eb801cd844edda6dc143c4f1f55ad41fe846310fa6dac989b04e8e6d19f717c8

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hw_report.ps1
Size 18KB
Sample260803-vrf5datfna
SHA256 eb801cd844edda6dc143c4f1f55ad41fe846310fa6dac989b04e8e6d19f717c8
MD5 791779e2948ec93987da0baebcb4d6c9
SHA1 0f9304fb32c9f5e95ec1fe1cf13c5401227a4ede
SHA512 e98f37a53cd5d738229864d7b0cf86f842646b5f6c3a33fd27b4d5728786f5c7578b1d25cd869774afcf9214a60bb6fa20389687bd5a7319e7650c0193ff7ec4
SSDEEP 192:uc4EsQ3MP4Epv5esUe46dhFMdq1qvCvD9TYAJjdiJlG6IHzmEXEL8LJwAXsCqzSZ:mRPvwPelhFx5rBYY4vG6iDLtXz+Ulvv
TLSH
T1C682D510B79EE825C2D34255AA79BD81EF2141765278085C729C594FFFF780283FBAE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit execution persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	nwinfo.exe
File opened (read-only)	\??\R:	nwinfo.exe
File opened (read-only)	\??\T:	nwinfo.exe
File opened (read-only)	\??\Z:	nwinfo.exe
File opened (read-only)	\??\S:	nwinfo.exe
File opened (read-only)	\??\H:	nwinfo.exe
File opened (read-only)	\??\L:	nwinfo.exe
File opened (read-only)	\??\P:	nwinfo.exe
File opened (read-only)	\??\U:	nwinfo.exe
File opened (read-only)	\??\V:	nwinfo.exe
File opened (read-only)	\??\W:	nwinfo.exe
File opened (read-only)	\??\Y:	nwinfo.exe
File opened (read-only)	\??\A:	nwinfo.exe
File opened (read-only)	\??\B:	nwinfo.exe
File opened (read-only)	\??\G:	nwinfo.exe
File opened (read-only)	\??\M:	nwinfo.exe
File opened (read-only)	\??\N:	nwinfo.exe
File opened (read-only)	\??\O:	nwinfo.exe
File opened (read-only)	\??\Q:	nwinfo.exe
File opened (read-only)	\??\X:	nwinfo.exe
File opened (read-only)	\??\D:	nwinfo.exe
File opened (read-only)	\??\I:	nwinfo.exe
File opened (read-only)	\??\J:	nwinfo.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	nwinfo.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\SET6122.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\SET6123.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\SET6112.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\pawnio.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\PawnIO.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF	PawnIOSetup.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\SET6112.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\SET6122.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}\SET6123.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{98799509-704d-c54b-8e67-caac168c1b35}	DrvInst.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.h	PawnIOSetup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.dll	PawnIOSetup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOUtil.exe	PawnIOSetup.exe
File created	C:\Program Files\PawnIO\uninstall.exe	PawnIOSetup.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIOSetup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIOSetup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1996	PowerShell.exe

Checks SCSI registry key(s) 3 TTPs 50 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	nwinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	nwinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	nwinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	nwinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	nwinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	nwinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	PawnIOSetup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nwinfo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	nwinfo.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1996	PowerShell.exe
1996	PowerShell.exe
1996	PowerShell.exe
1996	PowerShell.exe
1996	PowerShell.exe
3508	nwinfo.exe
3508	nwinfo.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3508	nwinfo.exe
Token: SeLoadDriverPrivilege	3508	nwinfo.exe
Token: SeLoadDriverPrivilege	1192	PawnIOSetup.exe
Token: SeLoadDriverPrivilege	1808	DrvInst.exe
Token: SeLoadDriverPrivilege	1808	DrvInst.exe
Token: SeLoadDriverPrivilege	1808	DrvInst.exe
Token: SeLoadDriverPrivilege	3108	PawnIOSetup.exe
Token: SeLoadDriverPrivilege	3108	PawnIOSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 3460	1996	PowerShell.exe	90
PID 3460 wrote to memory of 5544	3460	csc.exe	91
PID 1996 wrote to memory of 4244	1996	PowerShell.exe	92
PID 4244 wrote to memory of 5388	4244	csc.exe	93
PID 1996 wrote to memory of 3508	1996	PowerShell.exe	94
PID 3508 wrote to memory of 1192	3508	nwinfo.exe	95
PID 3508 wrote to memory of 3108	3508	nwinfo.exe	102

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\hw_report.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1w33kexf\1w33kexf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42CC.tmp" "c:\Users\Admin\AppData\Local\Temp\1w33kexf\CSCFA0081CEBBB3448EB925F7E54A6DFE50.TMP"
    3⤵
    PID:5544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\145uxmf1\145uxmf1.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47DD.tmp" "c:\Users\Admin\AppData\Local\Temp\145uxmf1\CSC404194878B984EB89761F3652104489.TMP"
    3⤵
    PID:5388
- C:\Users\Admin\AppData\Local\Temp\nwinfo.exe
  "C:\Users\Admin\AppData\Local\Temp\nwinfo.exe" --format=json --cp=utf8 --human --sys --cpu --uefi --gpu --display --smbios --net=phys --disk=phys --audio
  2⤵
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Users\Admin\AppData\Local\Temp\PawnIOSetup.exe
    PawnIOSetup.exe -install -silent
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\PawnIOSetup.exe
    PawnIOSetup.exe -uninstall -silent
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3108

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c173af59-7011-9d49-bb07-024b304b58ea}\pawnio.inf" "9" "4c553107b" "0000000000000170" "WinSta0\Default" "0000000000000130" "208" "c:\windows\temp\pawnio_9d82f6af.tmp"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2124

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf" "oem1.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000194" "1e79"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PawnIOLib.dll

Path C:\Program Files\PawnIO\PawnIOLib.dll
Size 38KB
SHA256 d71f62627d66983bb9f5b1c269f27bcd8c1b8a46e794377a6330f84c198f4443
MD5 ab63195d7f5d470d39284cbee5bd57f7
SHA1 f438797c5724e7142264697072f6ae7f161dabc6
SHA512 9c007911a6ee4c800a98883ee44de1dc78a879048c93b415d114f3095d386fa83fb5d10edda0e025e0b821612c528444b136b40e35a6ca8aaa508bb373e702ed
SSDEEP 384:kmbKFNL+YuMHvWcbAPZr0YLShbjdAA1m5wMPU5uEuo+:krFNLic+cbgfShbxf1mlP5EB+
TLSH
T1A4037C9B8104528BEDA7DEB482CBDA1FBC3877432B6105EBA1D9C0581D41BC5B33667A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIOLib.h

Path C:\Program Files\PawnIO\PawnIOLib.h
Size 4KB
SHA256 307e64aa72e30fb9e0b9c637390a035d691e306be8a0048b30a94904e8e52726
MD5 49806e372ac9298c0945cf10af49a4d7
SHA1 23c2db9744752cd72ab283d3a9892c193fffcaf7
SHA512 e20d81c21f3271aa7b45b6ae32ccb58ca6ea90637c7133361632132d75650a9d9c236597cf22d4ba9e5d1caf00dee2d66d8e75db7459947bf8ea969e47e3406c
SSDEEP 48:22dJyRhdr1/Qnv/nJQn0Q4pECqGn+d3qGn+IqGn+bQBFLTpEyqGncKjqGn68ssBF:HJyRbJKvuduIubOFj4nSeo
TLSH
T1FA91FEA9851701BFBE3974D165BA94E3536A0FA3D24387C2F1FC4F653928022D2976CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIOUtil.exe

Path C:\Program Files\PawnIO\PawnIOUtil.exe
Size 308KB
SHA256 8f26e2e55df2faffda3988d915e7fde769e011eae854d981dccfece3efbca1bc
MD5 ceeae5fa19ad0c320b56f7d897dcf788
SHA1 e3993cbfed20d8fa68c2cf81529a59487e498d29
SHA512 249a09579173b8a4c2aaa009cbda1ad6fd5a21691502232e0db2be5ece27a08e3043ce6bd3175caf63df809a002285b1dda39f2478eeec9495fd3f2a56f554ed
SSDEEP 3072:hmophLOjtksJn5Odvm64vNtVvVsbvk1Z1fs93f758+Ewzr8ewAfKpYjpSaxBV:1ORkWn5ORmvR9MLP75dBmUn
TLSH
T1F2647D55B3A40CF9EDB7823EC9524506DA727C065760E7CF03A0469A2F277E05E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\PawnIO\uninstall.exe
Size 3.3MB
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

145uxmf1.dll

Path C:\Users\Admin\AppData\Local\Temp\145uxmf1\145uxmf1.dll
Size 3KB
SHA256 6a4b682920c3177988991ef3c4b517430aaea50375ad4e655cc0a9466e195638
MD5 927f9cd8d1e513c78855f6f52a54dd6f
SHA1 31e4c6945c19399030790bbe6f60977a02ed9928
SHA512 3e70ad468d698449fe32d14aa31e314f5b8788e07e22bb8543332ab603e86ace3aa76c687c05f7a1eda25b45654ae051a2207ac932d739dabe7263e1677d0649
TLSH
T14D712F1687EA4637E0AB0B346EF30B0BA774FC608F73935F19D5031AAC506705A35BA6
MD5 SHA1 SHA512 TLSH

Submit Download

1w33kexf.dll

Path C:\Users\Admin\AppData\Local\Temp\1w33kexf\1w33kexf.dll
Size 3KB
SHA256 1b3f75638397f5df385d6af6cf55ad92ed7a9b9ebca4964b0ee9ad4e3206e5ac
MD5 908bd57b5d5f79b36e336286340344cb
SHA1 4c052b6469c24b617f95deaf18d52b2c8ab82da8
SHA512 677b2f85dc45b166971aeb875ac7a5b507eb4d98673db2fc218eb7629dfe0ed949bb3a955279d5ac3956eac6d4c8ad7f43830f97c164fcec6fb94ea3afb73d40
TLSH
T13A51DC0BA7E8456BE4730B34ADF307577BB4FC109BB3576A49800268AC607685E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES42CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES42CC.tmp
Size 1KB
SHA256 5f174593065635da7a376b9db2c666120216b12409499ae19d0ab0bab26814b8
MD5 0bba7d01d53ccecc446d12b8e2cb959a
SHA1 538a8a6bd4f2572e32a8dd33888138a8ad422e63
SHA512 2a0659943a0a8070037c9d46e1df1745a97b0bc5059ca99c7cb3b4bd08314be6aa863e709bda9bcda7d71cb9f519c03894f9d77c438aaf779a5018c691573cce
TLSH
T1B5211F0183E8471EF0775732A9F6271FA674FC15DFA29B5B854042282C51504EFE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES47DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES47DD.tmp
Size 1KB
SHA256 b6aa975ac6af4e2089322e7a29ccbfbaebb2fbbc7947f4bd0d820f6ff32ac9ed
MD5 57fb4f52de854b32a2301a0f5f492bb8
SHA1 33729514b97329d39ee1e2d143feed8e47046cdf
SHA512 7f0e89bd72b3bfdeab4fc8fc7f6d0b90f96fd728d604699deafab3a308abeb210ac29acf61712ec1b1b0a3a6a7e4d05e4d209e32a46cfdb8e2f0cf203246dc3f
TLSH
T17A21890553ED4B1FF0734731B9FA176FA675FD54AFA2A75A884042292C42104EEA0BB3
MD5 SHA1 SHA512 TLSH

Submit Download

pawnio.inf_amd64_a72a2f969b8b7496.ini

Path C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini
Size 413B
SHA256 48d98061a8c7975b2af6bf287ca7a5699b7cdd79ef0ce2297113fe5143f540c9
MD5 da255efbac20bcf935df193896095556
SHA1 919efd539f65e5580cd0252f794e0632fe1f7e31
SHA512 986acf3ad35e9fd4eed50dd9240f08acc2b22958b8c486fa4168379dc9f34bb6c67d208fd17f8c36b58411b772f04e8cedbbacbcbc58688a20e980b71b28fa51
TLSH
T158E0224301BD08DF8803634BA21A78688615B0A90473EF90FA429BE29643D030FDDD22
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.inf

Path C:\Windows\Temp\PawnIO_9D82F6AF.tmp\PawnIO.inf
Size 1KB
SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
MD5 0a33770fb7ac5bdf673e6d1bb78adc61
SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
TLSH
T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.sys

Path C:\Windows\Temp\PawnIO_9D82F6AF.tmp\PawnIO.sys
Size 133KB
SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
MD5 a9ebaa64ddefba4f4ad3b3071c582a24
SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
TLSH
T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pawnio.cat

Path C:\Windows\Temp\PawnIO_9D82F6AF.tmp\pawnio.cat
Size 11KB
SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
MD5 8045cc5d557423c7cef1ddc814abe8a3
SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
TLSH
T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

145uxmf1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\145uxmf1\145uxmf1.0.cs
Size 815B
SHA256 eb1e65482ef21c9139b140f62f77b65689a3b606831d35b3db88848023ae3ed4
MD5 84a746e4be4f6f3eaa1d5f65dc58ba45
SHA1 5e0bbfa876e18991448c1038d324217564a3ff23
SHA512 360f0d7937764958ffc5a9991a262070cdbc6ee7e138f903dbc4fab80d5ff8d8fc1d1aa8baa932a0cc9fb74d1b427df9d26624643fa0efa0e1d8be0216287f4d
TLSH
T14E018E297AC3D2694E450B0BCFB84E5BFD03707D27350C15AB9C61115D8A05192BEE87
MD5 SHA1 SHA512 TLSH

Submit Download

145uxmf1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\145uxmf1\145uxmf1.cmdline
Size 482B
SHA256 3b89d88f43497f6f51277510cf8fb17d3a504d623c47e0c52209deab93c91645
MD5 7454556e8fc1b98ce18e0dc3f1458753
SHA1 03b0f9d28ae74d09e1e4401fb6839c256a622846
SHA512 a61567ff544b64a64d01896abcfd2460f415a8807f676e51a56bb508321aa70f581e649d32cd3ac45df72fa6cc7d197be83ff8b9b9eb5f931e16f8545daee849
TLSH
T1DDF09E36122AC6FD55DD2007156DC8FCD332138728826F886584C45DE6170441B91766
MD5 SHA1 SHA512 TLSH

Submit Download

CSC404194878B984EB89761F3652104489.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\145uxmf1\CSC404194878B984EB89761F3652104489.TMP
Size 652B
SHA256 dfe118fc8a1dfe9192ee45fc27e9c94ccf27751260f61dbfd1bc7f2820816fa9
MD5 dfcfa99b10b9ffa0005e789abe2c7d1d
SHA1 ce50eec3566754d2c2140920eb45bd9225d242ef
SHA512 51967173334707dad62fbd7d1d8f4d84ea0fba678907437b352774bbf2398e046833423f5ad238bbfa151d59b8204d1c72973d4e030651ebdbc7b660107d518a
TLSH
T186F05E0963FC120EF0F34B30BEF64367A5A9BC65DE32A3ED144003192864510C962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

1w33kexf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1w33kexf\1w33kexf.0.cs
Size 211B
SHA256 6b5684e5faae6ed7e7d7aac53b635d8ea3c08837b9cb1bf966f3e3588a995c54
MD5 593697e8b45b2bd3a542dfacbbdaf247
SHA1 28a9a089a83685627d39f5aab6ed345cbb4ebe79
SHA512 93a3f6c661508911acb10a71d89f0b0df00fbdd3d9541df2f7381a1d6718bb6e8e8dd2e5581ec9653b6e26d097194abc197eb78f158a386d1032aca26de54656
TLSH
T161D0230C77F79D75401300130D46A679B717813B259D250579A80300EF8700F417DB15
MD5 SHA1 SHA512 TLSH

Submit Download

1w33kexf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1w33kexf\1w33kexf.cmdline
Size 369B
SHA256 de0fb42e23f6713b5964f430cc0dafad95644850d41d77d8580756460aa55e5d
MD5 1a58704616cf31a6222ffca70941809c
SHA1 355a90767ecdea85f014729211d9d2b21ea3da28
SHA512 31ec3ac2f71ad29c761da8e498d646818b90c42df47dd9346a2590ba9b595e5753e617f7b40f18f6fcbda5ffbe4e70b7de65579e98b91d1425f98e1dc53d7fa1
TLSH
T1AAE0683B5347C67D31F9240F226DEBACEA760A4329843F945080C40DD01700027D2B41
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFA0081CEBBB3448EB925F7E54A6DFE50.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1w33kexf\CSCFA0081CEBBB3448EB925F7E54A6DFE50.TMP
Size 652B
SHA256 b6a948bf0d466ccad3ab21a47c44bb79d788f376ac70a0432c0ed63c23ed89c2
MD5 d5ac930831c398678b2d8496297b56cd
SHA1 5556f840065e9dc43902c6dab1927d60e7577d61
SHA512 2462edb0cbada2bddc95e1d5f079c8763bb24e598a42df2cbc918698e8b7d3f4f2d919a09f165134ed9dc2e61654594fc61704ea17d657a3da3771cb11545f80
TLSH
T12AF0820963F8020EF0F34B34BDF65363A5A8BC65DE3297ED5480036D2C645148A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1192-94-0x000001E56DE00000-0x000001E56DE49000-memory.dmp

Download

memory/1996-9-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-6-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-29-0x00000292A8980000-0x00000292A89BE000-memory.dmp

Download

memory/1996-0-0x00007FFE601FF000-0x00007FFE60200000-memory.dmp

Download

memory/1996-43-0x00000292A8940000-0x00000292A8948000-memory.dmp

Download

memory/1996-17-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-15-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-14-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-11-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-10-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-4-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-8-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-30-0x00000292A48C0000-0x00000292A48CE000-memory.dmp

Download

memory/1996-27-0x000002928C100000-0x000002928C108000-memory.dmp

Download

memory/1996-7-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-118-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-117-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-116-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-115-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-114-0x00000292A7BB0000-0x00000292A7BB8000-memory.dmp

Download

memory/1996-112-0x00000292A9550000-0x00000292A9A78000-memory.dmp

Download

memory/1996-28-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-111-0x00000292A8E50000-0x00000292A9012000-memory.dmp

Download

memory/1996-5-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/1996-3-0x000002928C2C0000-0x000002928C2E2000-memory.dmp

Download

memory/3508-95-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download

memory/3508-103-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download

memory/3508-104-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download

memory/3508-105-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download

memory/3508-106-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download

memory/3508-101-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download

memory/3508-102-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download

memory/3508-97-0x000001F0949B0000-0x000001F0949B1000-memory.dmp

Download