654a286d076e81869399959d8700c68883300e07ef5f8ad7ef4f38ee15b02221

Analysis

max time kernel
584s
max time network
586s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
22/07/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Size

119KB
MD5

92afa514c40cbcfab9380561b127f657
SHA1

eea59b3b1ba3ec27d80968aec0642956647dc047
SHA256

654a286d076e81869399959d8700c68883300e07ef5f8ad7ef4f38ee15b02221
SHA512

adff54cfc926474012e8ea02a7a76dec486f299142ddb643d636250d9e69bffb902d252956fd4a82e0b395de2a470e201f9d1f10a60384563121be0b6ae78da6
SSDEEP

3072:3SojD9bzGtzJShh8N7q5AdYGgbVileLxBp/B6:CojxOzPtq5di0L3FB6

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET220A.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET220A.tmp	DrvInst.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc040000000100000010000000c759d588bceb1c8a8c8a4d2c00103ba10f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617531400000001000000140000009afe50cc7c723e76b49c036a97a88c8135cb6651190000000100000010000000ea06916833e9ecb6dac092d5c3482ff15c000000010000000400000000080000180000000100000010000000c7c2cda336016dcb1d1c518e4c192b4b4b0000000100000044000000320036004100440030003100460039004300300030003200460041004400330037003400320037004500370033003400330030003200330038003300440038005f0000002000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\ICounter = "1"	Dashboard.exe

Executes dropped EXE 32 IoCs

pid	Process
5084	tmpA289.tmp.exe
836	Dashboard.exe
1448	Dashboard.Service.exe
5944	Dashboard.Service.exe
5320	wyUpdate.exe
848	tap-windows-9.21.2.exe
4728	tapinstall.exe
1884	tapinstall.exe
4788	nvspbind.exe
2704	nvspbind.exe
4540	Dashboard.exe
1448	nvspbind.exe
1172	nvspbind.exe
532	nvspbind.exe
3328	nvspbind.exe
5452	nvspbind.exe
3464	nvspbind.exe
5064	nvspbind.exe
2372	nvspbind.exe
5316	nvspbind.exe
1964	nvspbind.exe
2496	nvspbind.exe
1436	nvspbind.exe
572	nvspbind.exe
3336	nvspbind.exe
4440	nvspbind.exe
644	nvspbind.exe
5312	nvspbind.exe
3704	nvspbind.exe
3560	nvspbind.exe
3392	nvspbind.exe
2908	nvspbind.exe

Loads dropped DLL 8 IoCs

pid	Process
848	tap-windows-9.21.2.exe
848	tap-windows-9.21.2.exe
848	tap-windows-9.21.2.exe
848	tap-windows-9.21.2.exe
848	tap-windows-9.21.2.exe
848	tap-windows-9.21.2.exe
848	tap-windows-9.21.2.exe
4540	Dashboard.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Windows\CurrentVersion\Run\CyberGhost = "\"C:\\Program Files\\CyberGhost 8\\Dashboard.exe\" /autostart /min"	Dashboard.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_EDECCD0EC7B65901C3BD3B27FF74B4EC	Dashboard.Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1691.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\tap0901.sys	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wyUpdate.exe.log	wyUpdate.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	Dashboard.Service.exe
File created	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1690.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DEE15686E811C38BC7830A3D1FEFB5F7_069A892313EF5F6BD3C358CC33D8864E	wyUpdate.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DEE15686E811C38BC7830A3D1FEFB5F7_069A892313EF5F6BD3C358CC33D8864E	wyUpdate.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	Dashboard.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_EDECCD0EC7B65901C3BD3B27FF74B4EC	Dashboard.Service.exe
File created	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1692.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D	wyUpdate.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1690.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1692.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771	wyUpdate.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771	wyUpdate.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1691.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Temp\KAPE\Update\8a24fbef-0d58-4698-9303-c203bf10acc1\0987340f-5604-4e77-8a57-1e418f977b43.zip	tmpA289.tmp.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D	wyUpdate.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\ZW.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\AF.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\JP.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\TK.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\log4net.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Newtonsoft.Json.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Web.WebView2.Core.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Logos\ic_logo_shield.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\PW.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\AntiVirus\Castle.Core.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\OpenVPN\x86\libcrypto-3.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\BN.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\CW.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Web.WebView2.Wpf.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Licenses\Svg2Xaml.txt	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Logos\vpn.svg	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\LaunchDarkly.CommonSdk.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Bcl.HashCode.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\System.Threading.Tasks.Extensions.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\it\Updater.Core.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\ZA.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\MN.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\US.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\AntiVirus\CyberGhost.Browser.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Logos\updaterRed.svg	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\AZ.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\MY.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\SY.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\System.Memory.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\ru\CyberGhost.Controls.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Licenses\Bindables.Fody.txt	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\AntiVirus\Data\Assets\Default\Logos\Intego-Grey.svg	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\ImportedSVG\GhostieCool.xaml	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Data\Assets\Default\Images\chrome_disable_sync_1.jpg	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\MX.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\SK.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\client.wyc	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\PrivacyGuard.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\AntiVirus\sv\AntiVirus.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\fr\Updater.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\LU.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\System.ValueTuple.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Ghosties\ghostie_error.svg	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Data\Assets\Default\Images\cg_withteIcon.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\CyberGhost\Ghosties\[email protected]	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Logos\logo_text.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\SY.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\EU.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\MC.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\de\CyberGhost.Controls.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\Dashboard.MPAHelper.dll.config	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\pt\CyberGhost.Controls.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Licenses\SharpCompress.txt	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Extensions.DependencyInjection.Abstractions.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\HR.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\MR.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\ro\PrivacyGuard.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\OpenVPN\x86\tapctl.exe	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Ghosties\LogoError.png	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Data\Assets\Default\Ghosties\AdvancedBlue.svg	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\AntiVirus\Sentry.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\ru\Updater.resources.dll	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Logos\dashboardRed.svg	tmpA289.tmp.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\SX.png	tmpA289.tmp.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nvspbind.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nvspbind.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nvspbind.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nvspbind.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nvspbind.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nvspbind.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nvspbind.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\Dashboard.exe = "0"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\Dashboard.exe = "1"	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Dashboard.exe = "1"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\Dashboard.exe = "0"	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\Dashboard.exe = "1"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Dashboard.exe = "0"	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Dashboard.exe = "11000"	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION\Dashboard.exe = "1"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	Dashboard.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wyUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wyUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wyUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Dashboard.Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	Dashboard.Service.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Modifies system certificate store 2 TTPs 13 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cgsetup_en_52vCnuXs6nskn3wQwksK.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5084	tmpA289.tmp.exe
5084	tmpA289.tmp.exe
5084	tmpA289.tmp.exe
5084	tmpA289.tmp.exe
5084	tmpA289.tmp.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe
5944	Dashboard.Service.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
668	Process not Found
668	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	cgsetup_en_52vCnuXs6nskn3wQwksK.exe
Token: SeDebugPrivilege	5084	tmpA289.tmp.exe
Token: SeSecurityPrivilege	5084	tmpA289.tmp.exe
Token: SeDebugPrivilege	836	Dashboard.exe
Token: SeDebugPrivilege	5944	Dashboard.Service.exe
Token: SeDebugPrivilege	5320	wyUpdate.exe
Token: SeAuditPrivilege	3692	svchost.exe
Token: SeSecurityPrivilege	3692	svchost.exe
Token: SeLoadDriverPrivilege	1884	tapinstall.exe
Token: SeRestorePrivilege	1352	DrvInst.exe
Token: SeBackupPrivilege	1352	DrvInst.exe
Token: SeLoadDriverPrivilege	1352	DrvInst.exe
Token: SeLoadDriverPrivilege	1352	DrvInst.exe
Token: SeLoadDriverPrivilege	1352	DrvInst.exe
Token: SeDebugPrivilege	4540	Dashboard.exe
Token: SeLoadDriverPrivilege	4940	svchost.exe
Token: SeLoadDriverPrivilege	4940	svchost.exe
Token: SeLoadDriverPrivilege	4940	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe
4540	Dashboard.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 5084	1352	cgsetup_en_52vCnuXs6nskn3wQwksK.exe	82
PID 1352 wrote to memory of 5084	1352	cgsetup_en_52vCnuXs6nskn3wQwksK.exe	82
PID 5084 wrote to memory of 836	5084	tmpA289.tmp.exe	84
PID 5084 wrote to memory of 836	5084	tmpA289.tmp.exe	84
PID 836 wrote to memory of 1448	836	Dashboard.exe	86
PID 836 wrote to memory of 1448	836	Dashboard.exe	86
PID 5944 wrote to memory of 5320	5944	Dashboard.Service.exe	89
PID 5944 wrote to memory of 5320	5944	Dashboard.Service.exe	89
PID 836 wrote to memory of 848	836	Dashboard.exe	93
PID 836 wrote to memory of 848	836	Dashboard.exe	93
PID 836 wrote to memory of 848	836	Dashboard.exe	93
PID 848 wrote to memory of 4728	848	tap-windows-9.21.2.exe	94
PID 848 wrote to memory of 4728	848	tap-windows-9.21.2.exe	94
PID 848 wrote to memory of 1884	848	tap-windows-9.21.2.exe	97
PID 848 wrote to memory of 1884	848	tap-windows-9.21.2.exe	97
PID 3692 wrote to memory of 2692	3692	svchost.exe	100
PID 3692 wrote to memory of 2692	3692	svchost.exe	100
PID 2692 wrote to memory of 2964	2692	DrvInst.exe	101
PID 2692 wrote to memory of 2964	2692	DrvInst.exe	101
PID 3692 wrote to memory of 1352	3692	svchost.exe	102
PID 3692 wrote to memory of 1352	3692	svchost.exe	102
PID 5944 wrote to memory of 4788	5944	Dashboard.Service.exe	104
PID 5944 wrote to memory of 4788	5944	Dashboard.Service.exe	104
PID 5944 wrote to memory of 4788	5944	Dashboard.Service.exe	104
PID 5944 wrote to memory of 3256	5944	Dashboard.Service.exe	105
PID 5944 wrote to memory of 3256	5944	Dashboard.Service.exe	105
PID 5944 wrote to memory of 5584	5944	Dashboard.Service.exe	108
PID 5944 wrote to memory of 5584	5944	Dashboard.Service.exe	108
PID 5944 wrote to memory of 2704	5944	Dashboard.Service.exe	110
PID 5944 wrote to memory of 2704	5944	Dashboard.Service.exe	110
PID 5944 wrote to memory of 2704	5944	Dashboard.Service.exe	110
PID 5944 wrote to memory of 1448	5944	Dashboard.Service.exe	116
PID 5944 wrote to memory of 1448	5944	Dashboard.Service.exe	116
PID 5944 wrote to memory of 1448	5944	Dashboard.Service.exe	116
PID 5944 wrote to memory of 1676	5944	Dashboard.Service.exe	120
PID 5944 wrote to memory of 1676	5944	Dashboard.Service.exe	120
PID 5944 wrote to memory of 2348	5944	Dashboard.Service.exe	122
PID 5944 wrote to memory of 2348	5944	Dashboard.Service.exe	122
PID 5944 wrote to memory of 3964	5944	Dashboard.Service.exe	124
PID 5944 wrote to memory of 3964	5944	Dashboard.Service.exe	124
PID 5944 wrote to memory of 1172	5944	Dashboard.Service.exe	127
PID 5944 wrote to memory of 1172	5944	Dashboard.Service.exe	127
PID 5944 wrote to memory of 1172	5944	Dashboard.Service.exe	127
PID 5944 wrote to memory of 532	5944	Dashboard.Service.exe	128
PID 5944 wrote to memory of 532	5944	Dashboard.Service.exe	128
PID 5944 wrote to memory of 532	5944	Dashboard.Service.exe	128
PID 5944 wrote to memory of 3328	5944	Dashboard.Service.exe	131
PID 5944 wrote to memory of 3328	5944	Dashboard.Service.exe	131
PID 5944 wrote to memory of 3328	5944	Dashboard.Service.exe	131
PID 5944 wrote to memory of 5452	5944	Dashboard.Service.exe	134
PID 5944 wrote to memory of 5452	5944	Dashboard.Service.exe	134
PID 5944 wrote to memory of 5452	5944	Dashboard.Service.exe	134
PID 5944 wrote to memory of 3464	5944	Dashboard.Service.exe	136
PID 5944 wrote to memory of 3464	5944	Dashboard.Service.exe	136
PID 5944 wrote to memory of 3464	5944	Dashboard.Service.exe	136
PID 5944 wrote to memory of 5064	5944	Dashboard.Service.exe	138
PID 5944 wrote to memory of 5064	5944	Dashboard.Service.exe	138
PID 5944 wrote to memory of 5064	5944	Dashboard.Service.exe	138
PID 5944 wrote to memory of 2372	5944	Dashboard.Service.exe	139
PID 5944 wrote to memory of 2372	5944	Dashboard.Service.exe	139
PID 5944 wrote to memory of 2372	5944	Dashboard.Service.exe	139
PID 5944 wrote to memory of 5316	5944	Dashboard.Service.exe	142
PID 5944 wrote to memory of 5316	5944	Dashboard.Service.exe	142
PID 5944 wrote to memory of 5316	5944	Dashboard.Service.exe	142

C:\Users\Admin\AppData\Local\Temp\cgsetup_en_52vCnuXs6nskn3wQwksK.exe
"C:\Users\Admin\AppData\Local\Temp\cgsetup_en_52vCnuXs6nskn3wQwksK.exe"
1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\tmpA289.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA289.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\cgsetup_en_52vCnuXs6nskn3wQwksK.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files\CyberGhost 8\Dashboard.exe
    "C:\Program Files\CyberGhost 8\Dashboard.exe" /install
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Program Files\CyberGhost 8\Dashboard.Service.exe
      "C:\Program Files\CyberGhost 8\Dashboard.Service.exe" --install
      4⤵
      Executes dropped EXE
      PID:1448
  - - C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\tap-windows-9.21.2.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\tap-windows-9.21.2.exe" /S
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Program Files\TAP-Windows\bin\tapinstall.exe
        
        "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        
        PID:4728
    - - C:\Program Files\TAP-Windows\bin\tapinstall.exe
        
        "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884

C:\Program Files\CyberGhost 8\Dashboard.Service.exe
"C:\Program Files\CyberGhost 8\Dashboard.Service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Program Files\CyberGhost 8\wyUpdate.exe
  "C:\Program Files\CyberGhost 8\wyUpdate.exe" /justcheck /quickcheck /noerr -server="https://download.cyberghostvpn.com/windows/updates/8/nt/wyserver.wys"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5320
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /d *
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4788
- C:\Windows\system32\netsh.exe
  "netsh" interface ip set address "Ethernet 2" static 169.254.123.120 255.255.0.0
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3256
- C:\Windows\system32\netsh.exe
  "netsh" interface set interface "Ethernet 2" DISABLED
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5584
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2704
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1448
- C:\Windows\system32\netsh.exe
  "netsh" interface set interface "Ethernet 2" ENABLED
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1676
- C:\Windows\system32\netsh.exe
  "netsh" interface ipv6 set teredo disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2348
- C:\Windows\system32\netsh.exe
  "netsh" interface ip set address "Ethernet 2" static 169.254.123.236 255.255.0.0
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3964
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3328
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1964
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:644
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3560
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /e ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /d ms_tcpip6
  2⤵
  - Executes dropped EXE
  PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e579ba35-94b8-0e44-ad7b-a34f3bab18ed}\oemvista.inf" "9" "4d14a44ff" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "c:\program files\tap-windows\driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{2F6A6331-B3DE-459E-B1C5-790C015C3874} Global\{1DE75E47-0465-480C-93D3-D40D0005858D} C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\tap0901.cat
    3⤵
    - Modifies system certificate store
    PID:2964
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000150" "ff29"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:1352

C:\Program Files\CyberGhost 8\Dashboard.exe
"C:\Program Files\CyberGhost 8\Dashboard.exe" /firststart
1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5816

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\CyberGhost 8\Applications\AntiVirus\AntiVirus.Core.dll

Filesize
190KB

MD5
703feb2516cf296ca4fdf66f430fb389

SHA1
d1114c9d43fcc908b55ff98f37febacaa437b092

SHA256
6c174e47dae570aa70bc17b67209f580ff9ff8cac50cab2165dc10bcd82a8011

SHA512
7f7db97fb8bf2d0ba53b1fad0f51744030b1c9006b923b6527e5350b545452db4ba2d7d269c5e490a18676d5a9579216113923e796dfc71b553855ed88f21d20

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\AntiVirus.dll

Filesize
339KB

MD5
623ca37ebc94f1409984a49672f95890

SHA1
9541b01e7c76c8f4334505d039f703a45d8d11e3

SHA256
397c57a6c7c93676f7e71e4b36d33fab72afca4e9f09dc0663af94b1272c3fe6

SHA512
c00606ca9e8bba92de0251049df40c790c95ecbc1e20dd04e8315b6b1c576ee23888499274f1e1c2b32e93b6ae84f183e56a74654e39133d4156e40ff1f7f3ca

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Filesize
34KB

MD5
1057bd714f5861f24ecd87b6fe37e1be

SHA1
94c6e4f79eba9c2e119fa911eb5271ff02b57f8c

SHA256
71baf16c51318a2ea1d893d4953e93a31284231c1f3ff2af3413a7c9089a5630

SHA512
ce43630ce674fd4951aec75511366d2219eaa7df44cef93ca0f0cae111535cfe54c26a31fe8f76df82f77d852b22523be161ee640ff605c090a38db003716147

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Web.WebView2.WinForms.dll

Filesize
37KB

MD5
ef76622cb8e4dfe6c27bcdcee4970d9f

SHA1
89baee9df743fd63403f5897320e574d28ce9484

SHA256
aad566577274918ab8fe7a6dbc575a0d9b5bb06dd74bc519b0ca754419797afc

SHA512
4a20548e55c0e5923407f911c835e2419e320f7e0a17a0742ba9c764a9e24a6d2374ff6600c069b002718adb633d1902ccf17d1a811c5497055bf6ec82804dd3

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Web.WebView2.Wpf.dll

Filesize
44KB

MD5
f2410b93d357a5b6bacebeafd7427671

SHA1
c08419cac41fe9dfadb7c5244f68c6d56d3b4076

SHA256
23eb0cc48273113e8fd55c4f8506ed852edaf173a3995607acda97b96b7fd376

SHA512
19d81445e29cbd9107b9ea60c64183c70c6fa4633d5f3b7d0b00ef894b8adae44fe2c65ac6687bcdbab4a02bfdcf65ea1b2a302b401ae79be0b5a8b197ce696b

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\RudderAnalytics.dll

Filesize
52KB

MD5
40ce83dc38c5768e4ad60b7903f51e2a

SHA1
2115d65f039948a3b2531a880d70761331c26ebc

SHA256
547648a40c55c7aa38c00ec4c70e0f59cd5615ed27a05cd6ba2e027234376fc4

SHA512
1909eae85f406721c83bd29f2b16872551c43147a5bc670f88aec47d60f8c9c6b044976b64a3982e0d488e0a74e800912d3197a3ceae8e577d7e9ca911c9157e

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\de\AntiVirus.resources.dll

Filesize
43KB

MD5
2ed19bc4b1cfe0e6302ae224862f492c

SHA1
cc1171e572a25911d2df51f9ecd068e806eee016

SHA256
354095b404cfc05e4f3638cdbfe73462ac8e73939221be6fab67be433f0ea82b

SHA512
6cdbcf8d2e73f2e6a4b58cb59e02c0ae2413818a576d0951f48368fc5498c39de62d2d78aeffeed0be4eb3758f618b5fc5c34d1d0e1fdeea2e53fdc341d8b2b6

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\es\AntiVirus.resources.dll

Filesize
42KB

MD5
b3f9d4e7326dd4302a94142a57feeb77

SHA1
5f4d720b0baee20e9121049be55cbb93f911d351

SHA256
3dc2b2029beb86f8a837fdb0ae7bdd2e1a575598c703b0657a55451ae6e39dcf

SHA512
586f2014c0ee8a89e391aa8001416857c6599cab17b5cb937ac86c200c96ce74175a8e79341583e9e65ca974fb30a0b1167ff8c248412b0b3bd26d13be51d776

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\fr\AntiVirus.resources.dll

Filesize
43KB

MD5
4b72fff1fdd8cea3fa64e0b04ca0fc29

SHA1
e7b7baa865c7c88b4de005e4861a9e1da07a2203

SHA256
5137b68df6a44b481358f63d32421baa7a073d014019d4e57510b4368ffacf53

SHA512
2b5098584eae1fb83ca638a748503f79d843625643dccd1877100c2592226498a0174d968452140b1497f7a408b03232cbd4e9778b60cdbc9fd19f6ad83ed59c

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\it\AntiVirus.resources.dll

Filesize
41KB

MD5
224c8d301d3a797833b70d88feb2eeae

SHA1
3a1354885f6a493812ed0c076d0f5268f0db4d2e

SHA256
34aa42b3200b116b5f4c6513d3ee3742b23418f847c4410bd1df181d6386fdaa

SHA512
757f48956696d65d5f9ff66d750872ab9cbfc012f298c362de0848104963b875a1afa89746631769a03e9a735109cd99b35c745f827be0244c6fa553b129a5ac

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\ko\AntiVirus.resources.dll

Filesize
43KB

MD5
04ad17ea4f99cc5b6fabc6742580a9c7

SHA1
c8ef3f6839200c4ad7f315562029baf675d5c62d

SHA256
0e6e279e5f178e4370f79d0f26c45f2ec4c0f68dac9861ed5eb805b7670b186d

SHA512
6b35073551712e3baf637807b6a0def868f1051e543e84bc879e3926bd7cd121f97f04937ae9764c04e70f359f259448c5df5c7aed8fea6d9b7f536fdaccab19

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\pl\AntiVirus.resources.dll

Filesize
43KB

MD5
ccfabef7aa55412738a3a3921672f958

SHA1
cbeb2cbff3530273013e535270591a41e07e17c5

SHA256
858f3cb8043983d3a1d909c8031604bb4984d23ded5884844ce7dd1dc3121e56

SHA512
d39cb24b4181745a445338238b06e35ce087dedcdee07fdfaf83917586175a8e9388ae072789ef9c4c327fc5175c190ce9eca55fb28a6b357f0c68bdaeb9f92e

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\pt\AntiVirus.resources.dll

Filesize
42KB

MD5
1d8ba66db74d5829321aa55d196b8521

SHA1
e71c66dd2452095e2c3121a2efb335d3bfc42a0f

SHA256
a014b918a60d5c326514259b18ddff7fa10448bcb2835088f37126025fed7f72

SHA512
dd7d915395014987e5b209121111a2593ed67ebbcbc5d16d9c2916b2e034e8963e5e629ee78655a5609cd5497c1d3e5ebfd426a27077ea495eac8ca097fba32e

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\ro\AntiVirus.resources.dll

Filesize
43KB

MD5
ad2c73741c13423cc0440ceccce5748c

SHA1
7f2f13e1b68be2bb81137c0cfa8228b40d570d1a

SHA256
9c13f968054d39045d117522eac2bb49797df0e802f10d04c43fc243fbb04d5d

SHA512
6e6728b77c4d492f50e241ecf2edee2a0bce9391a28e0cc90e31ab8c956891962df9c660cd5d89527e18b6a91939a5bdb0c31c8c7672ad54d9d0ab74b414c335

Download Submit
C:\Program Files\CyberGhost 8\Applications\AntiVirus\ru\AntiVirus.resources.dll

Filesize
50KB

MD5
1f65027352d77c2916b4f1d6d74ce3ff

SHA1
ca13aa4f8abd5fd8d17eaaa59ae73ea0e65a1434

SHA256
b4a0d921f4c80b4d8ebd08cb74d39254347630bb36a4c8c401a84d75939999f1

SHA512
9e49a2d41fd9445e5f71cf858efaf87c5f5bceb5f506ef9f76374827ed83e3b9fb8d47135b6c9ba419e2d9dda97a1aceedf6ba0956e38de862b35fb4e4e47642

Download Submit
C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\CyberGhost.Browser.dll.config

Filesize
780B

MD5
9c1d6723c3978de6e7d9be40d6c3920c

SHA1
af418f111137ab825656da62ef2c919836f65353

SHA256
6fb1c5765b496209f3811ce6cce41682110e6a59fbbacc367cb34350ab7b789a

SHA512
04c62525cf2bd4639fe28f792c4c6bfb43592c1e20897141b8f4effb7107c77ded97f1e205f9f2f6944c49c9e59ddd6f5545947ece8b5c175aef60ded46f5db7

Download Submit
C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Filesize
34KB

MD5
72a8235620d061b68b298e3cb0ca1178

SHA1
ac1608150dd721cece96ff0d694225815195caf8

SHA256
b2dfc7f8e8305b691776af8c64f33c98461e3a735596fc6ba0f66eecf7790bc6

SHA512
f1c9cfd572876f151fcd7cb9b255908a61911a421bd4d386ac0dabd9639a4e258cc89fd19cd2c06e8c296add6109b2c4f4d1ab92e2f89ebfd79ea8d1bb0b7d7a

Download Submit
C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Web.WebView2.WinForms.dll

Filesize
37KB

MD5
054a830681bfc7b0f52d9549616d44d5

SHA1
7a1360b3861ff0881b349a2f1756a570f76c1a31

SHA256
5ff2be8e85bdb89896c9c2946704abd450a22152cac5a0f1a8478f8910e15fd2

SHA512
cee139a27c2262d78b41a78be87d9dc190c96fa88e2b8d124697d91f92c9e379a40a06d305abee2d229dc51d803a9c76e4e03a2f0943527d88e991b85959b7af

Download Submit
C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Web.WebView2.Wpf.dll

Filesize
44KB

MD5
d2121527474575025e36ec2db32b80b9

SHA1
1a2767a30a3acb2e73761cc786a6de891ab03584

SHA256
c08917baedb108649f369898b9a941ffb4d6f303b0466fbbc6e7a847d336f25a

SHA512
8b95121c72659d11394430e773c48aab897583ab64d5bd91f40dcc8f3fd104df75d270e0c3ed2f8033abf3dbee4cfc86304663b812d8bf6fad0a7bd17468a64f

Download Submit
C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\PrivacyGuard.dll

Filesize
736KB

MD5
3961082f4253f9671aa2ae15340ec52a

SHA1
da932f9a32d4ab609cf7b97a43b964ba93ee0058

SHA256
2a1bb043df145387bf1570c40bfc8b43931030f05787e738f1626b1e462ff66b

SHA512
911f14b6aae42b18581d1fbe91c35563509d49e0d91667000a707bb467fd296dc6bd04ceca8b673cfff8312538d454660017b887456d89c33840bef4439d6477

Download Submit
C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\RudderAnalytics.dll

Filesize
52KB

MD5
afe61cef9754d9ebd4d9099735b71c43

SHA1
75bf86eac7ffe3fdd2dcab09548a55df99a67801

SHA256
dd08c78fb10452b0a42255bda71cea2c5012caf3ca8d00059234bf17f0e5eaeb

SHA512
78b87081b0d9cc518f9a2e821762062cf5310672133679d60ee1bb0c0cc93f995105cd3fc4284c4d6e246df3fa6175008a463bd8ad9312f7b7a75563df14649b

Download Submit
C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Filesize
34KB

MD5
b8c3c5b86489ebc29c9506c695697cab

SHA1
e10c7322ccbf89ac6dcf33051e8ef3644ba2c13a

SHA256
da1faa23f03b3150c9cf695d6788a0984b30f67cfc13dcde84db85ff84e11f33

SHA512
a58cb9d8ecd48bc1a04c31280700966bcf2a7ec553ea91725b2714d1e4634b4d736633147bc74acdb82d93335ebf4161b2d8b262d724e0b1b06f49cc92c27fd0

Download Submit
C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Web.WebView2.WinForms.dll

Filesize
37KB

MD5
71a385ad24940509d320336dbfc1b014

SHA1
631710d53319c28e733cf25fff76da9cfe621780

SHA256
9f143177db5da3e72c282c276be152da32f78debe428b38e4eaa631f7ad582a4

SHA512
a520f7d366f3b8482c8217e280c8396d2e406397f3d106942916a9d53ce4ec5e269669f4a39ff3b299ff97d5829ae1e719a7e94a4ef0912ff3af73a562c79a7b

Download Submit
C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Web.WebView2.Wpf.dll

Filesize
44KB

MD5
e786385e03e607a7ad6458f682d6c810

SHA1
8b19dd98d57a42b7305dfec5c18995605dc38a57

SHA256
bb3b284de50bea43470bfecefe43b7dcaee77893b5b209ccbb045434ae2a2506

SHA512
e31bb6dfeb296e13acd91500c46b28db8aa91f45c776a298ac63aff63b855d05cd90fdb5036baf1d4db69eb10cc5c4449f16550db19ca67b0e1df94642c05e48

Download Submit
C:\Program Files\CyberGhost 8\Applications\Updater\RudderAnalytics.dll

Filesize
49KB

MD5
6d65127d009508e5db58d01525ea51ab

SHA1
8891567d0fe416ccda8319052c554e9c6f568013

SHA256
ea247144b3048b0e88b04805a8476116796eab68d62fcb2c2ffc63dab971a11c

SHA512
117f33917354f37bcfbc66d16ee43b667768ffe9e3df6c600eba663cc7592ed981bd341ce4fffee4c571609af88df1001bd4ab66ee0906caa7a393da71e298e2

Download Submit
C:\Program Files\CyberGhost 8\Applications\Updater\Updater.Core.dll

Filesize
106KB

MD5
5721040c5a756d1b650160a2bd401142

SHA1
c0f11a84d8897510f64b87941806b7cf60dd15c3

SHA256
629239a5c9cf106c1ef84d73f313b3fd562f75857a0463259b3816f6c81e7405

SHA512
e124239e56620cb1a0810fdbe2294929e0ed31c0adfa183b6bfae63e39818d45dbb006be8b252173aee56f18142b5240030051e9451a0c8dc1912d24a2409406

Download Submit
C:\Program Files\CyberGhost 8\Applications\Updater\Updater.dll

Filesize
172KB

MD5
5a3c95ca0814d6373ddf17c06ca24693

SHA1
c8e610af941d78d3a2484e61e93d58e9a62b357c

SHA256
0ad9773793ad67e36a92b0fac2eb59502105c18d69b78a7b13947b2801a96bb1

SHA512
87b29991e59c23b2013a6ad3a0daf6c586e6f0c1a09f49516b6f224e4f4d5e6a2be0c1e102d80d5f3a5dcfb6e9e7a3d67e318900ac890a54a27873d16837df79

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\CyberGhost.VPN.dll

Filesize
842KB

MD5
c7eec49bb8e4f8468c19f11e9978f2e3

SHA1
cd17ef28dd851c9c9648424b6cca487c55fb24f5

SHA256
f1b89d0d21c1874dce720f74f34d3de6ddd19c4b28e07ba4175009c8f604a85e

SHA512
c1191a172c8bfa374c2634f16dd3cbd5e7ab0dd1eb5ab378330cab226ac8e082e921ee4eb9c30afea54030c9f27c01434facfc806b1bdeb7e5f5314f6e62278a

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\CyberGhost.VPNServices.dll

Filesize
149KB

MD5
ce1323a08f978266f71af9b43128bb9d

SHA1
a5782a7df5a82038d7a8cf9422a1bd1463d1bc8b

SHA256
1cd097a71614e55a17792cfa9f6b1218ce9890bc2141659fd1ada02f8869f143

SHA512
ba2300a4f165ad6343e3a214767e85ef9b656c25823c49a511639d2d51875f4fc7858829db66327552df9153462651b4e53b692dc9ef9a12229bf80978ab394c

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\CP.png

Filesize
136B

MD5
30bea326e5024b6a9b0136a000403d75

SHA1
0b6e65e87f670af6fbc4a28171aedf4db4daa0a5

SHA256
e58c331133d8f780738133e2aa966c8bcb5b17a07c860a990bc401afd6382e1a

SHA512
43362cef837497bc264a46dd70a67c3129d854cf7a9866bee4a33a4f62acb833ba96b4720441c6d6db56301c9b49f8c29f1465363b5c057ec6e16a213f06caac

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\FR.png

Filesize
114B

MD5
42c4c4ecb4448888421a7c1180b4cd08

SHA1
bb515751cc2f7616fe41929d2577fc965c69b51a

SHA256
1ef1946b6e352f2d5a4b003367b968374d6af122c5b645c6b4d9577645fb819d

SHA512
0e8d4b1c124b86d696e979d9b3aae007c80258672202f66fe3d2ea72e64d205f8dace52333d6749feab74abbd090173f6811490e9b09c3a06682f58b14e5fcbf

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Filesize
34KB

MD5
1b5c304c9ea046d3c2061b71f0f4ad72

SHA1
069d86e8136fd827f4d61e35063c24b91a22913c

SHA256
a06adf890575d74637a33b3eb59dd565d00c86def54217fa64b6f370697c0c1d

SHA512
a571a0c44af954d1235b1b2636f67416014b6016119901808be3793fe5430f5462a5320a6bc825b894f33c69b54179ff90c2e737360d5f2cf23e54429e27c513

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Web.WebView2.WinForms.dll

Filesize
37KB

MD5
aeb3c06059e193d48222a21227c903c9

SHA1
8ffccf8a4d0d7dcedcbc23e33ded335473262fea

SHA256
550b278f50eb0587ba3158210f29e5c0e15490e32b803c7dcd4398425ffb62bd

SHA512
18179c5e14cf8163412b39dd8035e23416f8e41612a419f25934ab45b099fa9c0ba3728a753ae9e19945b14be3fc81818f6f21efaab5359012e36182e77ffb53

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Web.WebView2.Wpf.dll

Filesize
44KB

MD5
83716706b6f37bf9680aa3a621d6976c

SHA1
2a1aeac7e4b58b4be013295974421316bef75339

SHA256
614c89775de8a02f937df83447b0390f8298cb2bb5ce401fc27497b53a34190c

SHA512
c7607a0f49a7ffffb68eff424dc1db906aac50668cea1e4c64d297bba2a0239ca4c6d9903b48926c33718d2eab8684e67fa759ed9dc1eee73fafb2507284aa28

Download Submit
C:\Program Files\CyberGhost 8\Applications\VPN\RudderAnalytics.dll

Filesize
52KB

MD5
796cd54f5882eb97d093be627fdd5561

SHA1
35e0830e3d60bbbf102a19e722dd91112f34a33b

SHA256
d05d188901c35ec6c0bae21b0c00d48cd2da2a42c4fbfed8e787b3580c037226

SHA512
1e9a711e35dc7831585b2c692480a7c9b38d8d84d0849157cbdb87476109294ddb636f6bb4f811fa152af90d51328232896d6389847a2fb788f632bf3002ece8

Download Submit
C:\Program Files\CyberGhost 8\Castle.Core.dll

Filesize
421KB

MD5
7915b53a3950ed1cf7ad2b016a6db85d

SHA1
11a0d7e27ef5980722b39e77803d7e78890cc15a

SHA256
497335b1f9caf6d573ba52da7b1fbc6a1f0f36c81f65b53776832116af0e532c

SHA512
4a1101f0f2bb2d6ca50a63cab199b510ec04d80ffb2c435a7984e1627f0c4d35cf50f081e03fff5c0453037f8a9d453693c30047042fe0608f1b2969f767d030

Download Submit
C:\Program Files\CyberGhost 8\Castle.Windsor.dll

Filesize
353KB

MD5
6ff272e2d995b1ff276120e212014993

SHA1
bdccf2981bccdfa1fbfd0c32e79051dc1df56bbb

SHA256
1237558218b43132c0b957266b0851da8ba0f154a80b27aeaa56f5f49c614a70

SHA512
f9169aab124d116f48682276085e50bd8ba78cdf6050b26f2f5e019165fb57662795b261c6626ad32a5776e446d688e8daed717a3b645b68cf566761641749df

Download Submit
C:\Program Files\CyberGhost 8\CyberGhost.Browser.dll

Filesize
44KB

MD5
5ac2460361f3c534813c7ad90aec7a07

SHA1
5cbdd4bfef3e70c4ec71a3e11b8d5a79567ac874

SHA256
1cb6c7f549e1bbeb666fa3e8a4099153ff266a8d297cf5901231161cd2693ca0

SHA512
4dc8f2406bab54dc1ffbff8085db6563aa20d646e406f0ef944a2b627271c2f7913ef49988b2ae26bbe080a76116cc33c2fca898359a89c43c83671334f804eb

Download Submit
C:\Program Files\CyberGhost 8\CyberGhost.Controls.dll

Filesize
621KB

MD5
057af8169c3a0a3f0616f8127cec33ff

SHA1
a8323a82f07df0bc71b53a492d9f7df0ca0f8a22

SHA256
e76f2d2fcfe19e66c5f35a475011466d72fd76f5f93fe724fd94f4185705af81

SHA512
15337ef4f493faff7f6069d954ce0700bc399c303dc36cef6dad89654a4772a95a23c40e1198040c56b09a46966625b49393d34f4e29f4e42638eb98faf38d6c

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Contracts.dll

Filesize
206KB

MD5
5ab448298a41e87de68d218c6b120bdb

SHA1
efb31e96905df2fe83b6527438bae1539767974e

SHA256
0a7ca39ba17b5dba367f9b17381c1b1e40ffbf22e25870519b6749fdce0061f8

SHA512
82c733fbee0fd80cd2f092c3674d4a0d06e1958f6ac951f343fe7c74977b8e5feaa79aaebec9adaa2172b56e3553efe889d1a37833ada380755059a6e898b5e8

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Core.dll

Filesize
171KB

MD5
361fc47e04ef7c1123564c007b7e7a71

SHA1
2cbd0ef5f78bd1505901df7898cb73dcabfbf54f

SHA256
1b226548dab788e1405842901698b88a515a64c039ea6eef5af8bd0cf41b5aaa

SHA512
343311dde4058b1865aafdc51a7054559a8a20deef4af83719ecf4fb9200dc8f2b0331abf5d0d5bb190fd29e02fe5da64b5eb34132aa7a52b0d7c05a3bb08637

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.MPAHelper.dll

Filesize
134KB

MD5
81b429b1333206c2f26a7fd0a78f6941

SHA1
0a305f10aabd4f863b3f7ebaeacc3c79d4091a4a

SHA256
d74c7fa740c9af13fa57658531a2a3062a957b2e29f3ddb270081b1b0d0736b4

SHA512
692b69dde962e8ea7f1d05bfab53e0fd2355fa14380f3799eafc7c58a7c26de76fab4be07a9c1bdd1149fb3716d4525b8bbebc3055ecce7a97551dca4694b4dd

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Pipes.dll

Filesize
39KB

MD5
1e65d78e8b98c495569292fc5a78681b

SHA1
c58e8da7ba4cc6bf7e4bdf7907766e8840e0d464

SHA256
00742e432a14c0c91f15cd980ec0500289a589714e8ef14f34438a5a313ff4c3

SHA512
afc3e894c9c397774737df5a0b295a31f514012af0e8eabd47ad1c8529ac09fe6869aa2b3ea828e53f9931340deb15ad8cbe690b4815ab386588a26cffefac76

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Service.InstallLog

Filesize
705B

MD5
93db14a63444f0640443ef75ef8e0276

SHA1
93789457f75725d2af59d0ad214c65a1db9038df

SHA256
4f233323f8bd797a8f1a1f7b42fd59b7b2cb4e5b8ef5c6e94a8bf85020e8543e

SHA512
45f469c0f7cf7f016a6eee01251407a783f1f4845bf6596e4e54c73e7cc460e8827b701760a676c47e4d75cf12c65a5649123304f175f7803327e2fe84f6d549

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Service.exe

Filesize
67KB

MD5
54cbfd95dee8263af6cd37caf86b7fc7

SHA1
a672bb250bfb18d40dc06f7fe05b54ac4385ffc4

SHA256
fe72e15d097889e8cfc3f92a072b423872e756dc58ca01b1776a4a00055f7c87

SHA512
1acf5568dd0bc9db9a801c75b7ce10d321e42dd501d5c79913b1633075349bf70d52eb64054d3695b0c4f8513ffad15a1edc1e9af157fc3452f92c48a04cb900

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Service.exe.config

Filesize
3KB

MD5
982d7c8a3787ef298b050aa9efca6478

SHA1
140cc16f0abb9e423ca084a9d043e7222b3652db

SHA256
cfd8b465e19a80c6100717744cad1b4f91a29e6201cc90103effe0ab42667ee2

SHA512
69ec8fad01d0bfd86ef5d4be561105b3f0fca1c4a9d709704d40b32f96fbf75bebbcffd9c1174fac14dc4ecb4107945ad311ac34299ed7666f9eb6586157840b

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.exe

Filesize
1.4MB

MD5
f184bf053d1f3bb5322f583903bce5ae

SHA1
1c5cc6325b9c282b15f18350891a502332c4376b

SHA256
82bac58c7ad273cc2f0e929c4e1d1c653243fd29ce42805f53dd2af8f5ff7a4b

SHA512
af95b468e6f5e666ee13022a2ce3bd898aed0df7517053ccef0dcbe750345eb5317a7019dc5a0323f076388dfd3235180c2ce85adf955d6be859610c7637a26b

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.exe.config

Filesize
3KB

MD5
f1e329e5df3fdff4f38b89a73dba103e

SHA1
954c609e77a97e9b72ad35bda5d3c6e08d9900ab

SHA256
6a67371a519355bef77448e7b769b05e2e516503edbcb6550e68e12167c8e811

SHA512
2e0ac30de9444fc8215b654ef1add263588f380bfcf163dc09812030ac24a94515de14dd6e5deb0b8923fe2f8e332377e799c08d8b29e422c55692fc81ae93cb

Download Submit
C:\Program Files\CyberGhost 8\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
20KB

MD5
3daf80a189a662f456fe619052642c76

SHA1
ce247636355a4ce9af639ad9a46bee5fa74fd606

SHA256
5681ac06acd27b4417dc8f1c3d83eaab327e8d50fc30fbd4a1b037deb14529cd

SHA512
ed5e17c57b8b8c60e7469cc1f0ac760914cfffc89dcbb261def1b9a23aa54f7e907cb94e45d3f58c06efad50eb79ea3e5ceda1b86fbc6874f6b860509f2232bb

Download Submit
C:\Program Files\CyberGhost 8\MobileConcepts45.dll

Filesize
644KB

MD5
c2c8ac9615d0214bf9eb01ace7ce55c4

SHA1
72034c98a51584a7d2efef069636ae4919dab19d

SHA256
d63dde4ff7a6a8ab5cde2c08da4890e9920e8ec1c4b57ab47026e23cc044aeb7

SHA512
911eb5885f81c7b51015d7c96df6b60946e7904eb708a3b25c573d85d24cbf268454bb6b1edc636fefba05ff5892b1dbfe02d57b5dd3d4b70b50e139ae245c1b

Download Submit
C:\Program Files\CyberGhost 8\Newtonsoft.Json.dll

Filesize
691KB

MD5
17dab3afcc00fc4f39b715feb46ccc15

SHA1
397b16116513cc84d600c6556b776baab7cefc28

SHA256
78ddce43352957c795806a094cd598420f5dcba93ac6d5a31ae7a333c3ba40a6

SHA512
6b1334f9907c1261f4ec1bd402b863f4d48df2a551f46ec0cc499401dc78fbeba5b7d389b7320d525756f2653834101383bad614c171923ce6acfe542ea0f908

Download Submit
C:\Program Files\CyberGhost 8\Sentry.dll

Filesize
584KB

MD5
0e0140b1a0a2458b1a3f4eb4e7e6bd9a

SHA1
18065e9b47e5302ef32b62213362d1a7dc584d0a

SHA256
58b6d08bcba6fed4d2924059dc7082f512cbf490b01a918d699d24a0787d96cb

SHA512
c0690a85f0a2cfff57394009974aeac0d3ec0f4858137d6ff6931187625af989cda9eb5064f0f19170eb7963e97fe4d249e779062c272e0f9f6baf51ba0e8eb5

Download Submit
C:\Program Files\CyberGhost 8\Serilog.Formatting.Compact.dll

Filesize
16KB

MD5
1f9710068535a64c5eb2deb8090b8c67

SHA1
fb852449f60cbc8affc3aa9fb29c18e6ba55bf6a

SHA256
cd3df0998bbeec93b1a2c27082222aa0f56857f4c383b382efc008ea266164f6

SHA512
0777c789d65ca9b4a706bcb5d1ab608de0e4a5ba2743d02b4d38335d39f5beb68eae11353371c73296c9181cd16f2325efe9e4eb9fa7ca306c4dbc1ece5aa102

Download Submit
C:\Program Files\CyberGhost 8\Serilog.dll

Filesize
145KB

MD5
f79a81819b620836ebe9c0ac8cfb2cb9

SHA1
21738572d54943068536a3d8dd45b8cc910ef5db

SHA256
27b2b3c464e9597f2d88617ee937531f6e14c19e03653c5c7a7aceaa3192bcc4

SHA512
e7a0848c32741a405472ce37e95cb9a5123f852e1ee06f6c743753f75cad82692e91630554b6261db28865515341f8b942f6dbffa3e86ab18cbbf23e574bb90c

Download Submit
C:\Program Files\CyberGhost 8\System.Threading.Tasks.Extensions.dll

Filesize
24KB

MD5
a77db6bac062e81cd24ccf5f70c8a6c9

SHA1
c2df976d080e234104da2b9f6b63b0cf83286a3a

SHA256
673d3d46ea0a993fcd064cb56d28278b89fa52803883f4b6e6dcd14eed2600e6

SHA512
1dd9e2728f8aadf0791d45f23fb7b1b173f243bbae0cfa7b26d9c26066645605fd7889c37b1c0a83a2b3bc452d010902f11181824f44b9190f0a8c5ee488e30f

Download Submit
C:\Program Files\CyberGhost 8\WPFLocalizeExtension.dll

Filesize
85KB

MD5
7af8e228ec9713328ee88b69c4a1fe29

SHA1
9deee41b7e849f5bc64a838d10daa476f1c29faa

SHA256
70f243562d909c2d14f9af8340a3b77cb7a7e091e07a6d7f5ef12df079d41cab

SHA512
7c66cdf8c9d5c4b9e92d7213d7455f63c4d4bba1e2b2f0438a0e9a57aaa523132c37659d1deb04d9308cf48aad3b9b35e3de555e9261d75632ca3a268fcf6413

Download Submit
C:\Program Files\CyberGhost 8\XAMLMarkupExtensions.dll

Filesize
37KB

MD5
6c3476819b24e9ab88fe6eafb2981601

SHA1
5e9b98c3254c5099605b20b9241ffa97ce2d561c

SHA256
e4e57348ac03e2611a6bd6d80ab4148b81b7d6e617a0baba5ed0a76304ea7036

SHA512
321dcee8bc9df654b354c91986c9e70c63b4c5d2fedade42d50f6adbb584e979220bf39b53798e66d68d27dc0569d952c811a2ec50defab5789467ded689c057

Download Submit
C:\Program Files\CyberGhost 8\de\Dashboard.resources.dll

Filesize
52KB

MD5
06ea9f712bd99c9b8919a7da6fdcc7c3

SHA1
d68159296622c9b5b3c8484e4b57b8d151e82ace

SHA256
b34f3f8bb9cab834fcd218e75d54067e25c5d3bcd04a527104eeacea0a69c1f0

SHA512
75e750bceb24c5a6ac37942a35985becd04292ee662800b989c9a0b336c4265f5c7870fb10dfdc1406f5da01e48c761b434f7ee684d2cf6a709e897937b27760

Download Submit
C:\Program Files\CyberGhost 8\es\Dashboard.resources.dll

Filesize
52KB

MD5
585f53ef4d03c5a464cb2c4217ac2249

SHA1
c34ecdc46a766b7a89b6388743ef8e5c6766e9c5

SHA256
8cea64807de07d94aa2ead550723a19c7bca19d3c019dd7382432eb55b2e8076

SHA512
df4c955e952323c7518a555e6c7ce4bb8152b38a2f3720fe43382dd76146c172773666ccec4cafcbfb464433c17f246c2b04087366eb13c96c152c4052362cd6

Download Submit
C:\Program Files\CyberGhost 8\fr\Dashboard.resources.dll

Filesize
54KB

MD5
0dc7aa365623f8ce8249ec55d3ff3c13

SHA1
3012b00e22ed69c5b40f56f1df7a332175228c53

SHA256
669cf901ec14a5a2480263aae07034a5bb69290c693b8dcd76278b31dbc66c06

SHA512
92efef973a3c18b917bfc21d2255a1d918cf613a68412a38cf8486954ed78e410a9d9b6c242c19314676cf9442887fbbb4838ca1cbd4ca860e2c0e9c38d0bdbf

Download Submit
C:\Program Files\CyberGhost 8\it\Dashboard.resources.dll

Filesize
52KB

MD5
18b878604e428501e8addad6cb31fb18

SHA1
8a64213b0a041a56e5e559b6c9f5dddb509e9aaf

SHA256
a1a492a8913bdee1edc08be636ca9cd5f44c9a559cab77709aa6b6129641b061

SHA512
c12b43811fe779226c6b734673474724d5335824c9d9fc5dca8ea9c49681556a18e8c1d890cceae250bc4cdc814f0c303f9eeb89d3646ea1676d5ed6f74d330e

Download Submit
C:\Program Files\CyberGhost 8\wyUpdate.exe

Filesize
621KB

MD5
6d47a82b3e4d08fe34a7f234aa398817

SHA1
1d751bac478562908d3fbe7d72fe3fdf5e277ac0

SHA256
c126ac09b061f2727384ea45dcfcde4244b1d41d6ed8b11436e8af2213599d6a

SHA512
c5a05c1c319e893fb9385cf118ecd552b408327c51934decbd3946b52fee4e6a1c971de9d18188dbb6000e7eba181ac554cc41e1ae1139bae395f7438a81d5f1

Download Submit
C:\Program Files\CyberGhost 8\wyUpdate.new

Filesize
623KB

MD5
599be6e85cecd0cd68c2387ebfa6290f

SHA1
65fde83df9682889b6b6671ef14eccebaad86d0f

SHA256
f63ff15827dea59530e190122e65291ae684cf656dcf34f87854de047fb95f28

SHA512
eab9e497e1b4607a774c022ab228d1723d2a6d2f05570101ff991b42507ccbc01428b20744baa5a240af7ace42cf356c9b4631efa778c3739417dda1fa4e44ca

Download Submit
C:\Users\Admin\AppData\Local\CyberGhost\dynamicmessages.json

Filesize
42KB

MD5
aca3b8db3b6b439c3e5b39300766f49d

SHA1
11c56a7c45426605da235819cf135ddbee409c96

SHA256
e3fae9c31b5ebc2d232204bef9c11ababbe655de843d75a42a77485aeed945e7

SHA512
2dfd1fc3d15c7b20268db9a35392213b23f3cc5255655dffca3e804631b7c25fc63348f92f58a286d1e6dca352388a03f8937b59d7566bed9dece3abc21a60d7

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\wta13l3h.nmj\2gjjijk4.ivk\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\StrongName.bx0ds5js14qgmnal5bhexnafezsd5pyy\Files\LaunchDarkly_QUEtxzTz76Ad8h9-oQ6Z5qLlzl8ZwK6bWWpos3tjUh4=\flags_FFiJRoZ53kEX0IukLW3ncXlcSfPIreq5QyDZIcVHVpY=

Filesize
18KB

MD5
b9187a3a510969536eb40d07a692944d

SHA1
f33b6938895a2f233d4d14ddd18180b939fca121

SHA256
095c2b15b4c37b1056d88f0e8af10a92831718bf93be9c53ad98320fb485d036

SHA512
8a755843e0257739d8e864e3d75e78734ae5790396aab05dc103cf7a74cadcd90c76a6950a2e182f08500db2d0caa51fab8bf615054faaf5d8f67dbed256f0bf

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\wta13l3h.nmj\2gjjijk4.ivk\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\StrongName.bx0ds5js14qgmnal5bhexnafezsd5pyy\identity.dat

Filesize
529B

MD5
b81dfaf8c0f7f1e2f170f4c6cb8c5634

SHA1
c24612cfc0b9c1067c311b4a9e6f7a98feda645f

SHA256
1f8da753d2cdc1c999a1cf1331c7ce4156c3cccf9ac6ed14b6621e6697566fdf

SHA512
980f1be6a48154a65cfd92d45a5737b53b20e2da48f1d88afb0e8186cb0cd9079436d4f6ad422012e8a7bcacba5b5452558ed3fddf904cb1e5c5bbb6dae0c051

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\wta13l3h.nmj\2gjjijk4.ivk\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\identity.dat

Filesize
516B

MD5
ddb6c9ec80f08e7b536510fe2ab4516a

SHA1
858da9c8457121f41c6b9a90517effa2b6603916

SHA256
3279e9e4aba9a713424b1e495e558182de1e096463d515fc6d35495e2a1b0f19

SHA512
f176a2aff227a3bdc583cbda7cc945dd996649c155fcb090a8d18bcb30979a95d66e282e5303776cea47472e0c664ff462ef8fa8883412cbf9bd6d4a4e6eb108

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\wta13l3h.nmj\2gjjijk4.ivk\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\info.dat

Filesize
64B

MD5
737a981e818861f62642c7cf461348ab

SHA1
64bbe79684ebae71d36197596f840187a51b035e

SHA256
12c8756e2239a10e480ca4fba15abdf37d1f66a05cf935a46207e223f09511b2

SHA512
aed9a8772fc565c13bae15a7f8f50453ccef63daff41e2e760f8d121e97d9c77306ffa296b32891ff2f7f477c0569e287e17bf3ac1b203ccf1a6aec8a06065c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
6687afd55424836aa873747895cb79ac

SHA1
b75202789a418717e5e845dfa8432bf66f362f71

SHA256
6d27294f7b03f5e30c684d8d27707e0fd4ebd10e9221ab1eab42715eec545e81

SHA512
af4c8f0e66766d0b59b8b4049758c59f49a21075ff95ec0d4d4233c62a81a8c049e72f4607ca5a5da2e5400a645ec2aaa0799ec56a75647c99474ff8ed5442a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpBF97.tmp

Filesize
2KB

MD5
647f843626b023aaaa748f924f95ac25

SHA1
652cacf99409e3dcd39b6eb8839c16d22b1800e8

SHA256
732dee732e0261afbfba21eca43008a5009cfc9e4c405ece8826a9746564cceb

SHA512
61093dcbe07efa5bdffec4933243168bf40b8159bc5a9840552bc3ea8e7c129156276a8548c658e5267bf0b8c4448dcb5c8ab10140c72ed48eb8910c075022fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk12F7.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk12F7.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk12F7.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA289.tmp.exe

Filesize
5.0MB

MD5
72540194bd451dac050609406eb50a56

SHA1
57c33ec10f90f81f6abc612b4d251510c36ebd6b

SHA256
3a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74

SHA512
ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444

Download Submit
C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1690.tmp

Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1691.tmp

Filesize
19KB

MD5
c757503bc0c5a6679e07fe15b93324d6

SHA1
6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

SHA256
91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

SHA512
efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

Download Submit
C:\Windows\System32\DriverStore\Temp\{c79c2ca6-4b1f-c649-8a5e-3f594a1230d9}\SET1692.tmp

Filesize
26KB

MD5
d765f43cbea72d14c04af3d2b9c8e54b

SHA1
daebe266073616e5fc931c319470fcf42a06867a

SHA256
89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

SHA512
ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

Download Submit
memory/836-1514-0x0000021B56E10000-0x0000021B56E22000-memory.dmp

Filesize
72KB

Download
memory/836-1493-0x0000021B569F0000-0x0000021B56A00000-memory.dmp

Filesize
64KB

Download
memory/836-1401-0x0000021B552B0000-0x0000021B552BE000-memory.dmp

Filesize
56KB

Download
memory/836-1395-0x0000021B3C9C0000-0x0000021B3C9C8000-memory.dmp

Filesize
32KB

Download
memory/836-1399-0x0000021B55F90000-0x0000021B55FAA000-memory.dmp

Filesize
104KB

Download
memory/836-1393-0x0000021B55FC0000-0x0000021B55FE8000-memory.dmp

Filesize
160KB

Download
memory/836-1381-0x0000021B56040000-0x0000021B560E6000-memory.dmp

Filesize
664KB

Download
memory/836-1383-0x0000021B560F0000-0x0000021B5614C000-memory.dmp

Filesize
368KB

Download
memory/836-1385-0x0000021B56150000-0x0000021B561BE000-memory.dmp

Filesize
440KB

Download
memory/836-1505-0x0000021B56BA0000-0x0000021B56BB2000-memory.dmp

Filesize
72KB

Download
memory/836-1387-0x0000021B55280000-0x0000021B552B0000-memory.dmp

Filesize
192KB

Download
memory/836-1389-0x0000021B55E50000-0x0000021B55E76000-memory.dmp

Filesize
152KB

Download
memory/836-1391-0x0000021B3C9D0000-0x0000021B3C9E0000-memory.dmp

Filesize
64KB

Download
memory/836-1379-0x0000021B3C960000-0x0000021B3C998000-memory.dmp

Filesize
224KB

Download
memory/836-1377-0x0000021B551E0000-0x0000021B55280000-memory.dmp

Filesize
640KB

Download
memory/836-1375-0x0000021B3AB20000-0x0000021B3AC7E000-memory.dmp

Filesize
1.4MB

Download
memory/836-1499-0x0000021B56B80000-0x0000021B56B92000-memory.dmp

Filesize
72KB

Download
memory/836-1497-0x0000021B56B50000-0x0000021B56B60000-memory.dmp

Filesize
64KB

Download
memory/836-1495-0x0000021B56A00000-0x0000021B56A10000-memory.dmp

Filesize
64KB

Download
memory/836-1397-0x0000021B56280000-0x0000021B56332000-memory.dmp

Filesize
712KB

Download
memory/836-1491-0x0000021B569D0000-0x0000021B569E0000-memory.dmp

Filesize
64KB

Download
memory/836-1489-0x0000021B569C0000-0x0000021B569CE000-memory.dmp

Filesize
56KB

Download
memory/836-1487-0x0000021B56860000-0x0000021B56870000-memory.dmp

Filesize
64KB

Download
memory/836-1485-0x0000021B569E0000-0x0000021B569F0000-memory.dmp

Filesize
64KB

Download
memory/836-1483-0x0000021B56850000-0x0000021B56860000-memory.dmp

Filesize
64KB

Download
memory/836-1517-0x0000021B56E70000-0x0000021B56E86000-memory.dmp

Filesize
88KB

Download
memory/836-1516-0x0000021B56E50000-0x0000021B56E64000-memory.dmp

Filesize
80KB

Download
memory/836-1515-0x0000021B56E30000-0x0000021B56E42000-memory.dmp

Filesize
72KB

Download
memory/836-1513-0x0000021B56DF0000-0x0000021B56E02000-memory.dmp

Filesize
72KB

Download
memory/836-1512-0x0000021B56DD0000-0x0000021B56DE2000-memory.dmp

Filesize
72KB

Download
memory/836-1511-0x0000021B56DB0000-0x0000021B56DC2000-memory.dmp

Filesize
72KB

Download
memory/836-1509-0x0000021B56D90000-0x0000021B56DA2000-memory.dmp

Filesize
72KB

Download
memory/836-1507-0x0000021B56BC0000-0x0000021B56BD2000-memory.dmp

Filesize
72KB

Download
memory/1352-0-0x00007FFF6FE53000-0x00007FFF6FE55000-memory.dmp

Filesize
8KB

Download
memory/1352-53-0x00007FFF6FE50000-0x00007FFF70912000-memory.dmp

Filesize
10.8MB

Download
memory/1352-4-0x000000001CE10000-0x000000001D338000-memory.dmp

Filesize
5.2MB

Download
memory/1352-3-0x000000001C710000-0x000000001C8D2000-memory.dmp

Filesize
1.8MB

Download
memory/1352-2-0x00007FFF6FE50000-0x00007FFF70912000-memory.dmp

Filesize
10.8MB

Download
memory/1352-1-0x00000000009E0000-0x0000000000A00000-memory.dmp

Filesize
128KB

Download
memory/1448-1419-0x000001BAF3460000-0x000001BAF349C000-memory.dmp

Filesize
240KB

Download
memory/1448-1418-0x000001BADAC70000-0x000001BADAC82000-memory.dmp

Filesize
72KB

Download
memory/1448-1405-0x000001BAD8F30000-0x000001BAD8F44000-memory.dmp

Filesize
80KB

Download
memory/5084-74-0x000001B865000000-0x000001B865008000-memory.dmp

Filesize
32KB

Download
memory/5084-52-0x00007FFF6FE50000-0x00007FFF70912000-memory.dmp

Filesize
10.8MB

Download
memory/5084-107-0x000001B8686A0000-0x000001B8686AA000-memory.dmp

Filesize
40KB

Download
memory/5084-75-0x000001B865060000-0x000001B865068000-memory.dmp

Filesize
32KB

Download
memory/5084-54-0x000001B849080000-0x000001B849590000-memory.dmp

Filesize
5.1MB

Download
memory/5084-55-0x000001B84B3C0000-0x000001B84B456000-memory.dmp

Filesize
600KB

Download
memory/5084-56-0x000001B849A20000-0x000001B849A28000-memory.dmp

Filesize
32KB

Download
memory/5084-57-0x000001B84B210000-0x000001B84B218000-memory.dmp

Filesize
32KB

Download
memory/5084-58-0x00007FFF6FE50000-0x00007FFF70912000-memory.dmp

Filesize
10.8MB

Download
memory/5084-72-0x000001B864E20000-0x000001B864E28000-memory.dmp

Filesize
32KB

Download
memory/5084-105-0x000001B869600000-0x000001B869626000-memory.dmp

Filesize
152KB

Download
memory/5084-104-0x000001B869570000-0x000001B869602000-memory.dmp

Filesize
584KB

Download
memory/5084-101-0x000001B8682F0000-0x000001B868302000-memory.dmp

Filesize
72KB

Download
memory/5084-100-0x000001B868240000-0x000001B8682F2000-memory.dmp

Filesize
712KB

Download
memory/5084-99-0x000001B868200000-0x000001B86823A000-memory.dmp

Filesize
232KB

Download
memory/5084-98-0x000001B867980000-0x000001B86798A000-memory.dmp

Filesize
40KB

Download
memory/5084-97-0x000001B8681D0000-0x000001B8681F2000-memory.dmp

Filesize
136KB

Download
memory/5084-84-0x000001B868160000-0x000001B86819A000-memory.dmp

Filesize
232KB

Download
memory/5084-83-0x000001B8679E0000-0x000001B867A18000-memory.dmp

Filesize
224KB

Download
memory/5084-82-0x000001B867970000-0x000001B86797E000-memory.dmp

Filesize
56KB

Download
memory/5084-81-0x000001B8679A0000-0x000001B8679D8000-memory.dmp

Filesize
224KB

Download
memory/5084-80-0x000001B867910000-0x000001B867918000-memory.dmp

Filesize
32KB

Download
memory/5084-79-0x000001B867900000-0x000001B867908000-memory.dmp

Filesize
32KB

Download
memory/5084-78-0x000001B865320000-0x000001B865336000-memory.dmp

Filesize
88KB

Download
memory/5084-77-0x000001B8651C0000-0x000001B8651C8000-memory.dmp

Filesize
32KB

Download
memory/5084-76-0x000001B865140000-0x000001B865148000-memory.dmp

Filesize
32KB

Download
memory/5084-1352-0x000001B869680000-0x000001B8696D0000-memory.dmp

Filesize
320KB

Download
memory/5084-1353-0x000001B869750000-0x000001B8697C6000-memory.dmp

Filesize
472KB

Download
memory/5084-106-0x000001B8686E0000-0x000001B8686E8000-memory.dmp

Filesize
32KB

Download
memory/5084-73-0x000001B864E60000-0x000001B864E68000-memory.dmp

Filesize
32KB

Download
memory/5084-71-0x000001B864DC0000-0x000001B864DC8000-memory.dmp

Filesize
32KB

Download
memory/5084-70-0x000001B864D20000-0x000001B864D28000-memory.dmp

Filesize
32KB

Download
memory/5084-69-0x000001B864720000-0x000001B864728000-memory.dmp

Filesize
32KB

Download
memory/5084-68-0x000001B8641C0000-0x000001B8641C8000-memory.dmp

Filesize
32KB

Download
memory/5084-67-0x000001B84B490000-0x000001B84B498000-memory.dmp

Filesize
32KB

Download
memory/5084-66-0x000001B8640A0000-0x000001B8640CA000-memory.dmp

Filesize
168KB

Download
memory/5084-65-0x000001B84B470000-0x000001B84B47E000-memory.dmp

Filesize
56KB

Download
memory/5084-63-0x000001B863ED0000-0x000001B863EEA000-memory.dmp

Filesize
104KB

Download
memory/5084-64-0x000001B863EF0000-0x000001B863F36000-memory.dmp

Filesize
280KB

Download
memory/5084-62-0x000001B863D00000-0x000001B863DA0000-memory.dmp

Filesize
640KB

Download
memory/5084-61-0x000001B84B280000-0x000001B84B28A000-memory.dmp

Filesize
40KB

Download
memory/5084-60-0x000001B84B1F0000-0x000001B84B1FA000-memory.dmp

Filesize
40KB

Download
memory/5084-59-0x000001B863C70000-0x000001B863D04000-memory.dmp

Filesize
592KB

Download
memory/5944-1477-0x000001784DA10000-0x000001784DAE8000-memory.dmp

Filesize
864KB

Download
memory/5944-1451-0x000001784CBE0000-0x000001784CC14000-memory.dmp

Filesize
208KB

Download
memory/5944-1479-0x000001784D0D0000-0x000001784D0FA000-memory.dmp

Filesize
168KB

Download
memory/5944-1470-0x000001784CC80000-0x000001784CCB0000-memory.dmp

Filesize
192KB

Download
memory/5944-1460-0x000001784D010000-0x000001784D0CC000-memory.dmp

Filesize
752KB

Download
memory/5944-1472-0x000001784CCB0000-0x000001784CCD0000-memory.dmp

Filesize
128KB

Download
memory/5944-1449-0x000001784CB40000-0x000001784CB9A000-memory.dmp

Filesize
360KB

Download
memory/5944-1447-0x000001784BAE0000-0x000001784BAEE000-memory.dmp

Filesize
56KB

Download
memory/5944-1437-0x0000017833140000-0x000001783314A000-memory.dmp

Filesize
40KB

Download
memory/5944-1439-0x0000017833160000-0x000001783316A000-memory.dmp

Filesize
40KB

Download
memory/5944-1435-0x000001784C8A0000-0x000001784C936000-memory.dmp

Filesize
600KB

Download