invoice.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Legal\Power of Attorney\Unlimited Power of Attorney.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Finance & Accounting\Buying & Selling of Shares\Bill of Sale for Corporations.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Staff Management\Direct Deposit Enrollment Form.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Planning & Management\Last Will & Testament\Last Will and Testament - Single with No Children.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Insurance\Request Immediate Insurance Coverage for New Employee.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\DevExpress.XtraRichEdit.v18.1.dll	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Real Estate\Leasing Real Estate\Agreement to Lease.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Interview Guides\Interview Guide_Programmer Java.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Human Resources\Surveys & Evaluations\New Employee Survey.btd	Business-in-a-Box_Setup (1).exe
File opened for modification	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Operations & Logistics\Selling Merchandise\Notice to Stop Goods in Transit.btd	Business-in-a-Box_Setup (1).exe
File created	C:\Program Files (x86)\Business-in-a-Box 2019\ENGLISH\BTDoc\Operations & Logistics\Shipping Merchandise\Packing Slip.btd	Business-in-a-Box_Setup (1).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BIB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BIBLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adxregistrator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BIBLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Business-in-a-Box_Setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Business-in-a-Box_Setup (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Business-in-a-Box_Setup (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BIB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	BIB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BIB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Business-in-a-Box_Setup (1).exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0AC7E18F-CA91-3D22-B691-7757F6654DD4}\InprocServer32\1.0.10.0\Assembly = "OfficeToolbar, Version=1.0.10.0, Culture=neutral, PublicKeyToken=f8ad09678905b4f9"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0AC7E18F-CA91-3D22-B691-7757F6654DD4}\ProgId	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{647921B9-D708-420A-BF7C-8560FE47BFE8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D948611-4B2D-4191-AF37-F609FDFCF872}\ProgId	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{44712FAE-7535-3046-8503-71FD72BF3296}\1.0.5.0\Class = "AxSpreadHost.Language"	RegAsm.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA3D1D84-A4FF-429D-9413-28C5B1D98804}\InprocServer32\1.0.10.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EAD78454-E582-40AB-B105-B207F323D362}\InprocServer32	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EAD78454-E582-40AB-B105-B207F323D362}\InprocServer32\1.0.5.0\Assembly = "AxSpreadHost, Version=1.0.5.0, Culture=neutral, PublicKeyToken=02fc447205b935b4"	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A1E6805-EF6E-3C45-B5FE-E5C99BA29214}\Implemented Categories	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E108A229-E8CF-300D-90AE-D248AB2E2C0A}\InprocServer32\1.0.10.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D7638-704C-4418-A0DF-989034239411}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04625B32-BB05-4550-B53A-EE5216E33DAC}\TypeLib\ = "{85CA4BB8-3B1E-4E59-B671-73E248539570}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA3D1D84-A4FF-429D-9413-28C5B1D98804}\Implemented Categories	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EA1B835-13CB-39B7-8151-234243200973}\InprocServer32\Class = "OfficeToolbar.SearchPaneDataContextSource"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADC60E9C-A87D-3513-9454-43F2B7FE7DFE}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EAD78454-E582-40AB-B105-B207F323D362}\InprocServer32\Assembly = "AxSpreadHost, Version=1.0.5.0, Culture=neutral, PublicKeyToken=02fc447205b935b4"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADC60E9C-A87D-3513-9454-43F2B7FE7DFE}\InprocServer32\1.0.10.0\CodeBase = "file:///C:/Program Files (x86)/Business-in-a-Box 2019/OfficeToolbar/OfficeToolbar.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E108A229-E8CF-300D-90AE-D248AB2E2C0A}\ = "OfficeToolbar.ContentItem"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{067E785A-7888-3D40-B010-F6712DE08457}\ProgId\ = "OfficeToolbar.UpgradeDialogContentArea"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7FCD897-ECAD-4AE6-BA28-2F1454207D6E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D948611-4B2D-4191-AF37-F609FDFCF872}\InprocServer32\ThreadingModel = "Both"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2DB9472-981F-3FA3-9618-AB92E3C70B60}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OfficeToolbar.ADXWordTaskPaneSearch	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E108A229-E8CF-300D-90AE-D248AB2E2C0A}\InprocServer32\1.0.10.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37187728-1E2B-4386-8E10-D45B676968B9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{949B9134-455A-4B57-9D68-F5871B8B7B86}\TypeLib\ = "{85CA4BB8-3B1E-4E59-B671-73E248539570}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.btd\shell	Business-in-a-Box_Setup (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F3ADB5F-AD81-4E91-A8D8-6B551D8F3CF1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA3D1D84-A4FF-429D-9413-28C5B1D98804}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2DB9472-981F-3FA3-9618-AB92E3C70B60}\ProgId\ = "OfficeToolbar.ADXExcelTaskPaneSearch"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5ED03CE-020E-3D17-99CD-2225024FCF97}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EA1B835-13CB-39B7-8151-234243200973}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82CB42AC-F2A8-41F3-8B9F-53574848725C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74D2D613-D6EC-3469-BD12-0B8DB79AB755}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A1E6805-EF6E-3C45-B5FE-E5C99BA29214}\InprocServer32\1.0.10.0\Assembly = "OfficeToolbar, Version=1.0.10.0, Culture=neutral, PublicKeyToken=f8ad09678905b4f9"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F2D7638-704C-4418-A0DF-989034239411}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A1E6805-EF6E-3C45-B5FE-E5C99BA29214}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6363639D-0054-3331-B07A-F2EE84A585B9}\InprocServer32\Assembly = "OfficeToolbar, Version=1.0.10.0, Culture=neutral, PublicKeyToken=f8ad09678905b4f9"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EF91550-0620-397E-82BF-A2FFE247CEF2}\InprocServer32\Class = "OfficeToolbar.ADXExcelTaskPaneBrowse"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37187727-1E2B-4386-8E10-D45B676968B9}\MiscStatus\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA3D1D84-A4FF-429D-9413-28C5B1D98804}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74D2D613-D6EC-3469-BD12-0B8DB79AB755}\ProgId\ = "OfficeToolbar.BrowseContentContainer"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OfficeToolbar.ADXExcelTaskPaneBrowse	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{067E785A-7888-3D40-B010-F6712DE08457}\InprocServer32\Assembly = "OfficeToolbar, Version=1.0.10.0, Culture=neutral, PublicKeyToken=f8ad09678905b4f9"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37187726-1E2B-4386-8E10-D45B676968B9}\TypeLib\Version = "2.9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C5AA94-651D-4658-AFDE-95DB755A40AD}\ = "IBTRPCServer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA3D1D84-A4FF-429D-9413-28C5B1D98804}\InprocServer32\ = "C:\\Program Files (x86)\\Business-in-a-Box 2019\\OfficeToolbar\\adxloader.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADC60E9C-A87D-3513-9454-43F2B7FE7DFE}\InprocServer32\1.0.10.0\Class = "OfficeToolbar.DialogDataContextSource"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7FCD897-ECAD-4AE6-BA28-2F1454207D6E}\ProxyStubClsid32\ = "{7F2D7638-704C-4418-A0DF-989034239411}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A817E7A2-43FA-11D0-9E44-00AA00B6770A}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D46E213D-30B2-35E0-8A4B-E5E530C7DEB6}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5ED03CE-020E-3D17-99CD-2225024FCF97}\Implemented Categories	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D46E213D-30B2-35E0-8A4B-E5E530C7DEB6}\InprocServer32\1.0.10.0\Class = "OfficeToolbar.ADXWordTaskPaneSearch"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{067E785A-7888-3D40-B010-F6712DE08457}\ProgId\ = "OfficeToolbar.UpgradeDialogContentArea"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F65877A-9CBC-455D-B154-AE09C130402C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5EF91550-0620-397E-82BF-A2FFE247CEF2}\InprocServer32\1.0.10.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OfficeToolbar.ADXExcelTaskPaneSearch\CLSID\ = "{A2DB9472-981F-3FA3-9618-AB92E3C70B60}"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{44712FAE-7535-3046-8503-71FD72BF3296}	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BizTree_DSOFramer.FramerControl\CLSID\ = "{37187727-1E2B-4386-8E10-D45B676968B9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F2D7638-704C-4418-A0DF-989034239411}\ProxyStubClsid32\ = "{7F2D7638-704C-4418-A0DF-989034239411}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA3D1D84-A4FF-429D-9413-28C5B1D98804}\InprocServer32\1.0.10.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74D2D613-D6EC-3469-BD12-0B8DB79AB755}\ProgId\ = "OfficeToolbar.BrowseContentContainer"	adxregistrator.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
220	msedge.exe
220	msedge.exe
4824	msedge.exe
4824	msedge.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
5384	identity_helper.exe
5384	identity_helper.exe
6156	BIBLauncher.exe
6156	BIBLauncher.exe
6156	BIBLauncher.exe
6156	BIBLauncher.exe
6156	BIBLauncher.exe
6156	BIBLauncher.exe
8668	BIB.exe
8668	BIB.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	Business-in-a-Box_Setup (1).exe
Token: SeDebugPrivilege	4028	Business-in-a-Box_Setup (1).exe
Token: SeDebugPrivilege	7560	adxregistrator.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
8264	BIBLauncher.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
8264	BIBLauncher.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
4028	Business-in-a-Box_Setup (1).exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8668	BIB.exe
8264	BIBLauncher.exe
8264	BIBLauncher.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
6156	BIBLauncher.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe
8668	BIB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4824	4028	Business-in-a-Box_Setup (1).exe	100
PID 4028 wrote to memory of 4824	4028	Business-in-a-Box_Setup (1).exe	100
PID 4824 wrote to memory of 2460	4824	msedge.exe	101
PID 4824 wrote to memory of 2460	4824	msedge.exe	101
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 4344	4824	msedge.exe	102
PID 4824 wrote to memory of 220	4824	msedge.exe	103
PID 4824 wrote to memory of 220	4824	msedge.exe	103
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104
PID 4824 wrote to memory of 3240	4824	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\SB Laptop\SUKUMARANS BACKUP\C Drive\Downloads\Business-in-a-Box_Setup (1).exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\SB Laptop\SUKUMARANS BACKUP\C Drive\Downloads\Business-in-a-Box_Setup (1).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.business-in-a-box.com/pages/en/try/thank-you/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffff1d46f8,0x7fffff1d4708,0x7fffff1d4718
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:8096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:8088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:8608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:8728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4682656198591878893,2475954205427385671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:6868
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\Business-in-a-Box 2019\btdsoframer.ocx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1088
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\Business-in-a-Box 2019\BIBSharedTools.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:7260
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\Business-in-a-Box 2019\BIBSharedTools64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7312
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\Business-in-a-Box 2019\BIBSharedTools64.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:7396
- C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\adxregistrator.exe
  "C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\adxregistrator.exe" /install="C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\OfficeToolbar.dll" /generateLogFile=true /logFileLocation="C:\ProgramData\Biztree\Business-in-a-Box\adxregistrator.log"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:7560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" AxSpell.dll /silent
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Interop.BIBSharedToolsLib.dll /silent
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" AxDocumentHost.dll /silent
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:7600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" AxSpreadHost.dll /silent
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:7652
- C:\Program Files (x86)\Business-in-a-Box 2019\BIBLauncher.exe
  "C:\Program Files (x86)\Business-in-a-Box 2019\BIBLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:8264
- C:\Program Files (x86)\Business-in-a-Box 2019\BIB.exe
  "C:\Program Files (x86)\Business-in-a-Box 2019\BIB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:8668
- - C:\Program Files (x86)\Business-in-a-Box 2019\BIBLauncher.exe
    "C:\Program Files (x86)\Business-in-a-Box 2019\BIBLauncher.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Business-in-a-Box 2019\BIB.exe

Filesize
17.7MB

MD5
03ecd802e5f402c742f9fbcd78197eea

SHA1
d155e936f92242aa485e18e92eaccc58ff4c9ac4

SHA256
bab70644b0e6debd2c51b78d708fc56aecaa5cd566280558e5e2c60848edc349

SHA512
b94d632e7a16bc9ef118a98ea715b2fc9b0f9a03c9bb0275825342cf85997cfc4d51ef6afb12bd6c235257afa3c517593d4928c8d2aa83f957b4b0ad7597fec4

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\BIBLauncher.exe

Filesize
2.7MB

MD5
a9fdaaa5e8985a378301bd7db64312d1

SHA1
c72acb8548617446d70143d0934c6b43494c8f11

SHA256
4a732d0f330e48aa50819e742350c55ed450449b1c92e7f849bc2edcdfbef51b

SHA512
269d8853a4defa18bec96554a33171b2bf8c5b2f26086390ed25dddd008b6e8fb4eb067c4152d163e752100fdd7cd6db5b854937e534caf09e73285d1f200c08

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\BIBSharedTools.dll

Filesize
1.8MB

MD5
dc80aba54f08fbd575f160e7cd6b24e7

SHA1
a782959dfe0b055a8327fa4160994a30adcb9f25

SHA256
f3cf17b96c1bacd008cf8da62b9dd3d728211f3eb0343afe6a7314a8aa91210a

SHA512
4d50d3e8a2f3f28e4b8fc44bca36595bfbe439db2e8c4f8a6ed31cfdb5d110ebb44682c19026b83ef42f146a84673e58af2c4625a809ebad31da0125b0126675

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\BIBSharedTools64.dll

Filesize
2.4MB

MD5
b1cdfa597e0090af75b03c5724e62a53

SHA1
bd108bb9e29d81c7f7b2a7f86bfdb62a9a8fe35e

SHA256
b828add0028e2302de6138bbf8366b57c6a3d8dee4c3e5d490054b3e181e1325

SHA512
8ece7dcbc2cf69164d1cb9cc785f2134c0255d9bfa840bc7825efbd8839e3bc3dc3a7f6039fa3e0e4662b4eb4ae35c1532e81207a29c75c2acb98a34217de2b5

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\BTDocEN.upd

Filesize
42.5MB

MD5
08808a4cc15ae19beb93bc9009ba997c

SHA1
b65ffc9ed73c90936da1d43bcca32ad1bdc6a3e1

SHA256
d65cc32835b127ddd3651423b8131a55770eaf37d4bc3cdf3197ee0d906f3bfa

SHA512
86523ddd6b3873635bbb870b8324d5bca7bf6332e4a4510fc3d1bba7d3daeb2539acc2a0d277ce83be8311fbc71275084d50748b9bdd596916c7bd80c527f438

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\AxDocumentHost.dll

Filesize
333KB

MD5
ada0aa58dc265f77e97a8b2d3b29d913

SHA1
5d389f41960503bac3175e90c500c3c8921025ab

SHA256
f933cd3b85b547d084e62a06d6068e1e4454152afee16ff7e6a3ba1fc321d23d

SHA512
38f33f7b7388585446cb7649c1e658312b855473f2f52295eaa80ace1a3d40960ed3356295ebdde6078549d43126234934b679d0c1964e59c87d5e35737e7d73

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\AxSpreadHost.dll

Filesize
370KB

MD5
52efd16eb7ecfb904a8b9d8f2f11e912

SHA1
63b92a5b6373d307c32a2029697b079eb7110820

SHA256
f69d25c8d3406cf821b8311ccecd6c599799b417e40e20691ed64c79439d87a1

SHA512
af450735ad22abef0d755d0928c6ac43499b8ed518d9e4a8d4086066cdbea01d15f3d7e28f36748a186039214a03c492a6bf16d9866079fbbc57066bfb1c1072

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
22043d46a5b843a0c2357021f8067f19

SHA1
e8d6c0f3c31a82bb9ae94b9f231422de03f6ef14

SHA256
a9cdca2a184c61f751d6d9e65cf4758c279cca6b020a25bd23a1fcf193f2e64c

SHA512
aaeb6e6b87da6c0bcf65962f448a26b6c5b23bbc0adddd775fe6a4a67ef4df141ef3d890f36579d3a2b52dbae1436008169acff64c0f0bec55940c797d242932

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
585099d834b5c70f819406f1d0c86b92

SHA1
fd6e7db7b36b76d9ac72558153c1839541426b2b

SHA256
097b15ac407faf3cfe2cbf993756808199a6f26508b1093cc5768035aba5d8c5

SHA512
26d044b9ba11a63f0520899f9476952a65eacb25d9959a86fc0b1ff10703989460f6dd6abae3cbdd525bdc31bffbcc6ad266412a7bbc57179a8b7254fe4c547e

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\DevExpress.XtraBars.v18.1.dll

Filesize
6.1MB

MD5
54b173202078bb304795d77746488276

SHA1
0c5d0e47befb3577e8518cd09a7e4cf849bb1418

SHA256
f9749aee57f67a1fc0d23d0935ca1604fd6a7663f35d836769bafe5d713f07a1

SHA512
2e8fddbfa3f5ec9b9ec49522ac93e5bfca1384cf82470c6e9892934f87729997bbd460d56e127eefc7a33f76ff098d647a517a78e968dc029590147ef89feb6c

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Frameworks\DevExpress.XtraEditors.v18.1.dll

Filesize
6.0MB

MD5
89c15cd0937a79f204bd49b5a7ae6fca

SHA1
ad01c640af360941136d3f3bcc8b4f8fe46d2c47

SHA256
81a737c5c491c5c69c5d8b9cc27ca30ee875bcaaaf620ed88d6cbc1b99ed7329

SHA512
afba1f20dde4dc5d5b98023bbcf61108a29360bcca65fcb5082e6c3cd7c0213cfe3d033d866d5b0c2fbf22ec3c72b4272d50ee51807d81b340caf90cae3053e0

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Installation.dll

Filesize
1.3MB

MD5
f8660621d5dce83823bf8b7dcd75c025

SHA1
ae6ad8d07f95fb13c17ccbcc7462a49ae85ee63f

SHA256
f3109013801aad5342a9a84e46a52665b308118e78ecd99f3bfb62d0d08857ef

SHA512
e9d60a98dd8674937572b162a36423bae5f0271bc3214cdd3f80863f21c135053407493febb1cdbdc97c0177ae50a63bd37ae3755a7ec8e59207dd9e3a3b28fb

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\AddinExpress.MSO.2005.dll

Filesize
4.1MB

MD5
83ca15331b56ec1ea0817c82dc78e6c7

SHA1
1d20a2d47194235ce03c1fcaebbf6836bb35be9c

SHA256
2488b3a307a297d6f7b349f625eebf8f44a6c2dedcbe3d316ecc87a4d434f35b

SHA512
c0ebb6b304ed2e7f3e4c8c500a5c6a178f4d1c1a12ab0074a3ab269fc499c2f81b8b063ae40070fad429652136a737254f9ceb7aeb4ff22bf737510c681c0be1

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\AddinExpress.WD.2005.dll

Filesize
675KB

MD5
caec156c63a16c4d27fb321703252c22

SHA1
d24fdd35ad7b67b0091dfb687319f166bf9df8cc

SHA256
433bb29fdd64da75a49d3f2de6eba6e5da8b55c0c5faad97fb96f79c6924cb6a

SHA512
aa113aa60d8e2ebb31ec2a29725f13d61ddb7811b530df5f7d960b5d0b55564a08f4673320cf7dd2fe7e42a8f52577a7505178769c5a29bb70a12f1e270ad637

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\AddinExpress.XL.2005.dll

Filesize
665KB

MD5
7153f189b36ba3e26195b7aaf5fb2dbe

SHA1
beec232734a30f3ce5be8da11f5e6d51f6f827f6

SHA256
a2a349ddbed4a413cc6e5b83c736febae5db58bbd4c40bef3628605207a59f80

SHA512
b9a469c46fa79c938dbdf72150ecc7548f7dd2c82fb13245a4820b242f21e9fe72a9f49e6f274668a929c9262b86286279b31835a458789c6544778f28103d9b

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\Interop.BIBSharedToolsLib.dll

Filesize
19KB

MD5
e2fd8d93e5840b810cac8f6d561532be

SHA1
2d89e0d716e500b8e89cb927ce6b0b2f113b907b

SHA256
d6c20cc4bf425def06ff0fa25ba0164f49c4436d7b10bb55e77e3d911d1c7196

SHA512
7734e44919b1a04a4b459c02d01de74ffe3992861de1fabe0c31510b010065f58f9a0e888fff1cf8b0a6902d5e9a93d1890f3cc77dbc3be1687eac57a870b273

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\OfficeToolbar.dll

Filesize
1.9MB

MD5
d6a25771bc32075325da8d0ef5cfee8b

SHA1
564979d4da0906eeaa444d2fd2f6b14c8d10be27

SHA256
635b7c3119ca14f189a76e5da2eb66327f2fc9b2e7ae596ac22c8bdea5a90ecf

SHA512
c05c76eae06e4d941eb475b079c2f2c958141162067935799a37b5aed2e0863894eb1adaa8ed8a676cd2d3460ba79f932aa06a70b28c047c59b42c931cb790f0

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\adxloader.dll.manifest

Filesize
285B

MD5
1a96ea8dd513fc2176eddd3e6f272328

SHA1
cae57bf853b792453debe862b22931c94fff2b83

SHA256
caa4a45dc90d63907045a40f765d2a5feb428cb65191bd5a297dfce28b664418

SHA512
9074f41c616ec3896addd6128bdf6d7f0effaf2c0590d33b9e9589b4166af972db6733dc269fff8e3db391ec61aeb0c93b2dbf839ee10f7aea13c2078c2c4ceb

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\OfficeToolbar\adxregistrator.exe

Filesize
167KB

MD5
1d6be4e749fef9bf18a0082ee05e5344

SHA1
5b89cc6788c741627b1bb1a8326301169ae65ac9

SHA256
80e99c9bd8ebf68900d62e076e683b09098c9be4ecbca90e1eb43251046f202f

SHA512
685ac60f731e32d64c9b38f57a1ae9c200a38d826651f698874afceef35b2476c17c1230d6777109439df1c2125854b317520980f117b653feb797b89303dc8e

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Spell\AxSpell.dll

Filesize
11KB

MD5
dc8303d6f1054382e450a750a1c24516

SHA1
5b621f205f3bc708b83d718a68eb58d2db632d8b

SHA256
b85459a48613597b2057a18a273089d1697af03578be830145c73ef37af05c1a

SHA512
472b74a98cf007d34b35f7edda08d11ce5182e25db1202c1be568cd5d7ddf0d4511b9ff719f10e8632c3384a04d45df8a58823aeb46e59254b268fd28b8f96fc

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\Web\en\index.html

Filesize
669B

MD5
03944dbfb9d6498fa4801c088206ca35

SHA1
566cf9a3cdc31186074de1c7f773463fbcb197d4

SHA256
a15aaa698f731b293e7a76e1bb3009dec48e20f625db9f1720cdafed22dec966

SHA512
efd6794544de6536814d3fd038ace404b7b8b42c364f548729c9a5c69cd8d92add4498250954623ffb40b04f2519a012d93bdeccf11850a7d1fb8a21cf6f9c66

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\btdsoframer.ocx

Filesize
277KB

MD5
f7b2c4538173ddbf512bd9303cfc76bb

SHA1
96d88fb62afdfa70013ab147331d80ffe4a76ad1

SHA256
7f739e8e682f66d5a484e72189e600d124830eee2d9a774570d5d12fa3134932

SHA512
3766ebcbcbb69709209ba74062b80ca6e2f9220e7a0307aa45f32fe71392c2963d078adcd58efbf652599102c257f7b61cfd46e466541a81c1c1d531f3493bf1

Download Submit
C:\Program Files (x86)\Business-in-a-Box 2019\unrar.dll

Filesize
75KB

MD5
98aa3d4a9ae300a839f36381a1790741

SHA1
7e7857688d71887209e9fc6710762ecfb99c6c69

SHA256
1ebf9d3625896a0a9133ce8e4e7ef2d2c217204df9ce178dbe69d009fddba2e2

SHA512
7feb67757140306c25779319a43f7448b57d418efdeb9f16f4b0c98403ca29cb3def506abd5f481bc4e4905dcab8712075c5207dfc30c562d21165299f81bc68

Download Submit
C:\ProgramData\Biztree\Business-in-a-Box\Libraries\ENGLISH\BTDoc\Legal\Incorporation\Limited Partnership Agreement 2.btd

Filesize
52KB

MD5
154fd44647365bf6983b3f7c5e5ec1ae

SHA1
1104f6b2cd556fe5d0b87b90bfa4d25a42df2ecc

SHA256
4f89f9a43af98ef67d0a13dd62aa3c19f07aa06f623f63418c40c27a28afd643

SHA512
014d94af66310f2de9be914f997df58ba345b9a21fb1500b11f6d6b154cf66b3d95d5a126520d56577cac7ffe5b5903f964337c49cf4664f7c7a2c2f13fcfb99

Download Submit
C:\ProgramData\Biztree\Business-in-a-Box\btdact.bl1

Filesize
1.0MB

MD5
189b4ed0bb46a10d89d557309061d8de

SHA1
31ce4f14e20da847b574626aeaf98662e56320f8

SHA256
60b5b86344d2439ffcbc03622f2c6977b5b1b3c257bfbe5309110ca17290ec61

SHA512
8f982abae1bd3f2caa301e019a3f4ab0f7400376d72a463e3e42e2b10e9962b838b8378abb5f05cb113595c8e8cad223ef94ebffef22fc93952bf0bb9f60de97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
07956ba7a80e4df09f53517510f196ea

SHA1
5411cc3c997d588e770d9937187f4d2f0942ff28

SHA256
edef46ff72ba822f080060d36e94844b422d079369fae0e7dfe537c12e6dfa89

SHA512
d39a7c7ce596307d5e8ad6750535e6f94cfc8a55c058f44aa7a403fe55bb424c9a7f47f31ba1b849a741cd2a4f08d0445b801e205ba1f079b2ec0771838e8577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cc6492f264c095274801c4f1387c903b

SHA1
5ea423e67ed2c71a646a507f05b22cfa0715c829

SHA256
39b01b927347fd22c429dfe548e6d305767c45ea75c64236803357a88b4f6089

SHA512
9206e887d70d9535608427ec5e30ce09e9c9a827a1f7653d37e608d7918b07ebfd8b5acb8e1d07fa226df2b58ce1fd72b902a629c8eb82969a7e67e1562c9a06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4efa029830bcdc834ba15c1e2e3ca043

SHA1
19e391d91099c4f8d9473354fdfaa4886781e584

SHA256
ca21f67b10d2733f2ad9b2b145a232d274d739aa9a648b7ace8eb8f1134e9edb

SHA512
96622d37015adab1e7a897b84e3e95d97d6be7093f561100582ea3adc5c61a4c83f77f12598d3a8c7e36c67bcd56a04b5bfa844cd6cedf628f420bec688721df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ddaa24871b8b05f261cdeaded2ddf7a

SHA1
87c454430765093514475d4f97b2325a29f869cb

SHA256
25827ec26340fe05a271013d44a51e94e3ee70cb8949fe9fdb892c2f22222bfc

SHA512
cda31b07395eaafbadffebb89a5dd1ccdf498eb406a05ef7dbb2391275f7dacc45798897026be1ae4cbc2507bb04e0d30208b86ef9ed5e0547172bde50249784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9a420f95174b47c52d94aa065a103b95

SHA1
c9315b11dddadb4867f2db7c38c4463e489ae1a2

SHA256
7427f6348cc849815179abee11113e737f8c51eaf1fb2058188c4aaf47b4e887

SHA512
a6eb6d5ac2dd0514792105ad02be18890c6016a2921b4a6fea3310f6eda6926826504fa5ad7bda9e3642ae6eed1b8231e1eca5568634fbada4557e61d94a0e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f96abcdc9255d58711cbb621cb33855f

SHA1
2da2ed987b8d4118b1578b4f7a3ede5c33e22b03

SHA256
dee8020368b89fbf65fbd8254de9f2007be525e16eb7cbef8ac2ea4f742957c0

SHA512
abcd148b937a2cfa78c31a5b7257ff0b8fae5c94491749cbef1b535e5757f46ffe0fff489d2e4d7e42834a8217e7d9a32ca109764fc9a4c1f118d1cf83257681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593cb1.TMP

Filesize
48B

MD5
9ac786dc86f595f6159cf74d39d2333b

SHA1
3e46282d3bc9d091f2cfce81d9eaf435ab0c33e7

SHA256
8d060671a7dfe04acd8d944f3451c8f03d908cab30c593a3df54bebd74c494d7

SHA512
8138e3229bde19beba08f7a9ef5a7d0152f760451f0b8f92fba98a1fc931e677d2658b88de14decd30690a09a03d09500c93172200d4d6244219a1f9b6170cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
2b8d7879c7b0a73127f86eaed0dbbc5b

SHA1
f742c8a6b9c1270e59d9d472fefc10d8999aabd7

SHA256
9d609e72698c9ad6bc89b22c65f402ad9edba1a781305030e073b539e160d283

SHA512
6e039731106502ba66869956c86fdff9e7c74d92d86441f290962135187e4d070326d2140421bd9f18c8edd228e08f32a969ff1b3ca3b01f1ec02c983cdf4c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590ff4.TMP

Filesize
203B

MD5
b48064eed8d6299bb79dd7591afc0918

SHA1
c586a3297e1293de8766b774c11bc86b11dae2ad

SHA256
222e2509bc967fad5a1c564e5583d91483a311d0f8b1196fd3b286e093cdb6bb

SHA512
5eaf94e966f84395de57d7e1d3ff47b0246a1779433dcfe753933e9d1a1af3acaeb9eba4e9802b1923bd619aa8e7bc94d8842440832862ccb116a4cb0980d913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RFe58d889.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e2dd0b6327e0d61b8ab4c4319e2f1fe9

SHA1
6cbd9c039ec07673c42ef5af202f704934b46461

SHA256
10272fa1c4a807c7e42ab33554d6d4797f543325c6dc8c4a2b6843bdde97fb37

SHA512
af5c35e4a31779f7dab94413b121c61a1a6dadec7a0f0ace2daf2e9dc1af6d7d57a81538ba66ceb3f97fe5d62507bef97125363501e8d31825969d0c913aa6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1e559c995629ea7fda62d264e715ba24

SHA1
845d544def18c7a1c54bdaf19ff214917fa3d24f

SHA256
2e605fabc562da804e39965e5a18907feddb3f4e2c4cdd5d1a376d46c1e49ec2

SHA512
19cd8a4b804afaefbf5eea0f1744c7fcf9d2df64a13692ae27fdeae38dbfcdab210e403cc491afa4106b9fd6fdfffee6fa7ede7235b4cbc407e167d82e0ab9bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\BTD2560.tmp

Filesize
16KB

MD5
0b8ee649332698151171b34ca6c38db4

SHA1
fd2a84b0dadba45d354818d2b72fa33e0e213b3d

SHA256
1c3e2f1a6ce495819704fe357c496edd3ae1ef16049848c650a79c0a678befa9

SHA512
5446b31ec49dd657fd11d8f4e5be28057f29bb00e2cd3d06c6e9988bf5c9a0d8c92eb90fe8d08afdc4e52ec038cd00f3854a32cae19811178abca1e57152fa9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2045521122-590294423-3465680274-1000\acfa1d9c932e6c1aa1ddeb0330c3edc5_896de533-e5fb-4eb9-8f2b-d363f3584dc5

Filesize
77B

MD5
c1b2c4b275cdd8fa39552fc95c02daaf

SHA1
346eb9910d8b16cc7a95831f137694d1cc2f69eb

SHA256
3f3674bb7f50dd140a3b24ae756b372f3410cdd6a9fb6a592cc9c7832ddfbb75

SHA512
dc18c2d2e12d61b68a6f7577166491d4e9ea08c68f8c268cbca85274f1f74a3f7b9975ec690937c4ae8bbce53250283793eebe6bc47b18e5a600272e9ac5d36b

Download Submit
memory/4028-9948-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-18-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-4567-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4028-9850-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4028-5133-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-4556-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4028-5136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4028-9886-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-13-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-1-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-0-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-9949-0x0000000000711000-0x00000000007D7000-memory.dmp

Filesize
792KB

Download
memory/4028-9849-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-5-0x0000000000710000-0x000000000088D000-memory.dmp

Filesize
1.5MB

Download
memory/4028-4-0x0000000000711000-0x00000000007D7000-memory.dmp

Filesize
792KB

Download
memory/4028-14-0x0000000000711000-0x00000000007D7000-memory.dmp

Filesize
792KB

Download
memory/7528-9817-0x0000000005650000-0x0000000005658000-memory.dmp

Filesize
32KB

Download
memory/7560-9107-0x0000000005AC0000-0x0000000006064000-memory.dmp

Filesize
5.6MB

Download
memory/7560-9306-0x00000000055F0000-0x0000000005682000-memory.dmp

Filesize
584KB

Download
memory/7560-9775-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/7560-8700-0x00000000050E0000-0x0000000005504000-memory.dmp

Filesize
4.1MB

Download
memory/7560-9788-0x0000000006260000-0x0000000006448000-memory.dmp

Filesize
1.9MB

Download
memory/7560-9796-0x0000000006070000-0x000000000611C000-memory.dmp

Filesize
688KB

Download
memory/7560-9792-0x00000000059E0000-0x0000000005A88000-memory.dmp

Filesize
672KB

Download
memory/7576-9811-0x0000000004CB0000-0x0000000004CBC000-memory.dmp

Filesize
48KB

Download
memory/7600-9826-0x0000000007CA0000-0x0000000008912000-memory.dmp

Filesize
12.4MB

Download
memory/7600-9836-0x0000000008920000-0x0000000008F86000-memory.dmp

Filesize
6.4MB

Download
memory/7600-9797-0x0000000000E30000-0x0000000000E42000-memory.dmp

Filesize
72KB

Download
memory/7600-9844-0x0000000007020000-0x0000000007626000-memory.dmp

Filesize
6.0MB

Download
memory/7600-9846-0x00000000063C0000-0x00000000065AC000-memory.dmp

Filesize
1.9MB

Download
memory/7600-9847-0x00000000065B0000-0x00000000067EC000-memory.dmp

Filesize
2.2MB

Download
memory/7600-9845-0x0000000008F90000-0x00000000095F6000-memory.dmp

Filesize
6.4MB

Download
memory/7600-9802-0x0000000005800000-0x0000000005854000-memory.dmp

Filesize
336KB

Download
memory/7600-9820-0x00000000069F0000-0x0000000007016000-memory.dmp

Filesize
6.1MB

Download
memory/7652-9851-0x0000000009AD0000-0x000000000A86C000-memory.dmp

Filesize
13.6MB

Download
memory/7652-9833-0x00000000055A0000-0x00000000055FE000-memory.dmp

Filesize
376KB

Download
memory/8668-9912-0x0000000076C40000-0x0000000076D1C000-memory.dmp

Filesize
880KB

Download
memory/8668-9917-0x0000000077640000-0x0000000077685000-memory.dmp

Filesize
276KB

Download
memory/8668-9896-0x0000000076B40000-0x0000000076C23000-memory.dmp

Filesize
908KB

Download
memory/8668-9895-0x0000000077640000-0x0000000077685000-memory.dmp

Filesize
276KB

Download
memory/8668-9881-0x00000000014BC000-0x0000000001D13000-memory.dmp

Filesize
8.3MB

Download
memory/8668-9893-0x0000000076150000-0x000000007620F000-memory.dmp

Filesize
764KB

Download
memory/8668-9892-0x0000000076C40000-0x0000000076D1C000-memory.dmp

Filesize
880KB

Download
memory/8668-9891-0x000000006F5B0000-0x000000006F738000-memory.dmp

Filesize
1.5MB

Download
memory/8668-9890-0x00000000763D0000-0x000000007644A000-memory.dmp

Filesize
488KB

Download
memory/8668-9889-0x000000006F960000-0x000000006F9B3000-memory.dmp

Filesize
332KB

Download
memory/8668-9887-0x0000000074A40000-0x0000000074AB4000-memory.dmp

Filesize
464KB

Download
memory/8668-9885-0x0000000075570000-0x0000000075780000-memory.dmp

Filesize
2.1MB

Download
memory/8668-9911-0x0000000075780000-0x000000007581F000-memory.dmp

Filesize
636KB

Download
memory/8668-9884-0x0000000074D20000-0x0000000074D92000-memory.dmp

Filesize
456KB

Download
memory/8668-9883-0x0000000077640000-0x0000000077685000-memory.dmp

Filesize
276KB

Download
memory/8668-9882-0x0000000075B60000-0x0000000076113000-memory.dmp

Filesize
5.7MB

Download
memory/8668-9894-0x0000000075B60000-0x0000000076113000-memory.dmp

Filesize
5.7MB

Download
memory/8668-9888-0x0000000075200000-0x00000000753A8000-memory.dmp

Filesize
1.7MB

Download
memory/8668-9879-0x00000000753B0000-0x00000000753DC000-memory.dmp

Filesize
176KB

Download
memory/8668-9878-0x00000000763D0000-0x000000007644A000-memory.dmp

Filesize
488KB

Download
memory/8668-9877-0x0000000075200000-0x00000000753A8000-memory.dmp

Filesize
1.7MB

Download
memory/8668-9876-0x0000000074D20000-0x0000000074D92000-memory.dmp

Filesize
456KB

Download
memory/8668-9875-0x00000000766D0000-0x00000000767CA000-memory.dmp

Filesize
1000KB

Download
memory/8668-9874-0x0000000076B40000-0x0000000076C23000-memory.dmp

Filesize
908KB

Download
memory/8668-9872-0x00000000014BC000-0x0000000001D13000-memory.dmp

Filesize
8.3MB

Download
memory/8668-9871-0x00000000763D0000-0x000000007644A000-memory.dmp

Filesize
488KB

Download
memory/8668-9898-0x00000000774D0000-0x0000000077533000-memory.dmp

Filesize
396KB

Download
memory/8668-9899-0x0000000075200000-0x00000000753A8000-memory.dmp

Filesize
1.7MB

Download
memory/8668-9910-0x000000006F5B0000-0x000000006F738000-memory.dmp

Filesize
1.5MB

Download
memory/8668-9914-0x00000000762F0000-0x0000000076365000-memory.dmp

Filesize
468KB

Download
memory/8668-9901-0x0000000073B30000-0x0000000073BF8000-memory.dmp

Filesize
800KB

Download
memory/8668-9915-0x0000000075A10000-0x0000000075ACF000-memory.dmp

Filesize
764KB

Download
memory/8668-9916-0x0000000075B60000-0x0000000076113000-memory.dmp

Filesize
5.7MB

Download
memory/8668-9897-0x0000000077540000-0x00000000775D6000-memory.dmp

Filesize
600KB

Download
memory/8668-9918-0x0000000076B40000-0x0000000076C23000-memory.dmp

Filesize
908KB

Download
memory/8668-9919-0x0000000077540000-0x00000000775D6000-memory.dmp

Filesize
600KB

Download
memory/8668-9902-0x000000006F9C0000-0x000000006F9E8000-memory.dmp

Filesize
160KB

Download
memory/8668-9920-0x00000000766D0000-0x00000000767CA000-memory.dmp

Filesize
1000KB

Download
memory/8668-9921-0x00000000774D0000-0x0000000077533000-memory.dmp

Filesize
396KB

Download
memory/8668-9922-0x0000000074D20000-0x0000000074D92000-memory.dmp

Filesize
456KB

Download
memory/8668-9923-0x0000000075570000-0x0000000075780000-memory.dmp

Filesize
2.1MB

Download
memory/8668-10291-0x000000000B280000-0x000000000B2C6000-memory.dmp

Filesize
280KB

Download
memory/8668-10292-0x000000000B3A0000-0x000000000B464000-memory.dmp

Filesize
784KB

Download
memory/8668-9924-0x0000000074A40000-0x0000000074AB4000-memory.dmp

Filesize
464KB

Download
memory/8668-10325-0x000000000CC80000-0x000000000CD90000-memory.dmp

Filesize
1.1MB

Download
memory/8668-10326-0x000000000E920000-0x000000000ED40000-memory.dmp

Filesize
4.1MB

Download
memory/8668-10329-0x000000000EE20000-0x000000000F174000-memory.dmp

Filesize
3.3MB

Download
memory/8668-10330-0x0000000010840000-0x0000000010D6C000-memory.dmp

Filesize
5.2MB

Download
memory/8668-9913-0x0000000076150000-0x000000007620F000-memory.dmp

Filesize
764KB

Download
memory/8668-10337-0x0000000011600000-0x0000000011620000-memory.dmp

Filesize
128KB

Download
memory/8668-10342-0x0000000010EF0000-0x0000000010F2E000-memory.dmp

Filesize
248KB

Download
memory/8668-10343-0x00000000117B0000-0x000000001189C000-memory.dmp

Filesize
944KB

Download
memory/8668-10344-0x0000000011A20000-0x0000000011BA0000-memory.dmp

Filesize
1.5MB

Download
memory/8668-10345-0x0000000012430000-0x0000000012886000-memory.dmp

Filesize
4.3MB

Download
memory/8668-10346-0x0000000011950000-0x00000000119FA000-memory.dmp

Filesize
680KB

Download
memory/8668-10347-0x0000000012D30000-0x00000000131CA000-memory.dmp

Filesize
4.6MB

Download
memory/8668-10348-0x0000000012A10000-0x0000000012B84000-memory.dmp

Filesize
1.5MB

Download
memory/8668-10349-0x0000000013580000-0x0000000013928000-memory.dmp

Filesize
3.7MB

Download
memory/8668-10350-0x0000000013490000-0x000000001356C000-memory.dmp

Filesize
880KB

Download
memory/8668-10351-0x0000000013E80000-0x0000000013F36000-memory.dmp

Filesize
728KB

Download
memory/8668-9900-0x00000000753E0000-0x0000000075549000-memory.dmp

Filesize
1.4MB

Download
memory/8668-9873-0x00000000014BC000-0x0000000001D13000-memory.dmp

Filesize
8.3MB

Download
memory/8668-9903-0x0000000074A30000-0x0000000074A3F000-memory.dmp

Filesize
60KB

Download
memory/8668-9904-0x00000000763D0000-0x000000007644A000-memory.dmp

Filesize
488KB

Download
memory/8668-9905-0x00000000753B0000-0x00000000753DC000-memory.dmp

Filesize
176KB

Download
memory/8668-9906-0x0000000076120000-0x0000000076145000-memory.dmp

Filesize
148KB

Download
memory/8668-9908-0x00000000014BC000-0x0000000001D13000-memory.dmp

Filesize
8.3MB

Download
memory/8668-9909-0x0000000077830000-0x0000000077950000-memory.dmp

Filesize
1.1MB

Download