40a6dfb2da3f160374c4c287d2b2e7657d151f5d9c1d73fd0f6682264a3b0872

Analysis

max time kernel
18s
max time network
265s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

cvnwzmammv.exe
Size

316KB
MD5

f5e0962b8f5ba52bbec6f2b7f63a2bc1
SHA1

ef2437a8277565dc36ab2222d893849964eb863c
SHA256

5a520735eb6373fbb0a5e76d72b33dbb9514d7cfa3b7fb465a12bd9221ec27f3
SHA512

2c86bf5145efa719c54c33710db57a7ae1b8b4a51d3161f5ff09f6e62199ee6ac07e64f5ade3d9de576979ce588fa55984f0ce1a97d0a502a4fbf960ddf30450
SSDEEP

3072:GGmjllRDGTCzXCLA52mvVZKjzepmECnvwsC6m7Yl22wruUiLrf923F8GDsrXkd+Q:EjlnC6yQmzeAPv23

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cvnwzmammv.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5004	reg.exe
3380	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	688	AUDIODG.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 5040	232	cvnwzmammv.exe	79
PID 232 wrote to memory of 5040	232	cvnwzmammv.exe	79
PID 232 wrote to memory of 5040	232	cvnwzmammv.exe	79
PID 5040 wrote to memory of 5004	5040	cmd.exe	81
PID 5040 wrote to memory of 5004	5040	cmd.exe	81
PID 5040 wrote to memory of 5004	5040	cmd.exe	81
PID 232 wrote to memory of 4840	232	cvnwzmammv.exe	82
PID 232 wrote to memory of 4840	232	cvnwzmammv.exe	82
PID 232 wrote to memory of 4840	232	cvnwzmammv.exe	82
PID 4840 wrote to memory of 3760	4840	cmd.exe	84
PID 4840 wrote to memory of 3760	4840	cmd.exe	84
PID 4840 wrote to memory of 3760	4840	cmd.exe	84
PID 232 wrote to memory of 3128	232	cvnwzmammv.exe	85
PID 232 wrote to memory of 3128	232	cvnwzmammv.exe	85
PID 232 wrote to memory of 3128	232	cvnwzmammv.exe	85
PID 3128 wrote to memory of 3380	3128	cmd.exe	87
PID 3128 wrote to memory of 3380	3128	cmd.exe	87
PID 3128 wrote to memory of 3380	3128	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\cvnwzmammv.exe
"C:\Users\Admin\AppData\Local\Temp\cvnwzmammv.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start calc.exe
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start notepad.exe
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:1296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start dxdiag.exe
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\dxdiag.exe
    dxdiag.exe
    3⤵
    PID:4044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start write.exe
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\write.exe
    write.exe
    3⤵
    PID:3416
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4780
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd.exe
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe
    3⤵
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start charmap.exe
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\charmap.exe
    charmap.exe
    3⤵
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start taskmgr.exe
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\Taskmgr.exe
    taskmgr.exe
    3⤵
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start winver.exe
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\winver.exe
    winver.exe
    3⤵
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -r -t 65
  2⤵
  PID:2020
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -t 65
    3⤵
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start mspaint.exe
  2⤵
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start devmgmt.msc
  2⤵
  PID:540
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\devmgmt.msc"
    3⤵
    PID:3304
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\devmgmt.msc" "C:\Windows\system32\devmgmt.msc"
      4⤵
      PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start control.exe
  2⤵
  PID:5300
- - C:\Windows\SysWOW64\control.exe
    control.exe
    3⤵
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start mmc.exe
  2⤵
  PID:5584
- - C:\Windows\SysWOW64\mmc.exe
    mmc.exe
    3⤵
    PID:5632
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      PID:5656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start calc.exe
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start notepad.exe
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:6104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start dxdiag.exe
  2⤵
  PID:5348
- - C:\Windows\SysWOW64\dxdiag.exe
    dxdiag.exe
    3⤵
    PID:5512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start write.exe
  2⤵
  PID:5836
- - C:\Windows\SysWOW64\write.exe
    write.exe
    3⤵
    PID:4912
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd.exe
  2⤵
  PID:5160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe
    3⤵
    PID:5212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start charmap.exe
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\charmap.exe
    charmap.exe
    3⤵
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start taskmgr.exe
  2⤵
  PID:5556
- - C:\Windows\SysWOW64\Taskmgr.exe
    taskmgr.exe
    3⤵
    PID:5572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start winver.exe
  2⤵
  PID:5728
- - C:\Windows\SysWOW64\winver.exe
    winver.exe
    3⤵
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start mspaint.exe
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start devmgmt.msc
  2⤵
  PID:6012
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\devmgmt.msc"
    3⤵
    PID:6052
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\devmgmt.msc" "C:\Windows\system32\devmgmt.msc"
      4⤵
      PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start control.exe
  2⤵
  PID:5924
- - C:\Windows\SysWOW64\control.exe
    control.exe
    3⤵
    PID:5504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:456

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:4592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:5396

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5880

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa399a855 /state1:0x41c64e6d
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\3e2651cb230b5698\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
0f7164f1f0566570ac69e1cfd7bc18e3

SHA1
19106621d143126a2b6ce4d97f774785f15db4a5

SHA256
405e203933b01a82d64aacb930395bc6c9157d0b392523956d200d4e54c464cb

SHA512
2843fa06a0c7808dc918dc0c7c003f6a65f5922d47f638c1c2a1aee0e5475488d8c0df2221f11450444b0ad7a180d2782888c20b1ee9fd1ba22f060d85453a9d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
960B

MD5
93b644a91ef6a5d2f79b5dbd31aaa3b6

SHA1
d6be447284aa7b3cf0539f0cd7577c295421ebc9

SHA256
b5d379052d3239e6a3bc951b6ea82e8ce51250a15303c9b06ae7ad6f82c28020

SHA512
eb18ea4f047962b8fc2c944cce45025fbaa09e9f71f97f8c93685f9e6370969d8c74749e2eecb396db5ee004d7afc7d30d2c1d0c5e0b3671327e849bb9f697f2

Download Submit
C:\Windows\INF\PerceptionSimulationSixDof.PNF

Filesize
10KB

MD5
05ba9884f919b26308f8573077568a7c

SHA1
6d406b35d2db6023103e710330551c82454bb7d4

SHA256
6b324616af82b9c30a97a5d0d220e60e67e7afa3f13676c0decbd5c7526cc4dc

SHA512
0e018a3eae4135f23c3f710eb8b6b95bec751309de0167d95a0be04aaea0ee654184a3498111e669c64de04fc2a77f496b16c4172a150b894449db9b206d5847

Download Submit
C:\Windows\INF\c_apo.PNF

Filesize
6KB

MD5
dcfdc3d6df1430c2970bcc767f1791c9

SHA1
58f77ad74262968d8aa98a094c1aa170c6af4293

SHA256
aaf877613d4d76040a983e31e7d0792658be358777f6f27f25d97dd9f717479e

SHA512
43cfe9ad30d15e4ef6eecf3c35dc7eddb24cfc402f8e406bf911bd33222711a20b51dcbfe4d5ca5d1830f2d2ff91e67353d078653ff96406e1357f2000911e14

Download Submit
C:\Windows\INF\c_barcodescanner.PNF

Filesize
3KB

MD5
72db725d99303e67a35922a90ae3444f

SHA1
b6e5dfb6fa16c4711376b66324e21cef067f6333

SHA256
c48d0d2fcf056a2074f1df288869f7a63f965f19aad8b61d02bf6edda9798549

SHA512
91a69eec94e0c1e8c25c26da9059763653ceef3269326dab058cdffc6a054d5127519c14bbbdf6d0da5180b9bffceedff215c091ba16ed89ea193f7640b59f56

Download Submit
C:\Windows\INF\c_camera.PNF

Filesize
8KB

MD5
eddb534de28a1cd8a309840e8eb43c8b

SHA1
cf22995a578c8f109b498add4dac57a7a89d9292

SHA256
f0b4e0fb01afcfb3536e1dcea47e6a7b6db0e6ad66b0c157da98be6d0be3565a

SHA512
f1e1466d3a58e3bb06bbcd3407680da0169c5edc8f00672cf581bf33c8b11715f0d9a1d48442d2fdb8ed0b00789af656db8b45a82073cd35d93e592b763cb3a8

Download Submit
C:\Windows\INF\c_cashdrawer.PNF

Filesize
3KB

MD5
4bd6ab742ada83ba6ef4d524ee8f8ed5

SHA1
ab9d5b959f375fa8cbe2dd54be8e106863fd4d73

SHA256
fc27404c47c7152215bc4c2bbd7a3ad6f9048229d3060e3fdac27325193b666f

SHA512
b54a672a407bb0b223a2afc2f29c96196a87380a9e0008a8de16bfde691ee0dae63c2961124810eb2af307cf24a2b722826a16f438984da68998251bc3544dd1

Download Submit
C:\Windows\INF\c_computeaccelerator.PNF

Filesize
4KB

MD5
562479b02cd4bf8b9f6a339b13f2d295

SHA1
b45ca1b5621a76122e57b375ab2124d6b04fd617

SHA256
6b6987b10f3ebe794c24152d72c994af771a280e6a7a7edc0af8cd6d60898543

SHA512
7f058274ae17fe673cd23dd5c08fdd57af4e7519a808b68cc22e1bf096995d947bb4c4d91d377735e2a837db3017ffb59a14648a11d3825f45c75e557392f5a6

Download Submit
C:\Windows\INF\c_diskdrive.PNF

Filesize
6KB

MD5
04916b253bbc426f48a519594427d3dd

SHA1
ff452a956e48d617449e5e1fa4bc56686837df42

SHA256
df023dfb667fcffa19ecd3918dcb83452ea0e057e63e07c0dfb750f47df03914

SHA512
1a9368c17c48ff96c29ce8acea3a95df6a4ec494839ab344f6eaee0b3de58cfce8166a3247792da8529caf1618ad23e95277beb9e281ebf3834200fb75c5416f

Download Submit
C:\Windows\INF\c_display.PNF

Filesize
8KB

MD5
c33235a0c1d12faaf9cdffdc2d792a28

SHA1
88b420c295c72b6ffd1026925ae2727fd0ceb9aa

SHA256
a50396a4528ca6028cd6bc29f9b6557ad38c87c53b5409a1a1d75708c204d1b7

SHA512
aff4061d6dad0b1ade89165c6bd30a3bab800aa4863bc368d9f2eaefe13550837820b6f4e3e16edda1f16c18584feb8e75df2331c07eb48478e45fd1761f6027

Download Submit
C:\Windows\INF\c_extension.PNF

Filesize
4KB

MD5
f744707692c267c4f905d85afdfd76e3

SHA1
47a267933d322dfda073208f831ce4e382052919

SHA256
a609d7ad70b03ef59aee3f7fc40b9da4fd424e1b065652fac2c72549c701df38

SHA512
fbe078143aa694e1d6c9fb9425a9ecebcaa4dffef5b3430f28b4e6bf8cc68a480253da99e075355fcb1b031be01a7d05ada7fa2b38d44ef4530564b43bedecc4

Download Submit
C:\Windows\INF\c_firmware.PNF

Filesize
7KB

MD5
d2062a16e208a79d5ed1866940fae96b

SHA1
94049d6219922d0a4ae4ac72570a734bb2d0b563

SHA256
ad8a727a40e1574f62ad22d0dbae028364eee22b5a377cd8fb4d84aab850a6e3

SHA512
e05b18ebf445af9122983f54b80554c4c01c962c48a7a730188b160f4b15635e8979caca837daedc05bc8f66c808107546e5ce1a7a12ebaae4a3baa9e5e4f77e

Download Submit
C:\Windows\INF\c_fsactivitymonitor.PNF

Filesize
4KB

MD5
8f3715121f1d5b83a843d0e34dda6fe7

SHA1
9f77dcfe3b962b18179bb87494316318b13bc51a

SHA256
ef88e6fce11137035a1b0b323a8679e0a2c33dfeac251a0f80156c5684ece323

SHA512
40f23eaedc3771b31d5cd19fc86cc82ca04caf458c864f34508b8c6ba60e4795ba4f99f3675bf7d34f867677dc0544e652f034f247131df1bbf02f6f47f29330

Download Submit
C:\Windows\INF\c_fsantivirus.PNF

Filesize
4KB

MD5
b6538040790fadd666918903d44471a8

SHA1
c86e9d04acb977e78265267c024bb9017299bed1

SHA256
8c86714556df49539a22db1990a0eae7efeb7cd08c723c28116d63b9699a12a2

SHA512
50fdaafa5e03baee6c81a6f1de293d70b87d1f5ea097011c49cb378229317ff8c76118888d2d5b5c051aec146e19ce37feaf11cfd9997d84f1fad3832b7aefdc

Download Submit
C:\Windows\INF\c_fscfsmetadataserver.PNF

Filesize
4KB

MD5
338b0ceee5d9482cefcd1a0ed04f2bc7

SHA1
4b0083b3044a4e02b2b312a440d145e28577526c

SHA256
6964e111ecd9988babe5836b5d9bfb78d0a47169a1ec6ee70356feb2699c4d12

SHA512
6191dfaf13640badc2001cbbccb67a99d9ba0ff184f747c5781c6a2c802af200cebfca0479fc2949d735906a31e599b4b0daf0fc997f03ba7f7621c6c0a69957

Download Submit
C:\Windows\INF\c_fscompression.PNF

Filesize
4KB

MD5
2df137b2e200375170f4c19a0191a148

SHA1
46e61b71454558adcb5612f05cb4a72e192de411

SHA256
16e8779d9261f029ed70eb83a2b6c3c3620410af507b8cd18ccda528d4c69782

SHA512
3e3f4b1d1486b9aaef6ac6d74cf235fdc4e3cd165136762239922f82864ff3124b63a1fedc94d05499650725dcab3da3ce4e0fc4883fa8cf2e6d7a89f37bd509

Download Submit
C:\Windows\INF\c_fscontentscreener.PNF

Filesize
4KB

MD5
9f3c5012d600a248c73b3fce78938a58

SHA1
e650c6c7cb669f341daa77120d3e2d9bb5239701

SHA256
a18024bcd8e6eff75963499308fdf36b2f88594eb6f34fb829765c78c6c3f003

SHA512
81d86ab7417b56668a0bc082807d2348ba0aa083f560a12510a712562d00ba848ec3d456bbb48c2aea47ddcb3ad5134a536671ab6f94128b342bb18a150ca414

Download Submit
C:\Windows\INF\c_fscontinuousbackup.PNF

Filesize
4KB

MD5
248a64ea976580b850f1435604852bb6

SHA1
8cbe92fc9699d72aaa8372616bf2886d89d84958

SHA256
53e76ba43650643db459e3d517425097a8a0652d24d5230edf6524359d0fea17

SHA512
93fc3ce048eaf2fcf4cd75ca6998b66b537940219a57ba7b3432bfd459b30c25b040aefc87afc04f8857ecfae2d12afbd7afe45657b49541311e0c49c6b2fb16

Download Submit
C:\Windows\INF\c_fscopyprotection.PNF

Filesize
4KB

MD5
ee02e103778a667786df4ff2e771e58f

SHA1
cd3ccea7f5b38a9d3c99cb78f25c0cccdb2e62aa

SHA256
95e2709e8640d1a9ad6de4f03e6fd58f79aacb398ebc34f1c45d1ac5e07e1bdf

SHA512
8007e163f3d4ab23bf162f1f242f9c63604bccb034492d7be1159f333640095fd62f4e0eebaccb2cfac0ab935c2dbe791465cd949cf2d85eb958ff6a3df025bb

Download Submit
C:\Windows\INF\c_fsencryption.PNF

Filesize
4KB

MD5
6311858ddf906beff4dabcbf045f8f7c

SHA1
8731b2cf203023bee01b36eb187303806399a36e

SHA256
2059c2d939269657cae40f3e03a08fe39161b88f06177c0ce7cff8e8ef0477dc

SHA512
f205f688b265608c0f71057ae3b79a28197e40c84a7fbb17c22c20aebd792c8dc0022685092d25f47ced9a288eb02902da0ac9bdfc3d96f08d8b0356c1fdb797

Download Submit
C:\Windows\INF\c_fshsm.PNF

Filesize
4KB

MD5
81c14fcba6597e8d4b906e318dfe79f7

SHA1
7874c9c1d700d5b1b0b6a08e5f9da43ee90cbbbe

SHA256
d9289e5e66e130a65d98477dcf39443900b9a2b4fd0fd64e8151b93ce01cc888

SHA512
a5549851d380e50ffd26a8d08a7df5ebc0772bff2d57ea23d3cd97dff684e21171d7091bde46859977519367ad3f79b11837c83a980b274298d62f4f9b9e0c8e

Download Submit
C:\Windows\INF\c_fsinfrastructure.PNF

Filesize
4KB

MD5
c2209e0020ef65b3ebe49069cfe8b525

SHA1
f93830c166c18659f0582a8c1d5875b830d6d393

SHA256
ce8a70bdc2d7e13d4537cf7c1e6b2d74bd45757dcd73fad39608d703b2ca57b0

SHA512
fe8103a9c9e7adfea203a9289743f56904dc7c2c104de5adc1bae4c61445d32985a851d1682379e463a9d0913342bcd3f3c11e07bc4a322a709d4d168dc48868

Download Submit
C:\Windows\INF\c_fsopenfilebackup.PNF

Filesize
4KB

MD5
66705c4194ca0e357222692a84931f16

SHA1
67ce189a44e9cc909b86d5cb0a5865c58a83ae88

SHA256
c3c9416b241b3e4abe519da5d9ce1215a0895f3738d8853bc88a506ae456d3b1

SHA512
3887d63376f1b3f15962af2b9a70a353680bbc60bc41c78759be58f43f8b1ae68a22060512122ffbd5b810e1e78d16095470459f915dce93e090da20d39ed943

Download Submit
C:\Windows\INF\c_fsphysicalquotamgmt.PNF

Filesize
4KB

MD5
b53d5ae6315e021f88639eef1333943b

SHA1
9993e3177afee20b83a433e81a9d16bb97252030

SHA256
28e16f039347ff0068e0d11ae63c659562c714b6be6faf138cb6bd5274fd1b33

SHA512
005bf69370b53d76dd0caff1ba4a98219443f50b7cba9639858dae4af8e1b1307ea4b69cdb930e6b5099a3a39fccd4a031a237f5a3ba39d9e3232b84bc5a5d6d

Download Submit
C:\Windows\INF\c_fsquotamgmt.PNF

Filesize
4KB

MD5
2ea2651b3c344e4ddca0bfe03eca2f30

SHA1
a77ac8cb0f1243c3f514092c9ed1ddd0028777ab

SHA256
f044f74b5ae8deb34300b9f2aec381c43aec963f29a3a4ec05e5e4da8657a84e

SHA512
e65adb0c5023d6eec509c56aa60aa78f2f354dbbe33136c85c48a5fbaec8ba61764d8d7474a7777bd70f88792b0854d4dd51f206da6ef24e6f478ec02c1a0592

Download Submit
C:\Windows\INF\c_fsreplication.PNF

Filesize
4KB

MD5
ba85117fc202f5bed9d5b71d354e0b10

SHA1
b57547e8e69c735f3cab60441a35a71f1e8fe01d

SHA256
a76a632a371dddfd3ae2db8cb772b8b49e07ed2d0fbf6c39002c6b519e760ca0

SHA512
9f37f800ad0aba6229d9fae19342679e6f8d2305572517615456165a9a6e179e9be8d48f53e435e8fbe61c67b559d8f2253bd81fc691dc51955afdf3b1492ccc

Download Submit
C:\Windows\INF\c_fssecurityenhancer.PNF

Filesize
4KB

MD5
751ee595e6413406542e942afc53b5c5

SHA1
6e61e623dc3e5b8f71119fa80ec360e2726f1909

SHA256
da227c04c725ecead208be92c7ef615af65fcb9c060271736007c536f7a1e158

SHA512
b3d15fc5c94d3f7ae401c2332de7e28e34861359bea06cdf8b90353b4be1dfd7196c0f7d1dabc6104884b4edc51a3f6144dc716b79b86b329d8586aa35f2897f

Download Submit
C:\Windows\INF\c_fssystem.PNF

Filesize
4KB

MD5
175da0f0176bd7f2a095cf0c8c60940e

SHA1
0c7029853e2057fb2afd6159740d623bd7d7dfcf

SHA256
61085a7726afd7ad7ab9f5904b2dc32aee52fb52a92053f3b797b77d54919a49

SHA512
eca642733c71e36ac6b0949f915aa509d07076bf0862662466bb9774cfae6e9f2a2e5aec06e1764ba31ccdd2579f2c54738ad9b5ca734ab5d272d1e20d3da673

Download Submit
C:\Windows\INF\c_fssystemrecovery.PNF

Filesize
4KB

MD5
6350635dbba3cf7ef1dff67029641906

SHA1
9b787ad5d5b08eb966bb073059c6aaa6bda1cf79

SHA256
d6ed46098d8dbb9ea3eb5bd58dafd5f5bbc4612070aa53d36da22b7ce076d2f4

SHA512
433b6c881309dc5a2d86e1be66f2052bacf938e10165e182c930431f277bbea881203427a6d64df9286e3574f88a711d1eb32983ffd0dcc7615b4a3c01668892

Download Submit
C:\Windows\INF\c_fsundelete.PNF

Filesize
4KB

MD5
1e48cffe04ac858e63879a513f2353fb

SHA1
e258c8296c0d5e6140bd518859ce7534c57be630

SHA256
ff38840ca301c3e46206a0ff362f97c31f9d5fd45a5776949006608768c12356

SHA512
f62d16bf73f2bce9340bd30d227a0d6d02d3e9ca85e1b3c06e0cf88d4da1a4465ef108b19b377ce67bfa4fc4f1b67721a68556ebad5fd064dd4f2f0be85a4714

Download Submit
C:\Windows\INF\c_fsvirtualization.PNF

Filesize
4KB

MD5
734db47959e726b33e607cc4fcb9f6b2

SHA1
ca775a0dbe2a0ef36aaffab79549ea4871858da8

SHA256
20818c37551a13af790ee62f5ca1d81f99959cbc30ef348fa4481d9c17cfacae

SHA512
1fd7e44f086f9fc4ba88c2dff180fed56d356ec46c06a2245e0531697d379a08d68e7b6edd75958bdb9834ecec19de3d7cbb56b7cbce6a3befdeca2bc7228f5a

Download Submit
C:\Windows\INF\c_holographic.PNF

Filesize
6KB

MD5
a4a376b7970cd8d9a55400d757126315

SHA1
0f82bf326a3c1c9ffe99e92c5a014df4098f7986

SHA256
5d3dcfb2fce261b867afc9227012e03e738165b03189f58e5a3aea2f3f0bd1cb

SHA512
369c87ec2048e6136d53826efa579ade05fa4fde1912b4d098440b9d9d45204ca98505696975d70ddacc9dd1668c7bc671b55538bc3a31039f77f93f8ed5eeeb

Download Submit
C:\Windows\INF\c_linedisplay.PNF

Filesize
3KB

MD5
c5819a4a73fdf3054d8cc7d5cc92cb74

SHA1
0334481608506d393b0521ce1ed3590faa09ffff

SHA256
a70b55200a8920292e9294a8613ec5a12c8b19beb69fd08c2869748cea2e6063

SHA512
60a4eb8269f58de6e19e276b816545aec9ea84f1a58e0fc4d67cb4051b114658be3b630fe4c813fb1bf3e5117444d53e0525c7631132649706da859f8e0a42a7

Download Submit
C:\Windows\INF\c_magneticstripereader.PNF

Filesize
3KB

MD5
998cf8b6890dad298dfb8ccb6fd83f08

SHA1
61522545b61316cef16e6708a8eb3fd6d8c00039

SHA256
260ce9aa7b91e4b9a9a680d20051f0a6839664f2c2166c3ea930db33b34b7cda

SHA512
fd9ce5bed4dc276660f48c091c2e037495d6279e62b4034036abc3dd54816ec99883c60fbc828055a8d4c6293e0aaaec3c44878bdd1e5f5b978dd095797c0a66

Download Submit
C:\Windows\INF\c_mcx.PNF

Filesize
4KB

MD5
4a052f260a8f4a6574bb7a09be64aef9

SHA1
0c2704a89a8d4ba5c4d9181d0ec9a2af875d5586

SHA256
27b265396f583f4beb66cdf0048377fcbfcd012e536d1944ee64927cce935141

SHA512
661ac6c159f960497ddf95ac48febd67f40150afd12c8a3ad9735e38e62b6309799d9f8995405e403a205b22a4a249994820870e1b2598bbd98f916359c81f3c

Download Submit
C:\Windows\INF\c_media.PNF

Filesize
12KB

MD5
395ac54156ecafcb0795ee9997fb4e70

SHA1
19944abadd2fb038699447451e190a55eed60da0

SHA256
c01865303aa01e981511773d495ab8e6f7f707ae0da173b9c362d5afb9aa20c7

SHA512
dda5718b7cb1d5c58c483af43a3c17daee23b47e82c50fcb025da1ef9fe97226123502be3b020554f0a6caa0b2c1d1fe113375a3dd445298f7d51bc7af71a7fd

Download Submit
C:\Windows\INF\c_monitor.PNF

Filesize
6KB

MD5
e36588021256e082993bab42ab69e669

SHA1
74d5739e17e2076cd6d84b760afd701cb5d8618f

SHA256
7ae11894327c4d37c65bf2f0df7e20e5a3b32aa4a8dc6de121fd080c703f5288

SHA512
d12da1d23f5e941e5dcb804be4be495337eb3001a1e8e0c44e45ca64f4f733910dda2293ab1e32345131eba3d0c5ddf172e86f3de4daea88cafd1335a70350a8

Download Submit
C:\Windows\INF\c_netdriver.PNF

Filesize
4KB

MD5
f4fe27de2751c54e8182f97f4f674a17

SHA1
c74331dcee394906b19c69db483cf0801d2df58b

SHA256
5ca6190fb35d719c553a852535aa5f0ede27537f2a257931e6fe4d5a2c34fc8a

SHA512
9a31d1c5d1c149a5b5536ee9c296854013a589fd500edac7f170d69195608f3d7f124cec332545236628957caa9c4d687192ec539c371d7e04be5ce1afcc3a1f

Download Submit
C:\Windows\INF\c_nvmedisk.PNF

Filesize
5KB

MD5
ad68d55efd5eb68b0434f842e17d4044

SHA1
3e705c88c791b403a4fa9bc789401d72afac2614

SHA256
e15384e7891c2a55e7277859cd6e45c47a6cce6a756e0eb7f31dac21c85043db

SHA512
64d8cbd6a364ebae99f01ef90ec1a1a7d2551475367afeb35caa16a9b8c812ba8b8c06f68a88e6dfe45d43d2608c01bc4985b8993c9951b5ce4399352982c594

Download Submit
C:\Windows\INF\c_primitive.PNF

Filesize
4KB

MD5
caf50de1d8a526e883b868a515abe119

SHA1
15969b9a07c632e5279caf507df1750e204d9112

SHA256
7c8f22023b0b0ffc7f87d7b41e877ef337e4aaafa6ac0e4d1d8cc96a1758088b

SHA512
9fd161c5d38c35173e5664955883d619dca75dc6169b935487cd903166217470a06733c5973b82e93a2589ef65cc3c306f1b06c382d8a46d32e62d9abb787178

Download Submit
C:\Windows\INF\c_processor.PNF

Filesize
5KB

MD5
82c526b7e39ff1e368c31cea940ad753

SHA1
1e706461f973e053c09c6b7b0609ac785a024685

SHA256
9911fe18c0ba32d5f27c076da0fa2d99895a2cad1f04da2c42d1477f272e423e

SHA512
eb1f2d1faaf892e7d627b418e3259268497cb710aea4abc56f9e070656dbb36c042ab8c037efeaed5f2bc47d62ce9d5c7082e9d851b4b9daa7af6d726cfdf42a

Download Submit
C:\Windows\INF\c_proximity.PNF

Filesize
5KB

MD5
901d51bae6564f83cba7d65788158424

SHA1
40859620c02c91270ee4cdd07715726febd1f67b

SHA256
7b00272bd88ebc67d42c9002b0581d959beb06e03adad5be120e4bef495b3a18

SHA512
8692e762e77ebd413b133120b0576de1e9054b295bb51a63288a21abe8d3b38ee9738da2876f6e23bb722bd1287b968bf76113aac9ba7ab2512561f3beb3eec6

Download Submit
C:\Windows\INF\c_receiptprinter.PNF

Filesize
3KB

MD5
c20ea00e5b7be7e26580200e28163f99

SHA1
f4b79527ef5256915cb35f962d746f42b7762e31

SHA256
e749baafda8c11af56ae4d20be987a85cd7dbca17a6f92471ee37159ce990635

SHA512
7134b55327155e6941303ebe762830d15d15173d6a123d89490321469461ce6228a4933a9145835de06f5cdb679507c9a0b96a4d276fbdeea347f4acb88a13ac

Download Submit
C:\Windows\INF\c_scmdisk.PNF

Filesize
6KB

MD5
e7fcca82e7530aa4e3d74b5af1bc0362

SHA1
25827af159e4f71eda92cb284610eeedd0560c73

SHA256
3b73dafaf553445859e9f20babac4ff4f92c9a062fd081c9776cf8ad99e2c5d1

SHA512
1babf1c97d4b04774ef7c15f1181e743ec86654299c383778deca9c750c6c43f611597691a62be9ae1fff6c20dc5efe8c44046a97441f3c2376bbf4ac79c5bc9

Download Submit
C:\Windows\INF\c_scmvolume.PNF

Filesize
4KB

MD5
171c9a1d9247e192d3162183608ffa00

SHA1
93a78706ab75a0dd29b153e87f021f373f355331

SHA256
170bed500d087b15e1da23530e7a041f6bc01d7bcf7d78fca49a276bcb339786

SHA512
583896d93b4ac0e16c50c34a140b8c10cc3ef9dd7d10ba42523290fd3dfdc855a724305222a582495fa609338287aa37c7e48ab270c3eee2758e777e7210228b

Download Submit
C:\Windows\INF\c_smrdisk.PNF

Filesize
6KB

MD5
3921574c9686597afbe25b4bfd6a4892

SHA1
0c1147c3f7db541128978083e75fb811dc1a5682

SHA256
803b88b7af8518ec35607eab378fbfb36159aedeb4a373cc900c0d5bd1c8e8c7

SHA512
c4828e14f2970d12980d8221bb02dc90872e0232b51e19880f13121e00f62cdcd4750497ac2cc2dd75cf20c2346b15e0c70ae3fde7a5c7e781870693e4ec3d0b

Download Submit
C:\Windows\INF\c_smrvolume.PNF

Filesize
4KB

MD5
3909b190b51590cfece17e3c4f1f62c7

SHA1
f6abfb4c3d25eaac25a61e7094f6615881390dfe

SHA256
7484a0bfb35a3f35da18e3d8741f769e77e2d5df68e0adbc3e7479286bc3a533

SHA512
53d0add21fc4857b103c17a22d44bf28575e5dea651fa11bec729830da0313ec69c5b0edf3d89d42fe69f2dfde71bc3032388e0aa0ed7bb56c98c689a6d2f2ce

Download Submit
C:\Windows\INF\c_sslaccel.PNF

Filesize
4KB

MD5
c8302a0aba1764abfe9a94938287bd6d

SHA1
443626db33f95146dc03a3d7a6c201683fa7a8f1

SHA256
0391195928365eedd1dfa10394db29def76e54050b9839c1e99bb279c710c246

SHA512
6a8e9bd19de1084210d1c3398979f299ae6a294052dc0bdc3db9a90f4665a7122cfa826d08d8144a2575225416cfb819d423c6dab0e82b9d845586c4b6f2c09f

Download Submit
C:\Windows\INF\c_swcomponent.PNF

Filesize
7KB

MD5
7a86355cbf01d975bb8522ccf24fc00d

SHA1
b9e62f28bf97acc8ea1cabd76ab83456f4ba2139

SHA256
205d35be699894663f589ffffeeae24151b7f87f21af3842b94cac9e8add2b32

SHA512
bb04d81497040a49277035430e0617a90feca616e8da2d37ea4ca9382eba7e3b249730c5bf0d817d2acf215cd36b08e139391723e9557ea64ebd8cf69b92f6f3

Download Submit
C:\Windows\INF\c_ucm.PNF

Filesize
4KB

MD5
57fe1c7d87eda80b49c2212c66127d7e

SHA1
f5ca14ec91b2f4f698aea0be731e14a5cee52ea7

SHA256
2b413b17c1146f272326763be55771dc031df2a2b88a6e0961c9b1fe40cc0394

SHA512
e1b750e10196cd827cee48118be0ba8781042dc6e08689f5529aa9c463953932bf7e8609eb16e6e4aa9511e6f94d547820bcc1e140cecb9ad0cc498f85511aad

Download Submit
C:\Windows\INF\c_volume.PNF

Filesize
4KB

MD5
90155cce4c8518a9a5d5626adc0c08b0

SHA1
32b3d7998f59146ce6967bdca29c117d45b2f037

SHA256
707eb52ac342e73dd49f89c4d3c9b0131865b13b8091896eb95fb5a06614edee

SHA512
1b799887c237f97a63e291437e3547558af71a04f06488dd08d4b970b0523bf4260fa8628adf294d0b066c52deccfbfa2f1c8409b724d4b0707a4ebfd6fadafc

Download Submit
C:\Windows\INF\dc1-controller.PNF

Filesize
14KB

MD5
5764ff4fd0b9a695f4e7ca809014650e

SHA1
034465ba09b161a6bb19acb373082bd58120ebf8

SHA256
a7eba32c169e06714194f4a22c5c0019c76bbed0b829fbfd1184f8bc963eb26e

SHA512
3e00b8fa788bb615671fd66a38063445ccb1e16e63a7fc8425ce7c64174befd79307cfd234c78e263f0a21f1ac38a96ec8df32263e520f4bad0da82857f2055c

Download Submit
C:\Windows\INF\digitalmediadevice.PNF

Filesize
7KB

MD5
288ec9208d0343c05c9beae0840b854c

SHA1
d9762c08917698101b73203b08f4b3e0ad6a1ffc

SHA256
ba0b8902fe58eccceaf45ceec51e25715adfdbc2debad80520883f0d6dbe49b0

SHA512
f34b5a716da147c25cdbbb38d83477039c4b0bc8da5b87459f5299a3723587a2a8634e4821f190f6c490f1d348985462cc1d1587fddb5348172575d65ca3621d

Download Submit
C:\Windows\INF\miradisp.PNF

Filesize
11KB

MD5
78545f12e26825b2b2d78e51197b8059

SHA1
145e6115ca4b4db77b44aeefe9e7eb948a5594bc

SHA256
a01beafe073451767de792bb87e157fc56d676b4340d345eab5010fe33c73ae9

SHA512
fd8d5f9fcdfa91e7e85e322b26823e46a0062fda00657a24268b45ddf367914518b57729562b4eed8895dfdb5d5e49f7e27b0b0533b9af6fe03dfeaf64ad1d7d

Download Submit
C:\Windows\INF\oposdrv.PNF

Filesize
8KB

MD5
35ba1978552e79e6a59713200cd0b29b

SHA1
8f8b9513a12a2e4a616819864702b1a1f31b7195

SHA256
266b1531b7a919f436a08296a87cb53c708a244d815fa6c9e873a31a02c6ddf5

SHA512
8676406c9028f70fe58a49898ab7bebc2950a79b65260d94e8d7faf930f2a25ce8fd0b5be705cc036f8361ddc85748ee482b9fafe1289fdf98f5cd32e42efe71

Download Submit
C:\Windows\INF\rawsilo.PNF

Filesize
8KB

MD5
2565bcbb1c9468a04f0ba73d0296a856

SHA1
8d7405e601685239695425a1e5a50cdf9b37aef6

SHA256
394b8c6140aa0ef90efb24e0297c54eeff0f29b85ae507f89d49b3bc2e548cea

SHA512
6702a8e0ad8eaabbe09dd59e9891f98220a2153d037cbe6b62ae305e760e4b50b65dbf233e703497d425c4d2e3e4e98956020bbdf93c29ba918659c02bc3250a

Download Submit
C:\Windows\INF\rdcameradriver.PNF

Filesize
13KB

MD5
743ae0cbc28be3c6114621cbce5c218a

SHA1
a4fe044a68e5acfe56a7640e6d2b6aac4fa52258

SHA256
6bbb1ce01939c11bc36dfb4f0a2b9b8010148aae99ea47b4b5fae54d735bb80e

SHA512
310c83d96b822a5c162e8f719ebc77f4ca363ff15a3d2b2554d8bee3ec4086e2a00bf310fc15ba11024b8a340784e33232cbac92dc68d8820237fb14ebdf9c8b

Download Submit
C:\Windows\INF\remoteposdrv.PNF

Filesize
8KB

MD5
ec71dadd49ec9dfcd541cb722e286a98

SHA1
c53d6f88741687e74aae69a4168fb233c3e07fab

SHA256
2f5cf47ded853f218edcb1029627cb8d5cdee67cef2f278ae25bf0eb372ba901

SHA512
4d1113baddb9ef268ed201f595e88fa187a8fb534f35f98755042cd8684cb07c6666795eaf0c10994c81b71572311417d208fe7540a860076ba5756a1bc380fb

Download Submit
C:\Windows\INF\ts_generic.PNF

Filesize
8KB

MD5
ff9f5c5eda08d3f9172d1acca4a2f4e5

SHA1
6e9c18e44e13ea022aad0b8b6f7c2f497555e72a

SHA256
3fa32686fffe98d47a8e559e3acd3191fad353ee8dd440506370203e9f2992ae

SHA512
a6d47b8a5a0427dab7dfe9d31fff157452ff7843c63c48e0cccbd276cda1b9cbae896fea465f598bd42faa86c2bf14cf8073bad8cf780875cbdb1f713b846826

Download Submit
C:\Windows\INF\wsdprint.PNF

Filesize
7KB

MD5
755db0bab7a1685b606d6581d9d8aea8

SHA1
aab7ef365c3b1e475420c89ce4842bd14439ddb4

SHA256
c9f9a311ab605d92754429f6cc398b64c9df5590ce49d729fbfa13a27c80f2c8

SHA512
f75e7c07b2a73315896f0ae1ba20f4cae76048e160c207f0a678786f7923d37e1ef3a846afe1a3a64a6dca809c5275de60c58622966b2ad7e4764473bed047e8

Download Submit
C:\Windows\INF\xusb22.PNF

Filesize
9KB

MD5
88e83ba628a3f022c3c65f54ae7c5cab

SHA1
400a45a53b172cdee93b030415ba7ac5c13e1f73

SHA256
c7b685f800b6b0e458d5cd7056b77ac67d5bde85f5deea12e48df424aae0f04a

SHA512
f126638112411a5b321e035cf842749d9f238f37b65fcc3eb4a4e5f842328aced2023a75a9045fd85b7dd46f4d0370b4a2a057ff3f625be106bff4ed933a9452

Download Submit
memory/2440-53-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2440-59-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2440-62-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2440-61-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2440-60-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2440-58-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2440-54-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2440-52-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/4044-6-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-10-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-0-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-9-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-11-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-12-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-1-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-2-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-8-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/4044-7-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/5512-126-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/5512-125-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/5512-133-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/5512-124-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/5512-134-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/5512-135-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/5512-132-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/5512-131-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads