Overview

overview

8

Static

static

1

CyberGhost...up.exe

windows7-x64

3

CyberGhost...up.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 00:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CyberGhostVPNSetup.exe

  • Size

    127KB

  • MD5

    fd093f3100a56b710c50d41667da7e2b

  • SHA1

    5ec9063e4380f642d2a551da76fd4d3f00fd4c96

  • SHA256

    f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58

  • SHA512

    d3daebf6e3669a4b2a944e60d97c86fd31878cea66e252f05ea8d23f92c1f02ef8e6f4dda250b979a9b9df3fa71dc43c4ab98e2cae52e7687861d1e9a3dd09c0

  • SSDEEP

    3072:ACNd5JY06+ywjDnJShh8N7JNzFrxO/DLxPO4GV:TNVPtVQ7LtOz

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Program Files\7a5b54fd-f883-46fe-a3b2-8455044557fd\81d3716f-204f-45bd-8e3e-26110982dad7.exe
      "C:\Program Files\7a5b54fd-f883-46fe-a3b2-8455044557fd\81d3716f-204f-45bd-8e3e-26110982dad7.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4908
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3892

    Network

    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      download.cyberghostvpn.com
      CyberGhostVPNSetup.exe
      Remote address:
      8.8.8.8:53
      Request
      download.cyberghostvpn.com
      IN A
      Response
      download.cyberghostvpn.com
      IN A
      104.20.1.14
      download.cyberghostvpn.com
      IN A
      104.20.0.14
    • flag-us
      GET
      https://download.cyberghostvpn.com/windows/webinstaller/8/WebInstaller.exe
      CyberGhostVPNSetup.exe
      Remote address:
      104.20.1.14:443
      Request
      GET /windows/webinstaller/8/WebInstaller.exe HTTP/1.1
      Host: download.cyberghostvpn.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 10 Jun 2024 00:55:27 GMT
      Content-Type: application/octet-stream
      Content-Length: 5293784
      Connection: keep-alive
      x-amz-id-2: 7JhdPJ14+HH+RjXMZuJpQ6xac6RsYy0GZScVILpYEuT8PIIb+isvaGlat4ClBYJduT+bW0PF5Y4=
      x-amz-request-id: 6KYCQNCFVG8196KV
      Last-Modified: Thu, 14 Sep 2023 08:28:03 GMT
      ETag: "72540194bd451dac050609406eb50a56"
      x-amz-server-side-encryption: AES256
      Cache-Control: public, max-age=31536000
      CF-Cache-Status: HIT
      Age: 1135991
      Expires: Tue, 10 Jun 2025 00:55:27 GMT
      Accept-Ranges: bytes
      Set-Cookie: _cfuvid=C5qEceiTncvJr8wYVEJ5t7l7pNCLtxC4.VzhEF8YqGI-1717980927648-0.0.1.1-604800000; path=/; domain=.cyberghostvpn.com; HttpOnly; Secure; SameSite=None
      Server: cloudflare
      CF-RAY: 8915655db8b77717-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      14.1.20.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.1.20.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.1.20.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.1.20.104.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      23.149.64.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.149.64.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      75.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      75.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      233.38.18.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      233.38.18.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      api.cyberghostvpn.com
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      Remote address:
      8.8.8.8:53
      Request
      api.cyberghostvpn.com
      IN A
      Response
      api.cyberghostvpn.com
      IN A
      104.20.1.14
      api.cyberghostvpn.com
      IN A
      104.20.0.14
    • flag-us
      GET
      https://api.cyberghostvpn.com/cg/status/ping?flags=0
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      Remote address:
      104.20.1.14:443
      Request
      GET /cg/status/ping?flags=0 HTTP/1.1
      Authorization: OAuth realm="api.cyberghostvpn.com", oauth_version="1.0", oauth_timestamp="1717980939", oauth_signature_method="PLAINTEXT", oauth_consumer_key="", oauth_signature="%26"
      Content-Type: application/json
      User-Agent: MC OAClient (8.4.2.78)
      Host: api.cyberghostvpn.com
      Accept-Encoding: gzip, deflate
      Connection: Close
      Response
      HTTP/1.1 200 OK
      Date: Mon, 10 Jun 2024 00:55:41 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: close
      x-frame-options: SAMEORIGIN
      strict-transport-security: max-age=31536000; includeSubdomains; preload
      x-xss-protection: 1; mode=block
      referrer-policy: strict-origin
      permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
      x-content-type-options: nosniff
      content-security-policy: default-src 'self'; font-src *;img-src * data:; script-src *; style-src *
      feature-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
      CF-Cache-Status: DYNAMIC
      Set-Cookie: _cfuvid=fqHORf8IRD5F67C_hmZgKGmTlezuBXr2MXkxKI5k9Ew-1717980941117-0.0.1.1-604800000; path=/; domain=.cyberghostvpn.com; HttpOnly; Secure; SameSite=None
      Server: cloudflare
      CF-RAY: 891565b1ce7194a9-LHR
      Content-Encoding: gzip
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://api.cyberghostvpn.com/cg/status
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      Remote address:
      104.20.1.14:443
      Request
      GET /cg/status HTTP/1.1
      User-Agent: CyberGhost MPLib
      Host: api.cyberghostvpn.com
      Response
      HTTP/1.1 200 OK
      Date: Mon, 10 Jun 2024 00:55:43 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 631
      Connection: keep-alive
      x-frame-options: SAMEORIGIN
      strict-transport-security: max-age=31536000; includeSubdomains; preload
      x-xss-protection: 1; mode=block
      referrer-policy: strict-origin
      permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
      x-content-type-options: nosniff
      content-security-policy: default-src 'self'; font-src *;img-src * data:; script-src *; style-src *
      feature-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
      CF-Cache-Status: DYNAMIC
      Set-Cookie: _cfuvid=NhCA8lIae_hhvRYJmeWT6NEVKbinbEXnvAL2hNcl5O8-1717980943886-0.0.1.1-604800000; path=/; domain=.cyberghostvpn.com; HttpOnly; Secure; SameSite=None
      Server: cloudflare
      CF-RAY: 891565c2fcc3954a-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      feedback.cyberghostvpn.com
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      Remote address:
      8.8.8.8:53
      Request
      feedback.cyberghostvpn.com
      IN A
      Response
      feedback.cyberghostvpn.com
      IN A
      104.20.0.14
      feedback.cyberghostvpn.com
      IN A
      104.20.1.14
    • flag-us
      POST
      https://feedback.cyberghostvpn.com/v2/feedback/
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      Remote address:
      104.20.0.14:443
      Request
      POST /v2/feedback/ HTTP/1.1
      Content-Type: application/json
      Host: feedback.cyberghostvpn.com
      Content-Length: 284
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 10 Jun 2024 00:55:44 GMT
      Content-Type: application/json; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Access-Control-Allow-Headers: Content-Type,Authorization,X-APP-KEY,X-DEVICE-ID,X-DEVICE-SECRET,X-MACHINE-ID,X-MACHINE-NAME,X-PASSWORD
      Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
      Access-Control-Allow-Origin: *
      Access-Control-Max-Age: 86400
      Cache-Control: max-age=0
      Expires: Mon, 10 Jun 2024 00:55:44 GMT
      Set-Cookie: FEEDBACK=-wgzgFTkuiSkci5jX3SRc; secure; HttpOnly
      Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
      X-Frame-Options: SAMEORIGIN
      X-Powered-By: PHP/7.2.34
      X-Record-Count: 6
      X-Status: SUCCESS
      CF-Cache-Status: DYNAMIC
      Set-Cookie: _cfuvid=0StsdzlkTqg_tPVRSLzVLZl7BjMTno.GklEsrEeed.Q-1717980944310-0.0.1.1-604800000; path=/; domain=.cyberghostvpn.com; HttpOnly; Secure; SameSite=None
      Server: cloudflare
      CF-RAY: 891565c53c779437-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.0.20.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.0.20.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      252.15.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      252.15.104.51.in-addr.arpa
      IN PTR
      Response
    • 104.20.1.14:443
      https://download.cyberghostvpn.com/windows/webinstaller/8/WebInstaller.exe
      tls, http
      CyberGhostVPNSetup.exe
      159.7kB
       5.5MB
       2735
      3938

      HTTP Request

      GET https://download.cyberghostvpn.com/windows/webinstaller/8/WebInstaller.exe

      HTTP Response

      200
    • 104.20.1.14:443
      https://api.cyberghostvpn.com/cg/status/ping?flags=0
      tls, http
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      1.1kB
       6.8kB
       10
      10

      HTTP Request

      GET https://api.cyberghostvpn.com/cg/status/ping?flags=0

      HTTP Response

      200
    • 104.20.1.14:443
      https://api.cyberghostvpn.com/cg/status
      tls, http
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      903 B
       2.1kB
       8
      8

      HTTP Request

      GET https://api.cyberghostvpn.com/cg/status

      HTTP Response

      200
    • 104.20.0.14:443
      https://feedback.cyberghostvpn.com/v2/feedback/
      tls, http
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      1.3kB
       7.3kB
       12
      13

      HTTP Request

      POST https://feedback.cyberghostvpn.com/v2/feedback/

      HTTP Response

      200
    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      download.cyberghostvpn.com
      dns
      CyberGhostVPNSetup.exe
      72 B
       104 B
       1
      1

      DNS Request

      download.cyberghostvpn.com

      DNS Response

      104.20.1.14
      104.20.0.14

    • 8.8.8.8:53
      14.1.20.104.in-addr.arpa
      dns
      140 B
       132 B
       2
      1

      DNS Request

      14.1.20.104.in-addr.arpa

      DNS Request

      14.1.20.104.in-addr.arpa

    • 8.8.8.8:53
      23.149.64.172.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      23.149.64.172.in-addr.arpa

    • 8.8.8.8:53
      75.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      75.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      233.38.18.104.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      233.38.18.104.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      api.cyberghostvpn.com
      dns
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      67 B
       99 B
       1
      1

      DNS Request

      api.cyberghostvpn.com

      DNS Response

      104.20.1.14
      104.20.0.14

    • 8.8.8.8:53
      feedback.cyberghostvpn.com
      dns
      81d3716f-204f-45bd-8e3e-26110982dad7.exe
      72 B
       104 B
       1
      1

      DNS Request

      feedback.cyberghostvpn.com

      DNS Response

      104.20.0.14
      104.20.1.14

    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      14.0.20.104.in-addr.arpa
      dns
      70 B
       132 B
       1
      1

      DNS Request

      14.0.20.104.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      252.15.104.51.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      252.15.104.51.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7a5b54fd-f883-46fe-a3b2-8455044557fd\81d3716f-204f-45bd-8e3e-26110982dad7.exe
      Filesize

      5.0MB

      MD5

      72540194bd451dac050609406eb50a56

      SHA1

      57c33ec10f90f81f6abc612b4d251510c36ebd6b

      SHA256

      3a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74

      SHA512

      ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tmp1539.tmp
      Filesize

      2KB

      MD5

      647f843626b023aaaa748f924f95ac25

      SHA1

      652cacf99409e3dcd39b6eb8839c16d22b1800e8

      SHA256

      732dee732e0261afbfba21eca43008a5009cfc9e4c405ece8826a9746564cceb

      SHA512

      61093dcbe07efa5bdffec4933243168bf40b8159bc5a9840552bc3ea8e7c129156276a8548c658e5267bf0b8c4448dcb5c8ab10140c72ed48eb8910c075022fa

      Download Submit

    • memory/2960-0-0x00007FFEAC103000-0x00007FFEAC105000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2960-1-0x0000000000190000-0x00000000001B2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2960-2-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2960-3-0x000000001BD10000-0x000000001BED2000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/2960-4-0x000000001C410000-0x000000001C938000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/2960-101-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2960-100-0x00007FFEAC103000-0x00007FFEAC105000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4908-67-0x000002C2339F0000-0x000002C2339F8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-69-0x000002C233A90000-0x000002C233A98000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-54-0x000002C218690000-0x000002C218698000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-55-0x000002C2328E0000-0x000002C232974000-memory.dmp

      Filesize

      592KB

      Download

    • memory/4908-56-0x000002C218600000-0x000002C21860A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4908-57-0x000002C2186A0000-0x000002C2186AA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4908-58-0x000002C2329C0000-0x000002C232A60000-memory.dmp

      Filesize

      640KB

      Download

    • memory/4908-59-0x000002C2186E0000-0x000002C2186FA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4908-60-0x000002C232B50000-0x000002C232B96000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4908-61-0x000002C218700000-0x000002C21870E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4908-62-0x000002C232CE0000-0x000002C232D0A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/4908-63-0x000002C2328B0000-0x000002C2328B8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-64-0x000002C232FF0000-0x000002C232FF8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-65-0x000002C233350000-0x000002C233358000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-66-0x000002C233950000-0x000002C233958000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-52-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4908-68-0x000002C233A50000-0x000002C233A58000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-71-0x000002C233C90000-0x000002C233C98000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-70-0x000002C233C30000-0x000002C233C38000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-53-0x000002C2185D0000-0x000002C2185D8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-72-0x000002C233D70000-0x000002C233D78000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-73-0x000002C233DF0000-0x000002C233DF8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-74-0x000002C233F50000-0x000002C233F66000-memory.dmp

      Filesize

      88KB

      Download

    • memory/4908-75-0x000002C236510000-0x000002C236518000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-76-0x000002C236520000-0x000002C236528000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-77-0x000002C2365E0000-0x000002C236618000-memory.dmp

      Filesize

      224KB

      Download

    • memory/4908-78-0x000002C2365A0000-0x000002C2365AE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4908-79-0x000002C236A30000-0x000002C236A68000-memory.dmp

      Filesize

      224KB

      Download

    • memory/4908-80-0x000002C236A70000-0x000002C236AAA000-memory.dmp

      Filesize

      232KB

      Download

    • memory/4908-51-0x000002C232710000-0x000002C2327A6000-memory.dmp

      Filesize

      600KB

      Download

    • memory/4908-95-0x000002C2386C0000-0x000002C2386E2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4908-96-0x000002C2365B0000-0x000002C2365BA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4908-97-0x000002C2386F0000-0x000002C23872A000-memory.dmp

      Filesize

      232KB

      Download

    • memory/4908-98-0x000002C238730000-0x000002C2387E2000-memory.dmp

      Filesize

      712KB

      Download

    • memory/4908-99-0x000002C236AB0000-0x000002C236AC2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/4908-50-0x000002C217D20000-0x000002C218230000-memory.dmp

      Filesize

      5.1MB

      Download

    • memory/4908-49-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4908-102-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4908-103-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.