f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58

Analysis

max time kernel
913s
max time network
547s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CyberGhostVPNSetup.exe
Size 127KB
Sample260908-vddr4agg73
SHA256 f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58
MD5 fd093f3100a56b710c50d41667da7e2b
SHA1 5ec9063e4380f642d2a551da76fd4d3f00fd4c96
SHA512 d3daebf6e3669a4b2a944e60d97c86fd31878cea66e252f05ea8d23f92c1f02ef8e6f4dda250b979a9b9df3fa71dc43c4ab98e2cae52e7687861d1e9a3dd09c0
SSDEEP 3072:ACNd5JY06+ywjDnJShh8N7JNzFrxO/DLxPO4GV:TNVPtVQ7LtOz
TLSH
T1FBD36322DAA84D1BDAFC03B4B1AC4203B5606B270604AA4B31F46F4EBFBFE539554D5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	5764	CyberGhostVPNSetup.exe

Executes dropped EXE 1 IoCs

pid	Process
5020	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\91021e4b-d757-461a-b272-9f13871ba88a\a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe	CyberGhostVPNSetup.exe
File opened for modification	C:\Program Files\91021e4b-d757-461a-b272-9f13871ba88a\Installer.log	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CyberGhostVPNSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	CyberGhostVPNSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae47f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42267e00000001000000080000000080826f22e7dc010300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	CyberGhostVPNSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee47e00000001000000080000000080826f22e7dc011d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e37f0000000100000016000000301406082b0601050507030306082b06010505070304620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	CyberGhostVPNSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	CyberGhostVPNSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CyberGhostVPNSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CyberGhostVPNSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CyberGhostVPNSetup.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5020	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe
5020	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe
5020	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe
5020	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe
5020	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5764	CyberGhostVPNSetup.exe
Token: SeSecurityPrivilege	5764	CyberGhostVPNSetup.exe
Token: SeDebugPrivilege	5020	a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 5020	5764	CyberGhostVPNSetup.exe	90

C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe
"C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Program Files\91021e4b-d757-461a-b272-9f13871ba88a\a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe
  "C:\Program Files\91021e4b-d757-461a-b272-9f13871ba88a\a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4404

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe

Path C:\Program Files\91021e4b-d757-461a-b272-9f13871ba88a\a1d8a97b-a7d9-456c-a9de-8ada4e4520d4.exe
Size 5.0MB
SHA256 3a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74
MD5 72540194bd451dac050609406eb50a56
SHA1 57c33ec10f90f81f6abc612b4d251510c36ebd6b
SHA512 ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444
SSDEEP 98304:lekqXf0F/PeHFr5MFyA2WH5e5BP4D5EMsveMy+VsEH7C2BVAQbzMEjahD1BI:lekSI/PyrWA1WH54Xy+VV7C2WI
TLSH
T151360206BBA4637BC5C603B86B1B01D2A7ADD02D9EF1D109785F8217135F9AC82B75E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 5e09283915a45a7f0491169c5c98e8c27f65fca7f64598413592db7675dd24e3
MD5 08339a0db3ec5456747051a59a0d2746
SHA1 c643f094a496d07fd6b134de3c1d4082cc79061e
SHA512 de4e01a47c24ef769e67b01c8b3008b3c0a7673339966337dee2f12212e09565a4d2a45530ef4dae4c82e3952920900ac009b68ef007a6760cdb2aed884d0e54
TLSH
T1B10170A10F3080437F2C44F00350E0B2B121AA7E38B9138DB82BC589022ABE8A7B8C4C
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_46E4040B4A28D439FBFA7E9FC642442C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_46E4040B4A28D439FBFA7E9FC642442C
Size 637B
SHA256 6d1e2f2cc2bbaf3173de1070a9c758650f81dc5dc82e6ab288d62586d9fe715e
MD5 20c34bb9e3d1f6a5d34405f1f6c9008d
SHA1 c6daa339eebd4765ef00c932a7b307dbbd3911bb
SHA512 7fcfef5bc407af0744bdc88430a6d006f874a903eeb8b7cb151544c8b283ff56e4bc298e0c5b04a4674eb6cca81c738308814d3ef2f6e2b9f1ba17c1ac3a20e2
TLSH
T14EF06845D820C798ACC0C5120BD2D5E9F370303634C4135FB23673101A583CDE7D9438
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 ad0f830891bd8860f3068f374b99bc652329ce6c0d1948606020c400fcd2f2ce
MD5 f14226b68ae3308b4d9b4d10798598b3
SHA1 7f73eea54482e337df3a535da60e04a1d4ca5f41
SHA512 53641c8ff4d53da34366fcafe19f0306eefeb844e57cd66bc6f4d1be40f77802bd6be2e75622faf11a793554bd6d66edf06dc21e231deff671bc6c5bda100921
TLSH
T11931E6E37F787D206E049D859CCE8B72BCB234E6B5640CB838A94097D863FD45C0940D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 b7c4059d2161f8659750f31ccf9cfcb0b74ba77d31a3aec9bffde8272b9d7222
MD5 12c67a810f6e5e684f56f6875bf49a0a
SHA1 57582bbdea04df3f4d7b8e5e6277cede8c43d802
SHA512 df80c7cf82a793f618dad28e0ce3d518a91a05c2dabc6a04c50b26166c3ad0da64fb0c0ba86e38d9854307c38c4851009e90de442d4c57c0d61efd226609fff6
TLSH
T172F0AB341DF7003FF1764CB15BE4B4A26C1AF213240189A65BA903098F0FF852C81165
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_46E4040B4A28D439FBFA7E9FC642442C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_46E4040B4A28D439FBFA7E9FC642442C
Size 488B
SHA256 f22f71f329a8f19a49859041816d49ed5e644e8e1cb3311ee2f4a7d7b94dd2ad
MD5 d975066da7a3873fbbf205e577101540
SHA1 fa2d915d9d46d0065b1ee56bcb0267dfb82ec71f
SHA512 061f198e9edc3364152152e12bdfe6d771772a0f3f80ad73e515327f6ff141fc21ea6ace22899103875df2c1cd5a648c0859fe7b1ffafc55a8c30e0519542420
TLSH
T1C8F0A31434EF003AE0F76E77C3E154E5059EF00B34099E6C175143155B09F404D53830
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 1c6e40e4c666359fe2bdf473d954360e627184d2582a34cf7ea8a3fad3d904ff
MD5 8dc22daddaa461a1491aae6ad99425ed
SHA1 4303e90636ca80f74d0dbfa8b24ecf53990f84c4
SHA512 c087daad69a269bbd4bd833cfbc4285d7b4fd60d96f70c2fa540202318e9895b22b199962436ec7708a017cfe14d6fc4c02f3326dfe95883dfad621f5d43ba97
TLSH
T1A4F0AB2025F1617EF0B72F728AE8B62ACC7CF322100506A606225607160A6824ED0D7B
MD5 SHA1 SHA512 TLSH

Submit Download

TmpF37E.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF37E.tmp
Size 2KB
SHA256 732dee732e0261afbfba21eca43008a5009cfc9e4c405ece8826a9746564cceb
MD5 647f843626b023aaaa748f924f95ac25
SHA1 652cacf99409e3dcd39b6eb8839c16d22b1800e8
SHA512 61093dcbe07efa5bdffec4933243168bf40b8159bc5a9840552bc3ea8e7c129156276a8548c658e5267bf0b8c4448dcb5c8ab10140c72ed48eb8910c075022fa
TLSH
T14141F83D1FA66C623ED242DCD1BC199E80C612B67EEF30F5B91D328A4604038697EE95
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5020-75-0x0000025FFCB40000-0x0000025FFCB48000-memory.dmp

Download

memory/5020-80-0x0000025FFCEC0000-0x0000025FFCEC8000-memory.dmp

Download

memory/5020-50-0x0000025FF84A0000-0x0000025FF89B0000-memory.dmp

Download

memory/5020-54-0x0000025FFA800000-0x0000025FFA896000-memory.dmp

Download

memory/5020-55-0x0000025FF8E20000-0x0000025FF8E28000-memory.dmp

Download

memory/5020-56-0x0000025FF8ED0000-0x0000025FF8ED8000-memory.dmp

Download

memory/5020-57-0x0000025FFB1F0000-0x0000025FFB284000-memory.dmp

Download

memory/5020-59-0x0000025FF8F30000-0x0000025FF8F3A000-memory.dmp

Download

memory/5020-58-0x0000025FF8E40000-0x0000025FF8E4A000-memory.dmp

Download

memory/5020-60-0x0000025FFB280000-0x0000025FFB320000-memory.dmp

Download

memory/5020-62-0x0000025FFA790000-0x0000025FFA7D6000-memory.dmp

Download

memory/5020-61-0x0000025FFA770000-0x0000025FFA78A000-memory.dmp

Download

memory/5020-63-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-64-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-65-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-66-0x0000025FFA750000-0x0000025FFA75E000-memory.dmp

Download

memory/5020-67-0x0000025FFB1B0000-0x0000025FFB1DA000-memory.dmp

Download

memory/5020-68-0x0000025FFA7E0000-0x0000025FFA7E8000-memory.dmp

Download

memory/5020-69-0x0000025FFBF40000-0x0000025FFBF48000-memory.dmp

Download

memory/5020-70-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-71-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-72-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-73-0x0000025FFC4A0000-0x0000025FFC4A8000-memory.dmp

Download

memory/5020-74-0x0000025FFCAA0000-0x0000025FFCAA8000-memory.dmp

Download

memory/5020-51-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-76-0x0000025FFCBA0000-0x0000025FFCBA8000-memory.dmp

Download

memory/5020-77-0x0000025FFCBE0000-0x0000025FFCBE8000-memory.dmp

Download

memory/5020-79-0x0000025FFCDE0000-0x0000025FFCDE8000-memory.dmp

Download

memory/5020-78-0x0000025FFCD80000-0x0000025FFCD88000-memory.dmp

Download

memory/5020-53-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-81-0x0000025FFCF40000-0x0000025FFCF48000-memory.dmp

Download

memory/5020-82-0x0000025FFCFA0000-0x0000025FFCFB6000-memory.dmp

Download

memory/5020-83-0x0000025FFF580000-0x0000025FFF588000-memory.dmp

Download

memory/5020-84-0x0000025FFF590000-0x0000025FFF598000-memory.dmp

Download

memory/5020-85-0x0000025FFF5E0000-0x0000025FFF61E000-memory.dmp

Download

memory/5020-86-0x0000025FFF5A0000-0x0000025FFF5AE000-memory.dmp

Download

memory/5020-88-0x0000025F992E0000-0x0000025F9931A000-memory.dmp

Download

memory/5020-87-0x0000025F992A0000-0x0000025F992D8000-memory.dmp

Download

memory/5020-52-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-99-0x0000025FFF620000-0x0000025FFF642000-memory.dmp

Download

memory/5020-100-0x0000025F99320000-0x0000025F9932A000-memory.dmp

Download

memory/5020-101-0x0000025F99340000-0x0000025F9937A000-memory.dmp

Download

memory/5020-102-0x0000025F99380000-0x0000025F99432000-memory.dmp

Download

memory/5020-103-0x0000025FFF650000-0x0000025FFF662000-memory.dmp

Download

memory/5020-104-0x0000026000000000-0x0000026000510000-memory.dmp

Download

memory/5020-105-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-106-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5020-107-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5764-1-0x0000000000450000-0x0000000000472000-memory.dmp

Download

memory/5764-0-0x00007FFB5540F000-0x00007FFB55410000-memory.dmp

Download

memory/5764-2-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5764-4-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5764-3-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5764-5-0x000000001C530000-0x000000001C6F2000-memory.dmp

Download

memory/5764-6-0x000000001CC30000-0x000000001D158000-memory.dmp

Download

memory/5764-7-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5764-13-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5764-10-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/5764-23-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download