Analysis
- user interaction
yes - max time kernel
340s - max time network
342s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/05/2026, 15:06
General
- Target CyberGhostVPNSetup.exe
- Size 127KB
- Sample260523-sg2bfsd14x
- SHA256 f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 3 IoCs
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 28 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 15 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 5 IoCs
- Modifies system certificate store 2 TTPs 11 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 38 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\cc3d1279-e70d-46cc-9b10-138d4e74a7b9\ff43eddc-c2b3-4297-8b76-a8ad4047079d.exe"C:\Program Files\cc3d1279-e70d-46cc-9b10-138d4e74a7b9\ff43eddc-c2b3-4297-8b76-a8ad4047079d.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\CyberGhost 8\Dashboard.exe"C:\Program Files\CyberGhost 8\Dashboard.exe" /install3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\CyberGhost 8\Dashboard.Service.exe"C:\Program Files\CyberGhost 8\Dashboard.Service.exe" --install4⤵
- Executes dropped EXE
-
-
C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\Win10\amd64\devcon.exe"C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\Win10\amd64\devcon.exe" install "C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\Win10\amd64\OemVista.inf" tap09014⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\CyberGhost 8\Dashboard.Service.exe"C:\Program Files\CyberGhost 8\Dashboard.Service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\CyberGhost 8\wyUpdate.exe"C:\Program Files\CyberGhost 8\wyUpdate.exe" /justcheck /quickcheck /noerr -server="https://download.cyberghostvpn.com/windows/updates/8/nt/wyserver.wys"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\netsh.exe"netsh" interface ip set address "Local Area Connection" static 169.254.123.1 255.255.0.02⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe"C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Local Area Connection" /d *2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\netsh.exe"netsh" interface set interface "Local Area Connection" DISABLED2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe"C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Local Area Connection" /e ms_tcpip2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\netsh.exe"netsh" interface set interface "Local Area Connection" ENABLED2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe"C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Local Area Connection" /e ms_tcpip62⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\netsh.exe"netsh" interface ipv6 set teredo disable2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" interface ip set address "Local Area Connection" static 169.254.123.254 255.255.0.02⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe"C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Local Area Connection" /e ms_tcpip62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3c449be9-6608-6b49-a2d4-5b2c33f693a5}\oemvista.inf" "9" "4d14a44ff" "000000000000010C" "WinSta0\Default" "0000000000000148" "208" "c:\program files\cyberghost 8\applications\vpn\data\openvpn\x64\win10\amd64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:tap0901," "4d14a44ff" "000000000000010C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\CyberGhost 8\Dashboard.exe"C:\Program Files\CyberGhost 8\Dashboard.exe" /firststart1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Dashboard.exe --webview-exe-version=8.4.14.14661 --user-data-dir="C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5732.5936.113597663427395592192⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffce5e1b078,0x7ffce5e1b084,0x7ffce5e1b0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView" --webview-exe-name=Dashboard.exe --webview-exe-version=8.4.14.14661 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1760,i,6012536539802848842,15988162252391259411,262144 --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView" --webview-exe-name=Dashboard.exe --webview-exe-version=8.4.14.14661 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1400,i,6012536539802848842,15988162252391259411,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView" --webview-exe-name=Dashboard.exe --webview-exe-version=8.4.14.14661 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2380,i,6012536539802848842,15988162252391259411,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView" --webview-exe-name=Dashboard.exe --webview-exe-version=8.4.14.14661 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3712,i,6012536539802848842,15988162252391259411,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView" --webview-exe-name=Dashboard.exe --webview-exe-version=8.4.14.14661 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4044,i,6012536539802848842,15988162252391259411,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CyberGhost\BrowserCache\EBWebView" --webview-exe-name=Dashboard.exe --webview-exe-version=8.4.14.14661 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4208,i,6012536539802848842,15988162252391259411,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:13⤵
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\CyberGhost 8\Dashboard.exe"C:\Program Files\CyberGhost 8\Dashboard.exe" /autostart /min1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcef84c728,0x7ffcef84c734,0x7ffcef84c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,10371470421487102472,14500080772562228312,524288 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1780,i,11874765707231037948,1574329247072317156,262144 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,14128955842824388824,2428037487062410696,524288 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2684 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,5768509044157771896,8091160088102579969,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,122308951167765939,5972251002479598721,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,2517103329389301672,10907459159750564418,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,4855612778116450317,5530478183944499789,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,661590349314362036,2300590533286572704,524288 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5860,i,16793363865110767158,7109326802632756796,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4760,i,13222493577507536693,8284760684940636159,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3428,i,11826849375204737222,204861895603404543,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5704,i,8388858162808830209,7132434107394260626,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3980,i,10627770648058860981,14925781168427553186,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5924,i,9887568568845375649,1110624896348493936,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3304,i,11720497668283236542,8953510626819577079,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6184,i,17411525060691547955,7257389089138245626,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6192,i,18050783477630338127,16413639829512567961,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6480,i,15711905091208837018,11267788372630053819,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6448,i,9203458782902518781,1652810978206819201,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7020,i,3118310462278647716,5778715649801539081,524288 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7024 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7000,i,15291964403308384014,10975016444814789862,524288 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7004 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,12903989149125361330,14599225431317360842,524288 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7336 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7152,i,16395972093863205259,11139146463298448609,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7176 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7104,i,6661078320544769245,11902112353507656149,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4560,i,10687637886980830783,4146599540408712770,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6620,i,4525936767248561157,13953407426341604737,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7400,i,10064802358006707122,14882205777780934708,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4848,i,12180717647215943908,8286717903573890633,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4608,i,16237127252896359915,10294875545345407138,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7740,i,1143040210046732036,13491116104184298536,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4868,i,11599727771012057228,13685818138935546606,262144 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7556 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7440,i,11774611523049156,589563698557008939,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7992,i,9674307466879719400,13488208095136913660,2097152 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=8184,i,4308679835445940227,11267058378745111822,524288 --field-trial-handle=1976,i,9527135286651657925,3948560837914924328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7892 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
AntiVirus.Core.dll
AntiVirus.dll
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Microsoft.Web.WebView2.WinForms.dll
Microsoft.Web.WebView2.Wpf.dll
RudderAnalytics.dll
System.Threading.Channels.dll
ZstdSharp.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
AntiVirus.resources.dll
CyberGhost.Browser.dll.config
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Microsoft.Web.WebView2.WinForms.dll
Microsoft.Web.WebView2.Wpf.dll
PrivacyGuard.dll
RudderAnalytics.dll
System.Threading.Channels.dll
ZstdSharp.dll
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Microsoft.Web.WebView2.WinForms.dll
Microsoft.Web.WebView2.Wpf.dll
RudderAnalytics.dll
System.Threading.Channels.dll
Updater.Core.dll
Updater.dll
ZstdSharp.dll
CyberGhost.VPN.dll
CyberGhost.VPNServices.dll
CP.png
FR.png
Castle.Core.dll
Castle.Windsor.dll
CyberGhost.Browser.dll
CyberGhost.Controls.dll
Dashboard.Contracts.dll
Dashboard.Core.dll
Dashboard.MPAHelper.dll
Dashboard.Pipes.dll
Dashboard.Service.exe
Dashboard.Service.exe.config
Dashboard.exe
Dashboard.exe.config
MobileConcepts45.dll
Newtonsoft.Json.dll
Sentry.dll
Serilog.Formatting.Compact.dll
Serilog.dll
System.Diagnostics.DiagnosticSource.dll
System.Text.Json.dll
System.Threading.Tasks.Extensions.dll
WPFLocalizeExtension.dll
XAMLMarkupExtensions.dll
Dashboard.resources.dll
wyUpdate.exe
wyUpdate.new
ff43eddc-c2b3-4297-8b76-a8ad4047079d.exe
settings.dat
data_0
data_1
data_2
data_3
MANIFEST-000001
Preferences
Preferences~RFe5d47f8.TMP
000001.dbtmp
Local State
Local State
Local State
Local State
Local State~RFe5ca909.TMP
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000008
f_000075
f_000087
f_000098
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5a1128.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
flags_MLHh9QIs4Rn8u1tQX6Lo5ViMN_SqiAkBwVhsIuO_vEQ=
flags_MLHh9QIs4Rn8u1tQX6Lo5ViMN_SqiAkBwVhsIuO_vEQ=
index
identity.dat
identity.dat
info.dat
TmpE819.tmp
f6e630b5-3209-4959-99c6-bdbf509bd76e.tmp
oemvista.inf
tap0901.cat
tap0901.sys
memory/1944-1476-0x0000017FB0150000-0x0000017FB018C000-memory.dmp
memory/1944-1475-0x0000017F96B10000-0x0000017F96B22000-memory.dmp
memory/1944-1462-0x0000017F94E90000-0x0000017F94EA4000-memory.dmp
memory/2068-1571-0x00000193ACE80000-0x00000193ACE92000-memory.dmp
memory/2068-1569-0x00000193ACE40000-0x00000193ACE52000-memory.dmp
memory/2068-1549-0x00000193AC900000-0x00000193AC910000-memory.dmp
memory/2068-1434-0x00000193AB2C0000-0x00000193AB2F8000-memory.dmp
memory/2068-1551-0x00000193ACA90000-0x00000193ACAA0000-memory.dmp
memory/2068-1446-0x0000019392A60000-0x0000019392A70000-memory.dmp
memory/2068-1430-0x0000019390C10000-0x0000019390D6E000-memory.dmp
memory/2068-1432-0x00000193ABE80000-0x00000193ABF20000-memory.dmp
memory/2068-1450-0x0000019392A50000-0x0000019392A58000-memory.dmp
memory/2068-1456-0x00000193AC0A0000-0x00000193AC0BA000-memory.dmp
memory/2068-1454-0x00000193AC320000-0x00000193AC3D2000-memory.dmp
memory/2068-1565-0x00000193ACC30000-0x00000193ACC42000-memory.dmp
memory/2068-1452-0x00000193AC220000-0x00000193AC252000-memory.dmp
memory/2068-1573-0x00000193ACEC0000-0x00000193ACED2000-memory.dmp
memory/2068-1572-0x00000193ACEA0000-0x00000193ACEB2000-memory.dmp
memory/2068-1458-0x00000193AB3A0000-0x00000193AB3AE000-memory.dmp
memory/2068-1570-0x00000193ACE60000-0x00000193ACE72000-memory.dmp
memory/2068-1444-0x00000193AB3B0000-0x00000193AB3D6000-memory.dmp
memory/2068-1568-0x00000193ACC70000-0x00000193ACC82000-memory.dmp
memory/2068-1567-0x00000193ACC50000-0x00000193ACC62000-memory.dmp
memory/2068-1448-0x00000193AC070000-0x00000193AC09E000-memory.dmp
memory/2068-1563-0x00000193ACC00000-0x00000193ACC10000-memory.dmp
memory/2068-1561-0x00000193ACAB0000-0x00000193ACAC0000-memory.dmp
memory/2068-1559-0x00000193ACAA0000-0x00000193ACAB0000-memory.dmp
memory/2068-1436-0x00000193AC0C0000-0x00000193AC16A000-memory.dmp
memory/2068-1557-0x00000193ACA80000-0x00000193ACA90000-memory.dmp
memory/2068-1438-0x00000193AC010000-0x00000193AC06C000-memory.dmp
memory/2068-1555-0x00000193ACA70000-0x00000193ACA7E000-memory.dmp
memory/2068-1440-0x00000193AC170000-0x00000193AC1DE000-memory.dmp
memory/2068-1553-0x00000193AC910000-0x00000193AC920000-memory.dmp
memory/2068-1442-0x00000193AB340000-0x00000193AB370000-memory.dmp
memory/2104-3286-0x000001943F8D0000-0x000001943F8FB000-memory.dmp
memory/2104-3182-0x00007FFD11000000-0x00007FFD11001000-memory.dmp
memory/2104-3183-0x000001943F900000-0x000001943F901000-memory.dmp
memory/2352-3287-0x0000014BCAF70000-0x0000014BCB01C000-memory.dmp
memory/2352-3215-0x00007FFD10990000-0x00007FFD10991000-memory.dmp
memory/3740-1407-0x000001EDDEA10000-0x000001EDDEA60000-memory.dmp
memory/3740-71-0x000001EDDAAB0000-0x000001EDDAAB8000-memory.dmp
memory/3740-51-0x000001EDBE120000-0x000001EDBE630000-memory.dmp
memory/3740-52-0x000001EDC0240000-0x000001EDC0250000-memory.dmp
memory/3740-53-0x000001EDD94E0000-0x000001EDD9576000-memory.dmp
memory/3740-54-0x000001EDC0210000-0x000001EDC0218000-memory.dmp
memory/3740-55-0x000001EDC0260000-0x000001EDC0268000-memory.dmp
memory/3740-56-0x000001EDD9680000-0x000001EDD9714000-memory.dmp
memory/3740-57-0x000001EDC0250000-0x000001EDC025A000-memory.dmp
memory/3740-58-0x000001EDD9760000-0x000001EDD976A000-memory.dmp
memory/3740-1408-0x000001EDDFA20000-0x000001EDDFA96000-memory.dmp
memory/3740-59-0x000001EDD9770000-0x000001EDD9810000-memory.dmp
memory/3740-107-0x000001EDDE950000-0x000001EDDE95A000-memory.dmp
memory/3740-105-0x000001EDDEAB0000-0x000001EDDEAD6000-memory.dmp
memory/3740-106-0x000001EDDE9A0000-0x000001EDDE9A8000-memory.dmp
memory/3740-104-0x000001EDDF820000-0x000001EDDF8B2000-memory.dmp
memory/3740-101-0x000001EDC0240000-0x000001EDC0250000-memory.dmp
memory/3740-98-0x000001EDDE5A0000-0x000001EDDE5B2000-memory.dmp
memory/3740-97-0x000001EDDE4F0000-0x000001EDDE5A2000-memory.dmp
memory/3740-96-0x000001EDDE4B0000-0x000001EDDE4EA000-memory.dmp
memory/3740-95-0x000001EDDD430000-0x000001EDDD43A000-memory.dmp
memory/3740-94-0x000001EDDE480000-0x000001EDDE4A2000-memory.dmp
memory/3740-81-0x000001EDDE410000-0x000001EDDE44A000-memory.dmp
memory/3740-80-0x000001EDDD490000-0x000001EDDD4C8000-memory.dmp
memory/3740-79-0x000001EDDD420000-0x000001EDDD42E000-memory.dmp
memory/3740-78-0x000001EDDD450000-0x000001EDDD488000-memory.dmp
memory/3740-77-0x000001EDDD3C0000-0x000001EDDD3C8000-memory.dmp
memory/3740-76-0x000001EDDD3B0000-0x000001EDDD3B8000-memory.dmp
memory/3740-75-0x000001EDDADD0000-0x000001EDDADE6000-memory.dmp
memory/3740-73-0x000001EDDABF0000-0x000001EDDABF8000-memory.dmp
memory/3740-74-0x000001EDDAC70000-0x000001EDDAC78000-memory.dmp
memory/3740-60-0x000001EDD9960000-0x000001EDD997A000-memory.dmp
memory/3740-72-0x000001EDDAB10000-0x000001EDDAB18000-memory.dmp
memory/3740-69-0x000001EDDA8D0000-0x000001EDDA8D8000-memory.dmp
memory/3740-70-0x000001EDDA910000-0x000001EDDA918000-memory.dmp
memory/3740-68-0x000001EDDA870000-0x000001EDDA878000-memory.dmp
memory/3740-67-0x000001EDDA7D0000-0x000001EDDA7D8000-memory.dmp
memory/3740-66-0x000001EDDA1D0000-0x000001EDDA1D8000-memory.dmp
memory/3740-65-0x000001EDD9C70000-0x000001EDD9C78000-memory.dmp
memory/3740-64-0x000001EDD9B70000-0x000001EDD9B78000-memory.dmp
memory/3740-63-0x000001EDD9B40000-0x000001EDD9B6A000-memory.dmp
memory/3740-62-0x000001EDD9980000-0x000001EDD998E000-memory.dmp
memory/3740-61-0x000001EDD9990000-0x000001EDD99D6000-memory.dmp
memory/3948-1539-0x0000020AFA070000-0x0000020AFA09A000-memory.dmp
memory/3948-1492-0x0000020AF9900000-0x0000020AF99B2000-memory.dmp
memory/3948-1537-0x0000020AFAAA0000-0x0000020AFAB7A000-memory.dmp
memory/3948-1512-0x0000020AF9D00000-0x0000020AF9D16000-memory.dmp
memory/3948-1514-0x0000020AF9850000-0x0000020AF985A000-memory.dmp
memory/3948-1523-0x0000020AF9D60000-0x0000020AF9D76000-memory.dmp
memory/3948-1520-0x0000020AFA5B0000-0x0000020AFA66C000-memory.dmp
memory/3948-1532-0x0000020AFA010000-0x0000020AFA040000-memory.dmp
memory/3948-1530-0x0000020AF9D60000-0x0000020AF9D76000-memory.dmp
memory/3948-1494-0x0000020AF99C0000-0x0000020AF9A42000-memory.dmp
memory/3948-1534-0x0000020AF9D60000-0x0000020AF9D80000-memory.dmp
memory/3948-1502-0x0000020AF9820000-0x0000020AF982E000-memory.dmp
memory/3948-1506-0x0000020AF9CC0000-0x0000020AF9CF4000-memory.dmp
memory/3948-1504-0x0000020AF98A0000-0x0000020AF98FA000-memory.dmp
memory/5012-11-0x0000000002440000-0x0000000002450000-memory.dmp
memory/5012-0-0x0000000000240000-0x0000000000262000-memory.dmp
memory/5012-3-0x000000001D3F0000-0x000000001D918000-memory.dmp
memory/5012-2-0x000000001CCF0000-0x000000001CEB2000-memory.dmp
memory/5012-1-0x0000000002440000-0x0000000002450000-memory.dmp
memory/6872-3269-0x00000295BDB40000-0x00000295BDBEC000-memory.dmp
memory/6872-3111-0x00007FFD10990000-0x00007FFD10991000-memory.dmp