Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\6a7ab05b-f62b-4a0d-bffc-b382ddf2fb26] 'ImagePath' = '%WINDIR%\iprot\6a7ab05b-f62b-4a0d-bffc-b382ddf2fb26\PhysMem.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\6a7ab05b-f62b-4a0d-bffc-b382ddf2fb26] 'Start' = '00000001'
- %WINDIR%\iprot\6a7ab05b-f62b-4a0d-bffc-b382ddf2fb26\PhysMem.sys