40a6dfb2da3f160374c4c287d2b2e7657d151f5d9c1d73fd0f6682264a3b0872

Analysis

max time kernel
21s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

cvnwzmammv.exe
Size

316KB
MD5

f5e0962b8f5ba52bbec6f2b7f63a2bc1
SHA1

ef2437a8277565dc36ab2222d893849964eb863c
SHA256

5a520735eb6373fbb0a5e76d72b33dbb9514d7cfa3b7fb465a12bd9221ec27f3
SHA512

2c86bf5145efa719c54c33710db57a7ae1b8b4a51d3161f5ff09f6e62199ee6ac07e64f5ade3d9de576979ce588fa55984f0ce1a97d0a502a4fbf960ddf30450
SSDEEP

3072:GGmjllRDGTCzXCLA52mvVZKjzepmECnvwsC6m7Yl22wruUiLrf923F8GDsrXkd+Q:EjlnC6yQmzeAPv23

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cvnwzmammv.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4668	reg.exe
4800	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3316	AUDIODG.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 2092	788	cvnwzmammv.exe	92
PID 788 wrote to memory of 2092	788	cvnwzmammv.exe	92
PID 788 wrote to memory of 2092	788	cvnwzmammv.exe	92
PID 2092 wrote to memory of 4668	2092	cmd.exe	94
PID 2092 wrote to memory of 4668	2092	cmd.exe	94
PID 2092 wrote to memory of 4668	2092	cmd.exe	94
PID 788 wrote to memory of 4952	788	cvnwzmammv.exe	95
PID 788 wrote to memory of 4952	788	cvnwzmammv.exe	95
PID 788 wrote to memory of 4952	788	cvnwzmammv.exe	95
PID 4952 wrote to memory of 1544	4952	cmd.exe	97
PID 4952 wrote to memory of 1544	4952	cmd.exe	97
PID 4952 wrote to memory of 1544	4952	cmd.exe	97
PID 788 wrote to memory of 4056	788	cvnwzmammv.exe	98
PID 788 wrote to memory of 4056	788	cvnwzmammv.exe	98
PID 788 wrote to memory of 4056	788	cvnwzmammv.exe	98
PID 4056 wrote to memory of 4800	4056	cmd.exe	100
PID 4056 wrote to memory of 4800	4056	cmd.exe	100
PID 4056 wrote to memory of 4800	4056	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\cvnwzmammv.exe
"C:\Users\Admin\AppData\Local\Temp\cvnwzmammv.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start calc.exe
  2⤵
  PID:3824
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start notepad.exe
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start dxdiag.exe
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\dxdiag.exe
    dxdiag.exe
    3⤵
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start write.exe
  2⤵
  PID:372
- - C:\Windows\SysWOW64\write.exe
    write.exe
    3⤵
    PID:2012
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4528
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd.exe
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe
    3⤵
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start charmap.exe
  2⤵
  PID:3376
- - C:\Windows\SysWOW64\charmap.exe
    charmap.exe
    3⤵
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start taskmgr.exe
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\Taskmgr.exe
    taskmgr.exe
    3⤵
    PID:2356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start winver.exe
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\winver.exe
    winver.exe
    3⤵
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -r -t 65
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -t 65
    3⤵
    PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start mspaint.exe
  2⤵
  PID:920
- - C:\Windows\SysWOW64\mspaint.exe
    mspaint.exe
    3⤵
    PID:3384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start devmgmt.msc
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\devmgmt.msc"
    3⤵
    PID:520
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\devmgmt.msc" "C:\Windows\system32\devmgmt.msc"
      4⤵
      PID:3492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start control.exe
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\control.exe
    control.exe
    3⤵
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start mmc.exe
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\mmc.exe
    mmc.exe
    3⤵
    PID:1364
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      PID:2124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start calc.exe
  2⤵
  PID:948
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start notepad.exe
  2⤵
  PID:3864
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start dxdiag.exe
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\dxdiag.exe
    dxdiag.exe
    3⤵
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start write.exe
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\write.exe
    write.exe
    3⤵
    PID:2240
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd.exe
  2⤵
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe
    3⤵
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start charmap.exe
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\charmap.exe
    charmap.exe
    3⤵
    PID:2300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start taskmgr.exe
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\Taskmgr.exe
    taskmgr.exe
    3⤵
    PID:1184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start winver.exe
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\winver.exe
    winver.exe
    3⤵
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start mspaint.exe
  2⤵
  PID:164
- - C:\Windows\SysWOW64\mspaint.exe
    mspaint.exe
    3⤵
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start devmgmt.msc
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\devmgmt.msc"
    3⤵
    PID:2400
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\devmgmt.msc" "C:\Windows\system32\devmgmt.msc"
      4⤵
      PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start control.exe
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\control.exe
    control.exe
    3⤵
    PID:1340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:668

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3612

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa393a855 /state1:0x41c64e6d
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
27754e2db48bc95315a62b86fd981e5a

SHA1
1568ecdb144be9f8dbc488bc4944d89e31058ea5

SHA256
84560889fb3e1f4e9f6302d1a73d62c85e0f7544dcc1255328b8643a0bfcca09

SHA512
fc8bf7fe7489942015f32f2d93de1b3f3a07e08aaebc872e89e5c9c20a21449d9bb7e4576695c6c81411bdabd9a96f658f6cd4a1cc502d7045b9db8568c422f1

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
898e2dc5627fca3339fa505dd73dc02d

SHA1
e6a4ed424f18649249dd6b72671febc6addaef52

SHA256
fec2c951726037804b8a661f5bec92fc0444871a5d7d03671983cd9f663a6d2b

SHA512
26f79cae91b3d0901bf0329741d805e3355f87248cc85274bd873a8a080f36beb01c6a3587f6eb235177f5a749e972ccaf841377b249eecf0245c113365dcd09

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
2KB

MD5
9143d51d913a3bf6f93e634dd2f7c491

SHA1
b73d3625bcce7b5f113b451c2659fea78c37dbd4

SHA256
9719d2f3b7fc280b71853b6cf9147be2c0810bebb167d7642075c39f1b78c098

SHA512
934dce87da4cf0a7c82df0dbc633df1b4e639d0e0c5a26d2c3997c9a30cdad84574188265b6a6ddfd852e298f8cd5c6bb2bb045bfebd7a42215e5b66a1f9a1cf

Download Submit
C:\Windows\INF\PerceptionSimulationSixDof.PNF

Filesize
10KB

MD5
7c4564e93d5fcfcca17fdd7ee9012226

SHA1
c313ef1f240b1032b4f4f04aa26d7d1e45e0824c

SHA256
4eac10d44d8894ba56323844f8b41fdf4954e7238d19a71653d5f97a77dbd6d6

SHA512
c9c310d4fa7136585fd71d6a8feff355c6f70a06f4feb7dbb451b3a28bd9d4d79c25a2530ee934b840f32dca15f7b23415e9025c63f58a7d2aba188b3301a7f3

Download Submit
C:\Windows\INF\c_apo.PNF

Filesize
6KB

MD5
c1737a44bbce5ba5371dc5c626ab30e3

SHA1
61d9db45a4f14003a75d28d3c712e85677e51ea8

SHA256
cafc2aa766914e0b94f34b27f26c175c61a377259d80e5b1e47d605c350719c3

SHA512
f10f26d735e53a0e613ef19b497c845769e32370360259ef74bc4d24987b10ac51841cebdb7fff5633218dcbc38296ad844ea42c4f998e2799da426f3a1c1f95

Download Submit
C:\Windows\INF\c_barcodescanner.PNF

Filesize
3KB

MD5
4705549566d5f15cccae4d54209a4eed

SHA1
ad3986036ebf800fe196e0ee2a8ec609b57d1f34

SHA256
0c8dda91d03dbc25376b19a14de363158bf6790b0f99638dabba9e5ba26f808c

SHA512
49ecc489bb6ffa4f370011af3f21e6b553bd9b282820165c22148d22631e941827773b0e6b1f8c568334b6b10c40cf204b85d120721f87611ea1a650edc1ebca

Download Submit
C:\Windows\INF\c_camera.PNF

Filesize
8KB

MD5
b4062134f54c42f90be290523efe5174

SHA1
1fdb50704409184397a1bbb0f965b906e32bcf88

SHA256
e50728846730a0ee4f5e17104150f2d15ca122d94e77420447b9a718ca3b34c6

SHA512
76859697a3a74a51c95445d624467c149484be75abffa89d48b9ec5ef3d812ef5a2313b1c416ce4b12170cccccc8b4d245f44784198f63bb8a2e604f342838d7

Download Submit
C:\Windows\INF\c_cashdrawer.PNF

Filesize
3KB

MD5
d367cb126c7d82ed118fcf355093a924

SHA1
8df3f2559d34824102faca2641bf084bb2085f40

SHA256
5c5604d9f27ba337f665a9c236b25ef275ef7e47046b8980c314a4c3dfd56156

SHA512
cc87e2ca233b51e8e928e616a1c109c84f89c7def9c4218ff033eacd1563eb340d21f79459e187c692949fbcbb9abd04f5d4ab393b269e48d6cf1a774d6811c4

Download Submit
C:\Windows\INF\c_computeaccelerator.PNF

Filesize
4KB

MD5
029b924586a8ea0e787741b0e959e6f7

SHA1
c396955b0112df2fd5f31075463f798e5918eda0

SHA256
b026cdea022ee9af884570c19af28057ffc062f5d21ab460052bcbf9902e019e

SHA512
7a7c6fdb4f94fe25bec18abdfd7ecaef7ddca8e496d6c25fce96bd2a93752bdecea14e472bf6f2a75a8c031b4249ae62f9d1726dd688e611954057f79ac255ac

Download Submit
C:\Windows\INF\c_diskdrive.PNF

Filesize
6KB

MD5
20d57b33f9557fa1d063be139ea8b709

SHA1
4076937fa161a703f1dd6b5388c7efe8750f0a33

SHA256
aa1f20a2d24be61e17ed99d7ca1850f2d36cac11dae4022106687d36e959db9b

SHA512
9ff80e228a49cd87433ba5ebedea5748226aecdf2783fbdf43e4d5ef9f689bc4f06a0c1df692f213cf8f55bad5f7db4e77db0ac05d4043f6cf14e73f05e5764e

Download Submit
C:\Windows\INF\c_display.PNF

Filesize
8KB

MD5
716a1b21d16beae0405cc08d35d137cd

SHA1
a013a0d39efd59a831edfe5194dd182af25109aa

SHA256
e3170e44d159d924bd7884c4e0fd6b590ffd93b0ce2c1eebd0d68606039f7df5

SHA512
bf6664be664c1675b1038afe91d108a0d0f487f158cf6d0b183ab5ac5cf10836270c71687b69a220bd7ef8383bd2aa1cc9715edcedd4fde1735c7af50ac103f8

Download Submit
C:\Windows\INF\c_extension.PNF

Filesize
4KB

MD5
382c95811a522581c37bf597c79a3d58

SHA1
56a66e80d924c8e54a9a9227e748293bd3adefb7

SHA256
0814d6a5a07779f17c7c1172b74e1c9fc75c64194cd9cbc67f58f35a24077b29

SHA512
87bea4c2988d0754925a89623e1211e223f473a0130d0a5167998dd5b45566be633d49156252057896dce6144a197ba420eddfe0b49dd92cc19fb772b5f79ab2

Download Submit
C:\Windows\INF\c_firmware.PNF

Filesize
7KB

MD5
5474a1ee1ed9b913a55e5d7775cde5e9

SHA1
fc12f68e4a4d00a6e025e966741318c42aceece9

SHA256
dd4108bca23ff514d603c4697f6c1c1fdb0949f60828c943f40ec14fae40b220

SHA512
42896bb55c35d74d08231ece85a35a7fd553cb2936d77fda6893edcb425fe49ec02f6daf316043d1635514eebcc7ab08ee1153dbf156280fd2b5f38891181a53

Download Submit
C:\Windows\INF\c_fsactivitymonitor.PNF

Filesize
4KB

MD5
866728e21c696c8a4898710a4bc496ce

SHA1
297c96a9a31719382b7d61344e192986e5785deb

SHA256
8be1726cc7b63937477554216c86c1deb3d93b4e7fd1ec2353bfb19961b23fde

SHA512
260cc2b40efdcd0ba8314a12398ec955e24b3de7759aca297aeb4e76c3d07f9302e253e83e170fcdc9818b7532f28ba33dc16aa3d7db17fb4e7f813deac2625f

Download Submit
C:\Windows\INF\c_fsantivirus.PNF

Filesize
4KB

MD5
a0a8d285e2736eb8f36059880acf384f

SHA1
0921cacf9534368867d4e0cba7bd54b448bd38a0

SHA256
0655f8f6500ef42e12fb7eaa8509b57eb7b9a3b1d071d2c2f88be442c49e480c

SHA512
00ae9cec96765f35b88b9f4b482b3ac2d872745bbb76b739571b4c91d79749900fddb1f9e11ca6fdcf31043458316a7406237a5be82d8a0bf036ce6b44ee2628

Download Submit
C:\Windows\INF\c_fscfsmetadataserver.PNF

Filesize
4KB

MD5
4f3bb88e3d8c4d7cbced118264f44b60

SHA1
db4c5837dd59a658386fff37148cc61f23a5ac2c

SHA256
01a70d5137951f06a58857e1fc5f733d31612e74e4c5faea63a9455ee1eac7cd

SHA512
29c163923a7c2341a2e7b441db7f93281e1217c70804c94d66bef269ab9f177fa106d385c5c6291f392ad95d2a47950b46a7a74d24d2a0bd5e08909488e7b709

Download Submit
C:\Windows\INF\c_fscompression.PNF

Filesize
4KB

MD5
f13c762ddefd4de2b044b3488c55d633

SHA1
b2c44f9b899f9021218457a51f08df373ef9bab0

SHA256
542642ff609ec65b5d4ecfb12e03bcf4b7ea1bfc4e176ceef09ad87ebfc42677

SHA512
65a241d086d771873a0ed38d108f76e0d2abd58da3e5cc7246138d68e82ce881d0af925096ba5434eec1ba854bcbbe4877d3759efdc475168ae4cc8a1b25e9ad

Download Submit
C:\Windows\INF\c_fscontentscreener.PNF

Filesize
4KB

MD5
ae30cd132bafbddc34e2c241fa89cf78

SHA1
e4a77358961d2f98cde0b1f3ed08e34c41763a1b

SHA256
1a3f5c7dd11a67e640948cf3f5eb6ca1baaa94bbb458b29f06bf99ccd96aacac

SHA512
9fa0fffb70b02577335f9c1428dce46811ebb2feb3fca9291cb3746595a4690d9e1a70ffbd943d54726425f2d30e5337c5f88ced773c1366491eb9e61567ad04

Download Submit
C:\Windows\INF\c_fscontinuousbackup.PNF

Filesize
4KB

MD5
e5aebd002fd4086116db5456abd9881a

SHA1
0393443c0aa8c0871bec6026853028c0155161b3

SHA256
748d8985abec2ddd2dfedd93655fb166da4fbf1809c825e192d163493237274d

SHA512
2f3dd360a8eb21a09213b45fe1ca3fe709dc7d3881bf45c4faa7d5b4e346d86afe6b051cbfcf87b731fbb874548a318ee3da5e8266af8d915a8a95e1776507c0

Download Submit
C:\Windows\INF\c_fscopyprotection.PNF

Filesize
4KB

MD5
efb626c14105d2095cef5efc9980491d

SHA1
d21c921f7f23cde3ed4fd5c3816b3d3980c5c779

SHA256
02ad18c41975f876d48f78569547bc69eabe7c85b2d3480a763b4bbae17f13c3

SHA512
09e999440a51713f87de149383023143d09a21a62d8c94bfac549f4566bf997551412fdb3181afa6c232f5305695783d7346af89ffbca52918e464914c11f2b7

Download Submit
C:\Windows\INF\c_fsencryption.PNF

Filesize
4KB

MD5
d2df781aa1e6c8068cb65ceb3c6afb0d

SHA1
61d8eca05eec42a4ad4f678d916ee8a7dad5191e

SHA256
ba6ec341cc8bced677cc489cedefa67d77238b83980879879475b06338e162a0

SHA512
3038cbe4bda42c5ffa7e6797251687a3f0ced0be3362821f651e5cfea6a2076755477b876f2af53a026188e0b16d1913c204f06dc5f66f7227609fed380d293e

Download Submit
C:\Windows\INF\c_fshsm.PNF

Filesize
4KB

MD5
1060f0143b7a22e51a813c1cc7540be3

SHA1
2d81f67c1758c4658ec034a51e3a3ee71e9b6e2c

SHA256
fac5c24c2e5b03ed802308cc180be5abcab756f04bb51ab727a824956480b1f1

SHA512
a21f88b464226b252e0daa655d4ce18f581a2deef76dcd5e874e7f0ffbb41723fa4bd637a4032078e577ed971ffd45581881d53657d22d5a61c6627d408946ed

Download Submit
C:\Windows\INF\c_fsinfrastructure.PNF

Filesize
4KB

MD5
cab64b746030d632ee9f2f1bd762a9e3

SHA1
14a7ef9f28148d5435dfe04952602ac92c5cf8fe

SHA256
37459d9dbee67c42110bf40c46ad190034955b105b95fd0075faa17ea9ef8a17

SHA512
82ed1c4f0af5f3e0c666c8d961f3e45370fe12db220b5139143a32d7538123487fdf0ce55286bfdf8497492f6d7645dec299560b69a77f6a1714a8d5dafa1241

Download Submit
C:\Windows\INF\c_fsopenfilebackup.PNF

Filesize
4KB

MD5
216d7876b58a6b06b114ec6383cef78d

SHA1
62ff0502df0798424e9ff66254977273ceea9d50

SHA256
6e5a555198c527bb869d1468dbdf599eaef2f9abc119209abfd2f388911e0f92

SHA512
d30b183f162562a9fa6894749dda6599fc6503a02070aa17bce75ef97dade653ad8cb8939ccad795886a11b6a133a24c6430314234a18de14c2b448a45d270b2

Download Submit
C:\Windows\INF\c_fsphysicalquotamgmt.PNF

Filesize
4KB

MD5
1a7ce8156e73b97e38b6a53aebcce6fe

SHA1
07926bd393b3b975ad431134cd91d15295e01c55

SHA256
f74e8810d47bfe3704bce9be48765353fe7cac0442744df9ab4945f8aac43995

SHA512
332d84d32308e807a4fa150aad6655d0c2a5048daa20ca59f7a98448f657c68198f098fe101da0f8385a78b5f2f834ed511ca7f3abe4811bdc2b374007403cb2

Download Submit
C:\Windows\INF\c_fsquotamgmt.PNF

Filesize
4KB

MD5
d30c2ec9bb72adafa536204a36870bd8

SHA1
8d09ba1ef5b03073d9b487825b0a476dfeb0ddff

SHA256
d490703d62044e0c2a4d3b82a91673339ba4f3bda9f04215f28d9674c4bc9ed6

SHA512
b2b7104add30ebbfbd4d3c97a1a401996ce49933f2b5113e5ed7c4ef98485a9ec93e444561f22d4fc1847847616fd4315711a5e4bf6b0fbb2179ab80c287b7b0

Download Submit
C:\Windows\INF\c_fsreplication.PNF

Filesize
4KB

MD5
7586da3ba4f96967928f1388f49345b1

SHA1
c201a332b075f03f64da751698329ecc5420e452

SHA256
edcb282e682c9001c4eae416b6e80b5b8502fe9ed90f4149b82e9fb4f3f123c5

SHA512
d9d840d13f7242aa0d380d77bb9404278cfb81bd9126599884fee33876750839149e3616710655d3556e155862cbade34769bfb3bdd6de9c54748db6a75ac36b

Download Submit
C:\Windows\INF\c_fssecurityenhancer.PNF

Filesize
4KB

MD5
d33fb400c473d002277078f03a6d66fc

SHA1
959920ca0c867a2ad0a2d0ecfbf675df3b6c913c

SHA256
2d1b6ccbd91b8a4d90a2043d58f6b2976b7a81580f2fa39968661ac29425e087

SHA512
fe3755a1545737c6d6d3ce8c4e4dc6ddee1d1795a1500b3a516de5811506a7e97cfc57fff5dda760b5207c44e317e929e1e6108a347204eda69fe5eaba38256b

Download Submit
C:\Windows\INF\c_fssystem.PNF

Filesize
4KB

MD5
6855672886e44447027af31c1234ff7f

SHA1
d6de7ba98c556f344aa6c5dd48ddc0fa6ec7a2b9

SHA256
d502cbf564f7dfa97308747c17786d2f44396a4af036f0e480cd4a96a6631706

SHA512
fcfd957036549491debdf7bf171a0b405bcb4aab583251ccc7bfb7a67c2e00c18c0573d68d4697d1b51cb6ffef5eb83089bac79fa0bb1e4ccdf777ce68865e80

Download Submit
C:\Windows\INF\c_fssystemrecovery.PNF

Filesize
4KB

MD5
1c20b551c8177c64891f1c20f38141ca

SHA1
5698b6c521d66a0c19ef1400bd05797f2d0dbdeb

SHA256
9e7a415f05f5ef98ed2afc3cb9b3af80970bdb80b00abaed19c89c6d4a2f3df9

SHA512
401c6e105ca2571202a1f2c4e7cd6e9b0e86db8122d45fde55ef3f84ef515938f516854fe5f665fd4934b4e39a61fd7700d65da6d95f3f1f54d0dade235ec3f5

Download Submit
C:\Windows\INF\c_fsundelete.PNF

Filesize
4KB

MD5
6280f9b7fddb96edbb7f05ee49ab75ca

SHA1
ef2acdb69e78abe3694e0aba72b48a6972a60568

SHA256
d0fce943b8bd8db882ae9c656b92b9341f0398dc187361112dfc3d4ab3443528

SHA512
7c5d16027ae82dddf19fde7672df131a3538998d92bb1a062d1183c741ea8a16c6db28bcf7dc8e70ccf4794dc26c8f65744f15fc521f5d563e072090f87e911f

Download Submit
C:\Windows\INF\c_fsvirtualization.PNF

Filesize
4KB

MD5
c1e850d8f2baa3c6943d6042db6dee7a

SHA1
bfccafaeeb44da789b9c2dc1a53d7081b4f735cf

SHA256
7ccb9efd738a97dbab566e83ada5d7253a6222e8cb32436bc002d7fed06810b4

SHA512
01f68721797672668e86d90493ef3274561e9829e4135e391fbd7808f9c2c2f8f27a21781b5ed8e98a0fbcb1cec9f589d38310fd4daff39fb84678a418e1b61f

Download Submit
C:\Windows\INF\c_holographic.PNF

Filesize
6KB

MD5
5741fa238284e3b1230452c1b60ab6fc

SHA1
1f3431c8680e6308366fd625a95765aab0e9a188

SHA256
0d0147b4c890765daff4ccbd880b1f9888b8e6232352d5d7f4370d878d639ee0

SHA512
c12493486a17f7b8d2b5af45b3303530e5c49651609279624cc46d6e913f05e9d065dece89d8d553d34d85633025e07a171463d9ad84385fdc83926b80da9a66

Download Submit
C:\Windows\INF\c_linedisplay.PNF

Filesize
3KB

MD5
2cdb8750cf4d771d4b645b1f7f7f86b3

SHA1
f55f5b770bbc742c345e540865cd705c7189305d

SHA256
da71d267e72aa379063aa4bbc0c4e8c12f02b0f51c86c68303483d8ea9414886

SHA512
c358e452236429f2ec91e64fc513a0210302e48396a90cddb0ff5241114f47b48e1aaa5cb4cc8b0589d1bd0ddce5dcb1e9d9c993aad44c2e615008ab3b3c5015

Download Submit
C:\Windows\INF\c_magneticstripereader.PNF

Filesize
3KB

MD5
b19015e21e1bc2886b0b674d2f450bd1

SHA1
540de50a0d3b98b6abbc084178ba05e4704321be

SHA256
a1bc54e853d96acf8279a0a7f98de870e6d217d281b1119aad865816659b1eff

SHA512
cfe69151364ff1227b2eae37420ae70f34760150ca78b2e5dad9a83cd0538f6e1ce2798b4f31ee6fd9b9e17e020d738c7ec3805796e8d40bad1cbaa3914350b6

Download Submit
C:\Windows\INF\c_mcx.PNF

Filesize
4KB

MD5
1b909c8deb042ba17243934d48b3ee41

SHA1
928e854f9097ac311fc5ce458fd6909d812f7d96

SHA256
20781e9cd4f11ab6dcc3cfd6df92e0c70f55ff043165f1681bea6e48e45eda03

SHA512
088c1db3e9b55fbb46cdfa4ff18040deb5c1a1347b7f6366b8bbcbf6a1d42ec74aa9e167fb021210ddd613a55c8fc223d99ce2f39974dab1eb301d4f3d1ede9f

Download Submit
C:\Windows\INF\c_media.PNF

Filesize
12KB

MD5
d6f787534eea52824abfef940379b071

SHA1
b200fb5e314de41c743ac84fc973584dee668946

SHA256
feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8

SHA512
7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca

Download Submit
C:\Windows\INF\c_monitor.PNF

Filesize
6KB

MD5
f780cf05c66e76b0e7fd96e15a25b1b5

SHA1
4d2cb2ef664e433d7e975007c9a7214e2120e9eb

SHA256
1e2b8358aeeaf5c99606907c775e2e9e04e1244f6c2ae00d29afcfd71f26845f

SHA512
4a030895d42bea4184e7a8c1601c495b9abd1cddbc002069f782362ea8a647f262a98fdd16105e6acd7e2de7059337a3f277e5584eea06f718c97557cab584dd

Download Submit
C:\Windows\INF\c_netdriver.PNF

Filesize
4KB

MD5
754a7d98f2f68b44b9027ed1be607cd5

SHA1
7994175c40348fc7d5cd80749f61ece9efd445ea

SHA256
6be1c4333398b2755bd43fed4c5db6453e1d4fca75b1553b253793d1d0fc7409

SHA512
49b3e17a06047bd069619aa1137580014005a97b02d6c35c377620113d4d814dd9db3ecc7c727ce23d049271dc600ce6c91abe026be201d9204dc6cec7c31c87

Download Submit
C:\Windows\INF\c_processor.PNF

Filesize
5KB

MD5
912a021ec384a1d66b47a2de39a6b7c2

SHA1
2dee665f515d8b5f42c7c9dd4721a18ba5f17c62

SHA256
3b5b240cfa3af80c010220d02c027c5264467ffc4b40e8da0989ebc5e71aea1b

SHA512
fe9c811de43100847c0073f74b9479012340ab3cb2676edd308142135289e7aaf1cf96a8e173d5821af5e02586fa9939e6dcc1ec54ad67b92f287c3849007f1a

Download Submit
C:\Windows\INF\c_proximity.PNF

Filesize
5KB

MD5
2cb532cd36b8688b066f9e338a354642

SHA1
870a29fb36f659b876187b91003485965b952ed0

SHA256
6f7221a8ab19112684f4b772820324288d31b17cef624780cbf47a7f11a85242

SHA512
6becba1c36643028c5927c00540751f5e0ec57d1ed976817fcf9da080573389c44e8af2ee146c8c80617e76b23333f8ca8c162347f0f299a46fe4052eb9a9ace

Download Submit
C:\Windows\INF\c_receiptprinter.PNF

Filesize
3KB

MD5
0b4ed36ac65a4451211d6304620e7f87

SHA1
42da4edf4836d395dc7276700fce799ae86aa77e

SHA256
8f8a0508ffbab5287084acd50da86abebe5b7c2ae62a6a321cfc5f6194ea98bb

SHA512
a13e482b27057dfd58c38b0c6369091126a21b7f73c9b9f0e84504e2e452c4bba2466c5a5258314f5f4e7a6bd178fddd9fd5a3b62df9cc84df49c7f0c8530929

Download Submit
C:\Windows\INF\c_scmdisk.PNF

Filesize
6KB

MD5
06c78f05ecc8eda671bc99c417e2fcb7

SHA1
bb9cdfb6bd0bead84abc0ebf648e08bd55955763

SHA256
01b226672055be2f9e4542990799b9a98d04bb94c18f5d338098266dc3a403c6

SHA512
7e62401a3d49965d2561661391752d64c7bb65952bfa9693d8e6f863ad1458cb88d3a00488ce895dfc2bf767bcf433d77b66a14714ded2a4f038bd30f8522734

Download Submit
C:\Windows\INF\c_scmvolume.PNF

Filesize
4KB

MD5
0f2537cbfcd53d274142b112a074c2f2

SHA1
e95e6ab44ade5103713989dc2db1799a3c48f16b

SHA256
ef7c74fa132116a15c2911b27e497337b88f822172492a0e8a39d624bb979a12

SHA512
7adcfcc09d49f8c7b8c9ebe8b296d623fa969218d1faaba0cf170b66247f78cd62c0980febeeab304486cc9d4df8fe5123240549925b6e10120078b561e3e780

Download Submit
C:\Windows\INF\c_smrdisk.PNF

Filesize
6KB

MD5
4cf21ec1f468774282bc715f036550a0

SHA1
4cd49ba4fc7f037035345193dfd1cdcb5edb991b

SHA256
7abc1718e77c2711db65071950c906c8a39ba4c290a507ffd6e6b8e8efe059b6

SHA512
97ff0b19fbee891456883c4c26243aa0e1b5c2b818bc5fd975e9dd59f0887b13ed935ae5f54a06bb3cbe8c18a817580a799ab4fdbb6e2d736e27c2e57b1ea78c

Download Submit
C:\Windows\INF\c_smrvolume.PNF

Filesize
4KB

MD5
5d49ef45b2106e2e78a848037077c15e

SHA1
06e37bdd97b61b01debf6a378c253ac925816dcd

SHA256
e2b41a6c066c61cc90d19853ba8a727214449d03a8d703fc78c7eda357065505

SHA512
b9e05b34c91035a9864fe8a03cd012a3cc336bd0a24173d21b887d47e4d65c41f931f742c81f159adcd1bd1d91034d349d07a91f8d134cfdfd077295ef1ee7d2

Download Submit
C:\Windows\INF\c_sslaccel.PNF

Filesize
4KB

MD5
a5b60198ed9c83074babfa86f60c1e4b

SHA1
2f3e922d885fec14b965d9138ec90a1571125e8a

SHA256
024d245e7af8409c38f53bd91cf4ede6c11dad6a192a27351ce027db7fdcbb03

SHA512
47571c1995d026e90114bea355d67842e8e77ab003e906f7f5b247c1fe50743609165b944368f7b92759082c78f5b0ef020023c45bb712ede8e408979a7bbd00

Download Submit
C:\Windows\INF\c_swcomponent.PNF

Filesize
7KB

MD5
b097dc99f5d4e4924505d26aad418060

SHA1
56c03dcfd0de0e0248c9087d278736e1c047ee98

SHA256
f46763a9b7072706927e582e3cbae297627738a5031d03b60dfa860888aa6712

SHA512
436d54a5912128459972bcb5cefae0fa9e878f8c0b142df76a4fa7060f2f08f5bc4fcffdee437c355f52450c1354c7128be72d1e32a7bb012aec02b7394cdcfb

Download Submit
C:\Windows\INF\c_ucm.PNF

Filesize
4KB

MD5
ad66096364560188e614ac4978243bf0

SHA1
938eb13ab98bd8f798d12b0327e74312416e725b

SHA256
559aefc00d2ab80a99137c2419dfe60b5253c227897f7645bfa639f714e8b66b

SHA512
da4ef0cc322b0081414014f7756127c87033ed2e68c4cc78ced562b37381935cefdc38936e2f32b960de837b8fe9e91d6f165880ce72efe87df60489409c5eb7

Download Submit
C:\Windows\INF\c_volume.PNF

Filesize
4KB

MD5
138947c61ab94912b484081cd6232030

SHA1
fb280090dde9a34de8051b199eca979170de5fcc

SHA256
b504a238f938f463f96dc80365fcf11c1d08ade491e5a22356b028b26120afb4

SHA512
14a99b739b63fce93af3dc49bdaeb503777b86554d23b82453154a0e77be2f3dc592026a2014a24019266a675d5df3c6802a2d1ffc12a09924d2ad924060ffc1

Download Submit
C:\Windows\INF\dc1-controller.PNF

Filesize
14KB

MD5
076754abb737832ebf0d71fb1b3e5bde

SHA1
29bd157921008c12d599dde178b0f498276e8e9c

SHA256
ceb92d8ea591861979a45569c2f29111c3d79b95313de25353fbac9dbc80fb7a

SHA512
f6205dd8e949ef2a24833d7c60b44dc1e6704be22d7c4546458718024216615caa5b894b36e2d60f6656fa0cc226c90c6949915f3c757e323d793101a3179682

Download Submit
C:\Windows\INF\digitalmediadevice.PNF

Filesize
7KB

MD5
d67c91c7a05009f0fae04f322a3547fa

SHA1
6c159fd27f8c8e88d3cb8cb423036c8d98549bee

SHA256
b9a275119436293f0f0a0a3a4db7b848b636a266fe1527f4f231183515b509ca

SHA512
ff91429a77105ea34f20c3de88cc4e83d2a3a38dc4ce13f6d84414b3c8759508e51dbce460e8cd331229ac218cb1967f9ccf03502d719addce49799bb23305ff

Download Submit
C:\Windows\INF\miradisp.PNF

Filesize
11KB

MD5
a29c26407bbcd347209ef1b6ee0da34f

SHA1
e1f4ce5ff4619a4414aa1e0ed3ac520a83919584

SHA256
519c5d140e5fa8aae6506e14dce399e1e7d44798989227962ef51733cca03227

SHA512
1760e5112b9e4723d51be0f07986649b3b524ec3a994b3035b6239850c449279cbbef40533dab1cc08c1bae3ec5957148ce6f66504d0c9cfd52109ef09cb53d7

Download Submit
C:\Windows\INF\oposdrv.PNF

Filesize
8KB

MD5
34a8492ee86581ed469ce4f2269c8272

SHA1
cd3c1e164d02a5617e5e0f4e9e405d101af1df17

SHA256
f69e3c0bc4527afd64d5253b7f6f94c55f88489a001e46fdd1558909befa261c

SHA512
4b706943c53385510f6bd106129d0d9a3cc619264d1b54c7b94c2e88e2adc58b5feb8b78e47c4d912df8c4dd8b37dc37dafab733283594c9cee95a0c76316f7b

Download Submit
C:\Windows\INF\rawsilo.PNF

Filesize
8KB

MD5
82d4a3efc0133428b08ed6f9caf1d275

SHA1
d6306a6b8341234f8a1f0c592b1e2af86d712044

SHA256
0649931f3077d128a6266fcf670d5001e61319977bdb9d407d34b30bfc791d3e

SHA512
a9d14b233ada20402acedbed94ebf389934ab6ec8293421ab246c70191f00500bc63d46d36d55b211f3b9078ee403113900297eb0a4488618924b280445da1fb

Download Submit
C:\Windows\INF\rdcameradriver.PNF

Filesize
13KB

MD5
1c5d8d8648b79b79d2ddda9d78fa637c

SHA1
5de477696fdaf88c626717f8a3a5c06c7135eb02

SHA256
ab0cb0aa7c4b85d6209fdfc916c5426cdf92fa8bc63c3fe15cda9485bc39f7a6

SHA512
e0a1d6d35578edc27783a22e40ae533477fdf0ff315d119d4fa460faba1653b23104976b1e0f685d0201f7cb9c06a304481337b567c3b2aa57ee72d31bf743e0

Download Submit
C:\Windows\INF\remoteposdrv.PNF

Filesize
8KB

MD5
a467740656c2d41d67e571a22e3801ea

SHA1
3cff2e5c9f9da0a3712309bf25ed60da0d42a817

SHA256
c06e9f267fb7458dc26847b7516e9de9882261576e5050aac2cd471a6b2eb8e9

SHA512
bef75bce6ab385f548d559698f64b6ad293be06facdbd620623eaa7ee83f3bb6332e3ceee38fc4e078ca01654396de4872e1ce2d0588ddc640f4ac2b19425918

Download Submit
C:\Windows\INF\ts_generic.PNF

Filesize
8KB

MD5
7ec7892ac4a62ad2548387f11f5a8917

SHA1
75b606edea0cb4964ddc2d28b7706d437ef8abb3

SHA256
8854966db0db843129614acff3ff81c06cecaca079833b83a7f4f5a0e7592db0

SHA512
cb2478853de7b2784b62043e37f8515ac1c0777ee2c336ed1c81e6f8d444c8b16a9e6b3ccdec80117c46b3971a0848a860bd7492970f2bac4799443b8fc211e4

Download Submit
C:\Windows\INF\wsdprint.PNF

Filesize
7KB

MD5
1671a9ea5066b2b30ad0b59fbcd67992

SHA1
eb44dfe3216ded035bdc4b891a06763e2a0584ca

SHA256
2e4a7afab81f605c4b994bb71ddab299e7f1f7ce96140fb930110c3aa5d1167d

SHA512
610c718048e2243f6a46bb02f9921fdf0bff26306cd58114002ca7269b68db27ed37e5c7be45e62dd328dae24f634496d78a08263d708f27868536a98a4d4b38

Download Submit
C:\Windows\INF\xusb22.PNF

Filesize
9KB

MD5
5ea20811fb0e104eb508143290f3cc5a

SHA1
af82a5b3a9188f1661b0bd317c218e83ff5c092f

SHA256
797ddc0f2b5a3e2137b972c3237b8fe99e6f7c408b2454a7d8aa77a9110c3c1f

SHA512
de6922329a8dc94eb45d7bb2515c155e62cf549e3bce72a052ce4133446d7e0ea81a22fe79073ce6a36d3d44ec9bc818be8615bfd65808240d91cfce593da2a5

Download Submit
memory/1988-103-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1988-96-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1988-97-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1988-98-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1988-107-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1988-106-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1988-105-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1988-104-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/2356-32-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2356-28-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2356-33-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2356-36-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2356-35-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2356-34-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2356-26-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2356-27-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/2516-12-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-2-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-6-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-1-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-7-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-8-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-9-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-11-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-10-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/2516-0-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads