Analysis

  • max time kernel
    267s
  • max time network
    190s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/08/2024, 21:15

General

  • Target

    cgsetup_en_52vCnuXs6nskn3wQwksK.exe

  • Size

    119KB

  • MD5

    92afa514c40cbcfab9380561b127f657

  • SHA1

    eea59b3b1ba3ec27d80968aec0642956647dc047

  • SHA256

    654a286d076e81869399959d8700c68883300e07ef5f8ad7ef4f38ee15b02221

  • SHA512

    adff54cfc926474012e8ea02a7a76dec486f299142ddb643d636250d9e69bffb902d252956fd4a82e0b395de2a470e201f9d1f10a60384563121be0b6ae78da6

  • SSDEEP

    3072:3SojD9bzGtzJShh8N7q5AdYGgbVileLxBp/B6:CojxOzPtq5di0L3FB6

Malware Config

Signatures

  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 2 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 28 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cgsetup_en_52vCnuXs6nskn3wQwksK.exe
    "C:\Users\Admin\AppData\Local\Temp\cgsetup_en_52vCnuXs6nskn3wQwksK.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\tmp9896.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp9896.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\cgsetup_en_52vCnuXs6nskn3wQwksK.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Program Files\CyberGhost 8\Dashboard.exe
        "C:\Program Files\CyberGhost 8\Dashboard.exe" /install
        3⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Program Files\CyberGhost 8\Dashboard.Service.exe
          "C:\Program Files\CyberGhost 8\Dashboard.Service.exe" --install
          4⤵
          • Executes dropped EXE
          PID:3408
        • C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\tap-windows-9.21.2.exe
          "C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\tap-windows-9.21.2.exe" /S
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3928
          • C:\Program Files\TAP-Windows\bin\tapinstall.exe
            "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
            5⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:4880
          • C:\Program Files\TAP-Windows\bin\tapinstall.exe
            "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:956
  • C:\Program Files\CyberGhost 8\Dashboard.Service.exe
    "C:\Program Files\CyberGhost 8\Dashboard.Service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Program Files\CyberGhost 8\wyUpdate.exe
      "C:\Program Files\CyberGhost 8\wyUpdate.exe" /justcheck /quickcheck /noerr -server="https://download.cyberghostvpn.com/windows/updates/8/nt/wyserver.wys"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4724
    • C:\Windows\system32\netsh.exe
      "netsh" interface ip set address "Ethernet 2" static 169.254.123.236 255.255.0.0
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:2312
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /d *
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4780
    • C:\Windows\system32\netsh.exe
      "netsh" interface set interface "Ethernet 2" DISABLED
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:2196
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1564
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2940
    • C:\Windows\system32\netsh.exe
      "netsh" interface ipv6 set teredo disable
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:1592
    • C:\Windows\system32\netsh.exe
      "netsh" interface set interface "Ethernet 2" ENABLED
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:2904
    • C:\Windows\system32\netsh.exe
      "netsh" interface ip set address "Ethernet 2" static 169.254.123.206 255.255.0.0
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:3912
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /d ms_tcpip6
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4184
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet" /e ms_tcpip6
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2460
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /e ms_tcpip6
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3024
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4852
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Loopback Pseudo-Interface 1" /d ms_tcpip6
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3516
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{41f4b28f-1f43-cc4c-bac9-aed7fb14a914}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000140" "208" "c:\program files\tap-windows\driver"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{D97CEEE7-B63A-45B8-997D-7810110B35E3} Global\{A1D1439A-A55D-44EF-9CEC-0571D17C8130} C:\Windows\System32\DriverStore\Temp\{04fbc966-eefc-0f4d-bb09-c5b9feaf98e6}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{04fbc966-eefc-0f4d-bb09-c5b9feaf98e6}\tap0901.cat
        3⤵
        • Modifies system certificate store
        PID:4420
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000158" "fb68"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3184
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:4220
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4896
    • C:\Program Files\CyberGhost 8\Dashboard.exe
      "C:\Program Files\CyberGhost 8\Dashboard.exe" /firststart
      1⤵
      • Manipulates Digital Signatures
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1136

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\AntiVirus.Core.dll

            Filesize

            190KB

            MD5

            703feb2516cf296ca4fdf66f430fb389

            SHA1

            d1114c9d43fcc908b55ff98f37febacaa437b092

            SHA256

            6c174e47dae570aa70bc17b67209f580ff9ff8cac50cab2165dc10bcd82a8011

            SHA512

            7f7db97fb8bf2d0ba53b1fad0f51744030b1c9006b923b6527e5350b545452db4ba2d7d269c5e490a18676d5a9579216113923e796dfc71b553855ed88f21d20

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\AntiVirus.dll

            Filesize

            339KB

            MD5

            623ca37ebc94f1409984a49672f95890

            SHA1

            9541b01e7c76c8f4334505d039f703a45d8d11e3

            SHA256

            397c57a6c7c93676f7e71e4b36d33fab72afca4e9f09dc0663af94b1272c3fe6

            SHA512

            c00606ca9e8bba92de0251049df40c790c95ecbc1e20dd04e8315b6b1c576ee23888499274f1e1c2b32e93b6ae84f183e56a74654e39133d4156e40ff1f7f3ca

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Extensions.DependencyInjection.Abstractions.dll

            Filesize

            34KB

            MD5

            1057bd714f5861f24ecd87b6fe37e1be

            SHA1

            94c6e4f79eba9c2e119fa911eb5271ff02b57f8c

            SHA256

            71baf16c51318a2ea1d893d4953e93a31284231c1f3ff2af3413a7c9089a5630

            SHA512

            ce43630ce674fd4951aec75511366d2219eaa7df44cef93ca0f0cae111535cfe54c26a31fe8f76df82f77d852b22523be161ee640ff605c090a38db003716147

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Web.WebView2.WinForms.dll

            Filesize

            37KB

            MD5

            ef76622cb8e4dfe6c27bcdcee4970d9f

            SHA1

            89baee9df743fd63403f5897320e574d28ce9484

            SHA256

            aad566577274918ab8fe7a6dbc575a0d9b5bb06dd74bc519b0ca754419797afc

            SHA512

            4a20548e55c0e5923407f911c835e2419e320f7e0a17a0742ba9c764a9e24a6d2374ff6600c069b002718adb633d1902ccf17d1a811c5497055bf6ec82804dd3

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Web.WebView2.Wpf.dll

            Filesize

            44KB

            MD5

            f2410b93d357a5b6bacebeafd7427671

            SHA1

            c08419cac41fe9dfadb7c5244f68c6d56d3b4076

            SHA256

            23eb0cc48273113e8fd55c4f8506ed852edaf173a3995607acda97b96b7fd376

            SHA512

            19d81445e29cbd9107b9ea60c64183c70c6fa4633d5f3b7d0b00ef894b8adae44fe2c65ac6687bcdbab4a02bfdcf65ea1b2a302b401ae79be0b5a8b197ce696b

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\RudderAnalytics.dll

            Filesize

            52KB

            MD5

            40ce83dc38c5768e4ad60b7903f51e2a

            SHA1

            2115d65f039948a3b2531a880d70761331c26ebc

            SHA256

            547648a40c55c7aa38c00ec4c70e0f59cd5615ed27a05cd6ba2e027234376fc4

            SHA512

            1909eae85f406721c83bd29f2b16872551c43147a5bc670f88aec47d60f8c9c6b044976b64a3982e0d488e0a74e800912d3197a3ceae8e577d7e9ca911c9157e

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\de\AntiVirus.resources.dll

            Filesize

            43KB

            MD5

            2ed19bc4b1cfe0e6302ae224862f492c

            SHA1

            cc1171e572a25911d2df51f9ecd068e806eee016

            SHA256

            354095b404cfc05e4f3638cdbfe73462ac8e73939221be6fab67be433f0ea82b

            SHA512

            6cdbcf8d2e73f2e6a4b58cb59e02c0ae2413818a576d0951f48368fc5498c39de62d2d78aeffeed0be4eb3758f618b5fc5c34d1d0e1fdeea2e53fdc341d8b2b6

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\es\AntiVirus.resources.dll

            Filesize

            42KB

            MD5

            b3f9d4e7326dd4302a94142a57feeb77

            SHA1

            5f4d720b0baee20e9121049be55cbb93f911d351

            SHA256

            3dc2b2029beb86f8a837fdb0ae7bdd2e1a575598c703b0657a55451ae6e39dcf

            SHA512

            586f2014c0ee8a89e391aa8001416857c6599cab17b5cb937ac86c200c96ce74175a8e79341583e9e65ca974fb30a0b1167ff8c248412b0b3bd26d13be51d776

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\fr\AntiVirus.resources.dll

            Filesize

            43KB

            MD5

            4b72fff1fdd8cea3fa64e0b04ca0fc29

            SHA1

            e7b7baa865c7c88b4de005e4861a9e1da07a2203

            SHA256

            5137b68df6a44b481358f63d32421baa7a073d014019d4e57510b4368ffacf53

            SHA512

            2b5098584eae1fb83ca638a748503f79d843625643dccd1877100c2592226498a0174d968452140b1497f7a408b03232cbd4e9778b60cdbc9fd19f6ad83ed59c

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\it\AntiVirus.resources.dll

            Filesize

            41KB

            MD5

            224c8d301d3a797833b70d88feb2eeae

            SHA1

            3a1354885f6a493812ed0c076d0f5268f0db4d2e

            SHA256

            34aa42b3200b116b5f4c6513d3ee3742b23418f847c4410bd1df181d6386fdaa

            SHA512

            757f48956696d65d5f9ff66d750872ab9cbfc012f298c362de0848104963b875a1afa89746631769a03e9a735109cd99b35c745f827be0244c6fa553b129a5ac

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\ko\AntiVirus.resources.dll

            Filesize

            43KB

            MD5

            04ad17ea4f99cc5b6fabc6742580a9c7

            SHA1

            c8ef3f6839200c4ad7f315562029baf675d5c62d

            SHA256

            0e6e279e5f178e4370f79d0f26c45f2ec4c0f68dac9861ed5eb805b7670b186d

            SHA512

            6b35073551712e3baf637807b6a0def868f1051e543e84bc879e3926bd7cd121f97f04937ae9764c04e70f359f259448c5df5c7aed8fea6d9b7f536fdaccab19

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\pl\AntiVirus.resources.dll

            Filesize

            43KB

            MD5

            ccfabef7aa55412738a3a3921672f958

            SHA1

            cbeb2cbff3530273013e535270591a41e07e17c5

            SHA256

            858f3cb8043983d3a1d909c8031604bb4984d23ded5884844ce7dd1dc3121e56

            SHA512

            d39cb24b4181745a445338238b06e35ce087dedcdee07fdfaf83917586175a8e9388ae072789ef9c4c327fc5175c190ce9eca55fb28a6b357f0c68bdaeb9f92e

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\pt\AntiVirus.resources.dll

            Filesize

            42KB

            MD5

            1d8ba66db74d5829321aa55d196b8521

            SHA1

            e71c66dd2452095e2c3121a2efb335d3bfc42a0f

            SHA256

            a014b918a60d5c326514259b18ddff7fa10448bcb2835088f37126025fed7f72

            SHA512

            dd7d915395014987e5b209121111a2593ed67ebbcbc5d16d9c2916b2e034e8963e5e629ee78655a5609cd5497c1d3e5ebfd426a27077ea495eac8ca097fba32e

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\ro\AntiVirus.resources.dll

            Filesize

            43KB

            MD5

            ad2c73741c13423cc0440ceccce5748c

            SHA1

            7f2f13e1b68be2bb81137c0cfa8228b40d570d1a

            SHA256

            9c13f968054d39045d117522eac2bb49797df0e802f10d04c43fc243fbb04d5d

            SHA512

            6e6728b77c4d492f50e241ecf2edee2a0bce9391a28e0cc90e31ab8c956891962df9c660cd5d89527e18b6a91939a5bdb0c31c8c7672ad54d9d0ab74b414c335

          • C:\Program Files\CyberGhost 8\Applications\AntiVirus\ru\AntiVirus.resources.dll

            Filesize

            50KB

            MD5

            1f65027352d77c2916b4f1d6d74ce3ff

            SHA1

            ca13aa4f8abd5fd8d17eaaa59ae73ea0e65a1434

            SHA256

            b4a0d921f4c80b4d8ebd08cb74d39254347630bb36a4c8c401a84d75939999f1

            SHA512

            9e49a2d41fd9445e5f71cf858efaf87c5f5bceb5f506ef9f76374827ed83e3b9fb8d47135b6c9ba419e2d9dda97a1aceedf6ba0956e38de862b35fb4e4e47642

          • C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\CyberGhost.Browser.dll.config

            Filesize

            780B

            MD5

            9c1d6723c3978de6e7d9be40d6c3920c

            SHA1

            af418f111137ab825656da62ef2c919836f65353

            SHA256

            6fb1c5765b496209f3811ce6cce41682110e6a59fbbacc367cb34350ab7b789a

            SHA512

            04c62525cf2bd4639fe28f792c4c6bfb43592c1e20897141b8f4effb7107c77ded97f1e205f9f2f6944c49c9e59ddd6f5545947ece8b5c175aef60ded46f5db7

          • C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Extensions.DependencyInjection.Abstractions.dll

            Filesize

            34KB

            MD5

            72a8235620d061b68b298e3cb0ca1178

            SHA1

            ac1608150dd721cece96ff0d694225815195caf8

            SHA256

            b2dfc7f8e8305b691776af8c64f33c98461e3a735596fc6ba0f66eecf7790bc6

            SHA512

            f1c9cfd572876f151fcd7cb9b255908a61911a421bd4d386ac0dabd9639a4e258cc89fd19cd2c06e8c296add6109b2c4f4d1ab92e2f89ebfd79ea8d1bb0b7d7a

          • C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Web.WebView2.WinForms.dll

            Filesize

            37KB

            MD5

            054a830681bfc7b0f52d9549616d44d5

            SHA1

            7a1360b3861ff0881b349a2f1756a570f76c1a31

            SHA256

            5ff2be8e85bdb89896c9c2946704abd450a22152cac5a0f1a8478f8910e15fd2

            SHA512

            cee139a27c2262d78b41a78be87d9dc190c96fa88e2b8d124697d91f92c9e379a40a06d305abee2d229dc51d803a9c76e4e03a2f0943527d88e991b85959b7af

          • C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Web.WebView2.Wpf.dll

            Filesize

            44KB

            MD5

            d2121527474575025e36ec2db32b80b9

            SHA1

            1a2767a30a3acb2e73761cc786a6de891ab03584

            SHA256

            c08917baedb108649f369898b9a941ffb4d6f303b0466fbbc6e7a847d336f25a

            SHA512

            8b95121c72659d11394430e773c48aab897583ab64d5bd91f40dcc8f3fd104df75d270e0c3ed2f8033abf3dbee4cfc86304663b812d8bf6fad0a7bd17468a64f

          • C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\PrivacyGuard.dll

            Filesize

            736KB

            MD5

            3961082f4253f9671aa2ae15340ec52a

            SHA1

            da932f9a32d4ab609cf7b97a43b964ba93ee0058

            SHA256

            2a1bb043df145387bf1570c40bfc8b43931030f05787e738f1626b1e462ff66b

            SHA512

            911f14b6aae42b18581d1fbe91c35563509d49e0d91667000a707bb467fd296dc6bd04ceca8b673cfff8312538d454660017b887456d89c33840bef4439d6477

          • C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\RudderAnalytics.dll

            Filesize

            52KB

            MD5

            afe61cef9754d9ebd4d9099735b71c43

            SHA1

            75bf86eac7ffe3fdd2dcab09548a55df99a67801

            SHA256

            dd08c78fb10452b0a42255bda71cea2c5012caf3ca8d00059234bf17f0e5eaeb

            SHA512

            78b87081b0d9cc518f9a2e821762062cf5310672133679d60ee1bb0c0cc93f995105cd3fc4284c4d6e246df3fa6175008a463bd8ad9312f7b7a75563df14649b

          • C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Extensions.DependencyInjection.Abstractions.dll

            Filesize

            34KB

            MD5

            b8c3c5b86489ebc29c9506c695697cab

            SHA1

            e10c7322ccbf89ac6dcf33051e8ef3644ba2c13a

            SHA256

            da1faa23f03b3150c9cf695d6788a0984b30f67cfc13dcde84db85ff84e11f33

            SHA512

            a58cb9d8ecd48bc1a04c31280700966bcf2a7ec553ea91725b2714d1e4634b4d736633147bc74acdb82d93335ebf4161b2d8b262d724e0b1b06f49cc92c27fd0

          • C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Web.WebView2.WinForms.dll

            Filesize

            37KB

            MD5

            71a385ad24940509d320336dbfc1b014

            SHA1

            631710d53319c28e733cf25fff76da9cfe621780

            SHA256

            9f143177db5da3e72c282c276be152da32f78debe428b38e4eaa631f7ad582a4

            SHA512

            a520f7d366f3b8482c8217e280c8396d2e406397f3d106942916a9d53ce4ec5e269669f4a39ff3b299ff97d5829ae1e719a7e94a4ef0912ff3af73a562c79a7b

          • C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Web.WebView2.Wpf.dll

            Filesize

            44KB

            MD5

            e786385e03e607a7ad6458f682d6c810

            SHA1

            8b19dd98d57a42b7305dfec5c18995605dc38a57

            SHA256

            bb3b284de50bea43470bfecefe43b7dcaee77893b5b209ccbb045434ae2a2506

            SHA512

            e31bb6dfeb296e13acd91500c46b28db8aa91f45c776a298ac63aff63b855d05cd90fdb5036baf1d4db69eb10cc5c4449f16550db19ca67b0e1df94642c05e48

          • C:\Program Files\CyberGhost 8\Applications\Updater\RudderAnalytics.dll

            Filesize

            49KB

            MD5

            6d65127d009508e5db58d01525ea51ab

            SHA1

            8891567d0fe416ccda8319052c554e9c6f568013

            SHA256

            ea247144b3048b0e88b04805a8476116796eab68d62fcb2c2ffc63dab971a11c

            SHA512

            117f33917354f37bcfbc66d16ee43b667768ffe9e3df6c600eba663cc7592ed981bd341ce4fffee4c571609af88df1001bd4ab66ee0906caa7a393da71e298e2

          • C:\Program Files\CyberGhost 8\Applications\Updater\Updater.Core.dll

            Filesize

            106KB

            MD5

            5721040c5a756d1b650160a2bd401142

            SHA1

            c0f11a84d8897510f64b87941806b7cf60dd15c3

            SHA256

            629239a5c9cf106c1ef84d73f313b3fd562f75857a0463259b3816f6c81e7405

            SHA512

            e124239e56620cb1a0810fdbe2294929e0ed31c0adfa183b6bfae63e39818d45dbb006be8b252173aee56f18142b5240030051e9451a0c8dc1912d24a2409406

          • C:\Program Files\CyberGhost 8\Applications\Updater\Updater.dll

            Filesize

            172KB

            MD5

            5a3c95ca0814d6373ddf17c06ca24693

            SHA1

            c8e610af941d78d3a2484e61e93d58e9a62b357c

            SHA256

            0ad9773793ad67e36a92b0fac2eb59502105c18d69b78a7b13947b2801a96bb1

            SHA512

            87b29991e59c23b2013a6ad3a0daf6c586e6f0c1a09f49516b6f224e4f4d5e6a2be0c1e102d80d5f3a5dcfb6e9e7a3d67e318900ac890a54a27873d16837df79

          • C:\Program Files\CyberGhost 8\Applications\VPN\CyberGhost.VPN.dll

            Filesize

            842KB

            MD5

            c7eec49bb8e4f8468c19f11e9978f2e3

            SHA1

            cd17ef28dd851c9c9648424b6cca487c55fb24f5

            SHA256

            f1b89d0d21c1874dce720f74f34d3de6ddd19c4b28e07ba4175009c8f604a85e

            SHA512

            c1191a172c8bfa374c2634f16dd3cbd5e7ab0dd1eb5ab378330cab226ac8e082e921ee4eb9c30afea54030c9f27c01434facfc806b1bdeb7e5f5314f6e62278a

          • C:\Program Files\CyberGhost 8\Applications\VPN\CyberGhost.VPNServices.dll

            Filesize

            149KB

            MD5

            ce1323a08f978266f71af9b43128bb9d

            SHA1

            a5782a7df5a82038d7a8cf9422a1bd1463d1bc8b

            SHA256

            1cd097a71614e55a17792cfa9f6b1218ce9890bc2141659fd1ada02f8869f143

            SHA512

            ba2300a4f165ad6343e3a214767e85ef9b656c25823c49a511639d2d51875f4fc7858829db66327552df9153462651b4e53b692dc9ef9a12229bf80978ab394c

          • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\CP.png

            Filesize

            136B

            MD5

            30bea326e5024b6a9b0136a000403d75

            SHA1

            0b6e65e87f670af6fbc4a28171aedf4db4daa0a5

            SHA256

            e58c331133d8f780738133e2aa966c8bcb5b17a07c860a990bc401afd6382e1a

            SHA512

            43362cef837497bc264a46dd70a67c3129d854cf7a9866bee4a33a4f62acb833ba96b4720441c6d6db56301c9b49f8c29f1465363b5c057ec6e16a213f06caac

          • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\FR.png

            Filesize

            114B

            MD5

            42c4c4ecb4448888421a7c1180b4cd08

            SHA1

            bb515751cc2f7616fe41929d2577fc965c69b51a

            SHA256

            1ef1946b6e352f2d5a4b003367b968374d6af122c5b645c6b4d9577645fb819d

            SHA512

            0e8d4b1c124b86d696e979d9b3aae007c80258672202f66fe3d2ea72e64d205f8dace52333d6749feab74abbd090173f6811490e9b09c3a06682f58b14e5fcbf

          • C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll

            Filesize

            34KB

            MD5

            1b5c304c9ea046d3c2061b71f0f4ad72

            SHA1

            069d86e8136fd827f4d61e35063c24b91a22913c

            SHA256

            a06adf890575d74637a33b3eb59dd565d00c86def54217fa64b6f370697c0c1d

            SHA512

            a571a0c44af954d1235b1b2636f67416014b6016119901808be3793fe5430f5462a5320a6bc825b894f33c69b54179ff90c2e737360d5f2cf23e54429e27c513

          • C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Web.WebView2.WinForms.dll

            Filesize

            37KB

            MD5

            aeb3c06059e193d48222a21227c903c9

            SHA1

            8ffccf8a4d0d7dcedcbc23e33ded335473262fea

            SHA256

            550b278f50eb0587ba3158210f29e5c0e15490e32b803c7dcd4398425ffb62bd

            SHA512

            18179c5e14cf8163412b39dd8035e23416f8e41612a419f25934ab45b099fa9c0ba3728a753ae9e19945b14be3fc81818f6f21efaab5359012e36182e77ffb53

          • C:\Program Files\CyberGhost 8\Applications\VPN\Microsoft.Web.WebView2.Wpf.dll

            Filesize

            44KB

            MD5

            83716706b6f37bf9680aa3a621d6976c

            SHA1

            2a1aeac7e4b58b4be013295974421316bef75339

            SHA256

            614c89775de8a02f937df83447b0390f8298cb2bb5ce401fc27497b53a34190c

            SHA512

            c7607a0f49a7ffffb68eff424dc1db906aac50668cea1e4c64d297bba2a0239ca4c6d9903b48926c33718d2eab8684e67fa759ed9dc1eee73fafb2507284aa28

          • C:\Program Files\CyberGhost 8\Applications\VPN\RudderAnalytics.dll

            Filesize

            52KB

            MD5

            796cd54f5882eb97d093be627fdd5561

            SHA1

            35e0830e3d60bbbf102a19e722dd91112f34a33b

            SHA256

            d05d188901c35ec6c0bae21b0c00d48cd2da2a42c4fbfed8e787b3580c037226

            SHA512

            1e9a711e35dc7831585b2c692480a7c9b38d8d84d0849157cbdb87476109294ddb636f6bb4f811fa152af90d51328232896d6389847a2fb788f632bf3002ece8

          • C:\Program Files\CyberGhost 8\Castle.Core.dll

            Filesize

            421KB

            MD5

            7915b53a3950ed1cf7ad2b016a6db85d

            SHA1

            11a0d7e27ef5980722b39e77803d7e78890cc15a

            SHA256

            497335b1f9caf6d573ba52da7b1fbc6a1f0f36c81f65b53776832116af0e532c

            SHA512

            4a1101f0f2bb2d6ca50a63cab199b510ec04d80ffb2c435a7984e1627f0c4d35cf50f081e03fff5c0453037f8a9d453693c30047042fe0608f1b2969f767d030

          • C:\Program Files\CyberGhost 8\Castle.Windsor.dll

            Filesize

            353KB

            MD5

            6ff272e2d995b1ff276120e212014993

            SHA1

            bdccf2981bccdfa1fbfd0c32e79051dc1df56bbb

            SHA256

            1237558218b43132c0b957266b0851da8ba0f154a80b27aeaa56f5f49c614a70

            SHA512

            f9169aab124d116f48682276085e50bd8ba78cdf6050b26f2f5e019165fb57662795b261c6626ad32a5776e446d688e8daed717a3b645b68cf566761641749df

          • C:\Program Files\CyberGhost 8\CyberGhost.Browser.dll

            Filesize

            44KB

            MD5

            5ac2460361f3c534813c7ad90aec7a07

            SHA1

            5cbdd4bfef3e70c4ec71a3e11b8d5a79567ac874

            SHA256

            1cb6c7f549e1bbeb666fa3e8a4099153ff266a8d297cf5901231161cd2693ca0

            SHA512

            4dc8f2406bab54dc1ffbff8085db6563aa20d646e406f0ef944a2b627271c2f7913ef49988b2ae26bbe080a76116cc33c2fca898359a89c43c83671334f804eb

          • C:\Program Files\CyberGhost 8\CyberGhost.Controls.dll

            Filesize

            621KB

            MD5

            057af8169c3a0a3f0616f8127cec33ff

            SHA1

            a8323a82f07df0bc71b53a492d9f7df0ca0f8a22

            SHA256

            e76f2d2fcfe19e66c5f35a475011466d72fd76f5f93fe724fd94f4185705af81

            SHA512

            15337ef4f493faff7f6069d954ce0700bc399c303dc36cef6dad89654a4772a95a23c40e1198040c56b09a46966625b49393d34f4e29f4e42638eb98faf38d6c

          • C:\Program Files\CyberGhost 8\Dashboard.Contracts.dll

            Filesize

            206KB

            MD5

            5ab448298a41e87de68d218c6b120bdb

            SHA1

            efb31e96905df2fe83b6527438bae1539767974e

            SHA256

            0a7ca39ba17b5dba367f9b17381c1b1e40ffbf22e25870519b6749fdce0061f8

            SHA512

            82c733fbee0fd80cd2f092c3674d4a0d06e1958f6ac951f343fe7c74977b8e5feaa79aaebec9adaa2172b56e3553efe889d1a37833ada380755059a6e898b5e8

          • C:\Program Files\CyberGhost 8\Dashboard.Core.dll

            Filesize

            171KB

            MD5

            361fc47e04ef7c1123564c007b7e7a71

            SHA1

            2cbd0ef5f78bd1505901df7898cb73dcabfbf54f

            SHA256

            1b226548dab788e1405842901698b88a515a64c039ea6eef5af8bd0cf41b5aaa

            SHA512

            343311dde4058b1865aafdc51a7054559a8a20deef4af83719ecf4fb9200dc8f2b0331abf5d0d5bb190fd29e02fe5da64b5eb34132aa7a52b0d7c05a3bb08637

          • C:\Program Files\CyberGhost 8\Dashboard.MPAHelper.dll

            Filesize

            134KB

            MD5

            81b429b1333206c2f26a7fd0a78f6941

            SHA1

            0a305f10aabd4f863b3f7ebaeacc3c79d4091a4a

            SHA256

            d74c7fa740c9af13fa57658531a2a3062a957b2e29f3ddb270081b1b0d0736b4

            SHA512

            692b69dde962e8ea7f1d05bfab53e0fd2355fa14380f3799eafc7c58a7c26de76fab4be07a9c1bdd1149fb3716d4525b8bbebc3055ecce7a97551dca4694b4dd

          • C:\Program Files\CyberGhost 8\Dashboard.Pipes.dll

            Filesize

            39KB

            MD5

            1e65d78e8b98c495569292fc5a78681b

            SHA1

            c58e8da7ba4cc6bf7e4bdf7907766e8840e0d464

            SHA256

            00742e432a14c0c91f15cd980ec0500289a589714e8ef14f34438a5a313ff4c3

            SHA512

            afc3e894c9c397774737df5a0b295a31f514012af0e8eabd47ad1c8529ac09fe6869aa2b3ea828e53f9931340deb15ad8cbe690b4815ab386588a26cffefac76

          • C:\Program Files\CyberGhost 8\Dashboard.Service.InstallLog

            Filesize

            269B

            MD5

            454cd1260e3376b62d937f7924db6897

            SHA1

            493bf82ac1053c06e3cff1df58a00be80aa42e49

            SHA256

            55e7968413664dc0af2228a5de2ee6717976953c4403d6d364569b3fb681c39e

            SHA512

            913a0e1dacf2e55634cab02acbbd42e8bb374c3f8900259c977ebfff3ec1da7a7789cab0243db53827443e8adb490c7ec869fc66fde42b32cf1c7245b46d5970

          • C:\Program Files\CyberGhost 8\Dashboard.Service.exe

            Filesize

            67KB

            MD5

            54cbfd95dee8263af6cd37caf86b7fc7

            SHA1

            a672bb250bfb18d40dc06f7fe05b54ac4385ffc4

            SHA256

            fe72e15d097889e8cfc3f92a072b423872e756dc58ca01b1776a4a00055f7c87

            SHA512

            1acf5568dd0bc9db9a801c75b7ce10d321e42dd501d5c79913b1633075349bf70d52eb64054d3695b0c4f8513ffad15a1edc1e9af157fc3452f92c48a04cb900

          • C:\Program Files\CyberGhost 8\Dashboard.Service.exe.config

            Filesize

            3KB

            MD5

            982d7c8a3787ef298b050aa9efca6478

            SHA1

            140cc16f0abb9e423ca084a9d043e7222b3652db

            SHA256

            cfd8b465e19a80c6100717744cad1b4f91a29e6201cc90103effe0ab42667ee2

            SHA512

            69ec8fad01d0bfd86ef5d4be561105b3f0fca1c4a9d709704d40b32f96fbf75bebbcffd9c1174fac14dc4ecb4107945ad311ac34299ed7666f9eb6586157840b

          • C:\Program Files\CyberGhost 8\Dashboard.exe

            Filesize

            1.4MB

            MD5

            f184bf053d1f3bb5322f583903bce5ae

            SHA1

            1c5cc6325b9c282b15f18350891a502332c4376b

            SHA256

            82bac58c7ad273cc2f0e929c4e1d1c653243fd29ce42805f53dd2af8f5ff7a4b

            SHA512

            af95b468e6f5e666ee13022a2ce3bd898aed0df7517053ccef0dcbe750345eb5317a7019dc5a0323f076388dfd3235180c2ce85adf955d6be859610c7637a26b

          • C:\Program Files\CyberGhost 8\Dashboard.exe.config

            Filesize

            3KB

            MD5

            f1e329e5df3fdff4f38b89a73dba103e

            SHA1

            954c609e77a97e9b72ad35bda5d3c6e08d9900ab

            SHA256

            6a67371a519355bef77448e7b769b05e2e516503edbcb6550e68e12167c8e811

            SHA512

            2e0ac30de9444fc8215b654ef1add263588f380bfcf163dc09812030ac24a94515de14dd6e5deb0b8923fe2f8e332377e799c08d8b29e422c55692fc81ae93cb

          • C:\Program Files\CyberGhost 8\Microsoft.Bcl.AsyncInterfaces.dll

            Filesize

            20KB

            MD5

            3daf80a189a662f456fe619052642c76

            SHA1

            ce247636355a4ce9af639ad9a46bee5fa74fd606

            SHA256

            5681ac06acd27b4417dc8f1c3d83eaab327e8d50fc30fbd4a1b037deb14529cd

            SHA512

            ed5e17c57b8b8c60e7469cc1f0ac760914cfffc89dcbb261def1b9a23aa54f7e907cb94e45d3f58c06efad50eb79ea3e5ceda1b86fbc6874f6b860509f2232bb

          • C:\Program Files\CyberGhost 8\MobileConcepts45.dll

            Filesize

            644KB

            MD5

            c2c8ac9615d0214bf9eb01ace7ce55c4

            SHA1

            72034c98a51584a7d2efef069636ae4919dab19d

            SHA256

            d63dde4ff7a6a8ab5cde2c08da4890e9920e8ec1c4b57ab47026e23cc044aeb7

            SHA512

            911eb5885f81c7b51015d7c96df6b60946e7904eb708a3b25c573d85d24cbf268454bb6b1edc636fefba05ff5892b1dbfe02d57b5dd3d4b70b50e139ae245c1b

          • C:\Program Files\CyberGhost 8\Newtonsoft.Json.dll

            Filesize

            691KB

            MD5

            17dab3afcc00fc4f39b715feb46ccc15

            SHA1

            397b16116513cc84d600c6556b776baab7cefc28

            SHA256

            78ddce43352957c795806a094cd598420f5dcba93ac6d5a31ae7a333c3ba40a6

            SHA512

            6b1334f9907c1261f4ec1bd402b863f4d48df2a551f46ec0cc499401dc78fbeba5b7d389b7320d525756f2653834101383bad614c171923ce6acfe542ea0f908

          • C:\Program Files\CyberGhost 8\Sentry.dll

            Filesize

            584KB

            MD5

            0e0140b1a0a2458b1a3f4eb4e7e6bd9a

            SHA1

            18065e9b47e5302ef32b62213362d1a7dc584d0a

            SHA256

            58b6d08bcba6fed4d2924059dc7082f512cbf490b01a918d699d24a0787d96cb

            SHA512

            c0690a85f0a2cfff57394009974aeac0d3ec0f4858137d6ff6931187625af989cda9eb5064f0f19170eb7963e97fe4d249e779062c272e0f9f6baf51ba0e8eb5

          • C:\Program Files\CyberGhost 8\Serilog.Formatting.Compact.dll

            Filesize

            16KB

            MD5

            1f9710068535a64c5eb2deb8090b8c67

            SHA1

            fb852449f60cbc8affc3aa9fb29c18e6ba55bf6a

            SHA256

            cd3df0998bbeec93b1a2c27082222aa0f56857f4c383b382efc008ea266164f6

            SHA512

            0777c789d65ca9b4a706bcb5d1ab608de0e4a5ba2743d02b4d38335d39f5beb68eae11353371c73296c9181cd16f2325efe9e4eb9fa7ca306c4dbc1ece5aa102

          • C:\Program Files\CyberGhost 8\Serilog.dll

            Filesize

            145KB

            MD5

            f79a81819b620836ebe9c0ac8cfb2cb9

            SHA1

            21738572d54943068536a3d8dd45b8cc910ef5db

            SHA256

            27b2b3c464e9597f2d88617ee937531f6e14c19e03653c5c7a7aceaa3192bcc4

            SHA512

            e7a0848c32741a405472ce37e95cb9a5123f852e1ee06f6c743753f75cad82692e91630554b6261db28865515341f8b942f6dbffa3e86ab18cbbf23e574bb90c

          • C:\Program Files\CyberGhost 8\System.Threading.Tasks.Extensions.dll

            Filesize

            24KB

            MD5

            a77db6bac062e81cd24ccf5f70c8a6c9

            SHA1

            c2df976d080e234104da2b9f6b63b0cf83286a3a

            SHA256

            673d3d46ea0a993fcd064cb56d28278b89fa52803883f4b6e6dcd14eed2600e6

            SHA512

            1dd9e2728f8aadf0791d45f23fb7b1b173f243bbae0cfa7b26d9c26066645605fd7889c37b1c0a83a2b3bc452d010902f11181824f44b9190f0a8c5ee488e30f

          • C:\Program Files\CyberGhost 8\WPFLocalizeExtension.dll

            Filesize

            85KB

            MD5

            7af8e228ec9713328ee88b69c4a1fe29

            SHA1

            9deee41b7e849f5bc64a838d10daa476f1c29faa

            SHA256

            70f243562d909c2d14f9af8340a3b77cb7a7e091e07a6d7f5ef12df079d41cab

            SHA512

            7c66cdf8c9d5c4b9e92d7213d7455f63c4d4bba1e2b2f0438a0e9a57aaa523132c37659d1deb04d9308cf48aad3b9b35e3de555e9261d75632ca3a268fcf6413

          • C:\Program Files\CyberGhost 8\XAMLMarkupExtensions.dll

            Filesize

            37KB

            MD5

            6c3476819b24e9ab88fe6eafb2981601

            SHA1

            5e9b98c3254c5099605b20b9241ffa97ce2d561c

            SHA256

            e4e57348ac03e2611a6bd6d80ab4148b81b7d6e617a0baba5ed0a76304ea7036

            SHA512

            321dcee8bc9df654b354c91986c9e70c63b4c5d2fedade42d50f6adbb584e979220bf39b53798e66d68d27dc0569d952c811a2ec50defab5789467ded689c057

          • C:\Program Files\CyberGhost 8\de\Dashboard.resources.dll

            Filesize

            52KB

            MD5

            06ea9f712bd99c9b8919a7da6fdcc7c3

            SHA1

            d68159296622c9b5b3c8484e4b57b8d151e82ace

            SHA256

            b34f3f8bb9cab834fcd218e75d54067e25c5d3bcd04a527104eeacea0a69c1f0

            SHA512

            75e750bceb24c5a6ac37942a35985becd04292ee662800b989c9a0b336c4265f5c7870fb10dfdc1406f5da01e48c761b434f7ee684d2cf6a709e897937b27760

          • C:\Program Files\CyberGhost 8\es\Dashboard.resources.dll

            Filesize

            52KB

            MD5

            585f53ef4d03c5a464cb2c4217ac2249

            SHA1

            c34ecdc46a766b7a89b6388743ef8e5c6766e9c5

            SHA256

            8cea64807de07d94aa2ead550723a19c7bca19d3c019dd7382432eb55b2e8076

            SHA512

            df4c955e952323c7518a555e6c7ce4bb8152b38a2f3720fe43382dd76146c172773666ccec4cafcbfb464433c17f246c2b04087366eb13c96c152c4052362cd6

          • C:\Program Files\CyberGhost 8\fr\Dashboard.resources.dll

            Filesize

            54KB

            MD5

            0dc7aa365623f8ce8249ec55d3ff3c13

            SHA1

            3012b00e22ed69c5b40f56f1df7a332175228c53

            SHA256

            669cf901ec14a5a2480263aae07034a5bb69290c693b8dcd76278b31dbc66c06

            SHA512

            92efef973a3c18b917bfc21d2255a1d918cf613a68412a38cf8486954ed78e410a9d9b6c242c19314676cf9442887fbbb4838ca1cbd4ca860e2c0e9c38d0bdbf

          • C:\Program Files\CyberGhost 8\it\Dashboard.resources.dll

            Filesize

            52KB

            MD5

            18b878604e428501e8addad6cb31fb18

            SHA1

            8a64213b0a041a56e5e559b6c9f5dddb509e9aaf

            SHA256

            a1a492a8913bdee1edc08be636ca9cd5f44c9a559cab77709aa6b6129641b061

            SHA512

            c12b43811fe779226c6b734673474724d5335824c9d9fc5dca8ea9c49681556a18e8c1d890cceae250bc4cdc814f0c303f9eeb89d3646ea1676d5ed6f74d330e

          • C:\Program Files\CyberGhost 8\ko\Dashboard.resources.dll

            Filesize

            54KB

            MD5

            f50a14ab201bb2bab3d7b2fb50149224

            SHA1

            2798d1678948647c25d698ad380c5bb10d3fc7bf

            SHA256

            ce06ded57cc7c801a2702f141a70d9d554804f03f434adfcc9f569f8a505dc5d

            SHA512

            c30e141d8c17bc7299fedb599b8f516b489955ed3180d0ad8e8d9f6a7623f042eebba7f87768131a64bd88738687fa37a9720256551d02759ce8a7bf01220003

          • C:\Program Files\CyberGhost 8\pl\Dashboard.resources.dll

            Filesize

            52KB

            MD5

            590af32e99440265a370191929a65b8b

            SHA1

            84945fa85e37d589e33805364a3395e0ea4dba53

            SHA256

            d0342f866b2f15e2fd2dfcc1a38012cb5b3c2db0c1081aa0b9f12841cd135b3c

            SHA512

            751714fdd2a43bb1f42f66de17f9e10641dcb11645a9948600cecb84d0e1e2b6e4fc18f2044984a0dc593f0a24153c79597d195ba68e7b3d354a33dfbe4e5cae

          • C:\Users\Admin\AppData\Local\IsolatedStorage\1zexnmjs.ruz\hiuyny40.stn\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\StrongName.bx0ds5js14qgmnal5bhexnafezsd5pyy\Files\LaunchDarkly_QUEtxzTz76Ad8h9-oQ6Z5qLlzl8ZwK6bWWpos3tjUh4=\flags_DBdb7hl0z3BiNB83q2ZovXt6nARukMcA0nxKaXsXpoY=

            Filesize

            18KB

            MD5

            b3bd7edb9abc3050cb636bb173bb25f8

            SHA1

            c54bf5919f1b73918345d5313311f03491e2ce79

            SHA256

            c22125bd5a755f17d6bda64f6f37a4f0da8109c8a15e23e29b0bdf14e818ac69

            SHA512

            44c780b1716ab79aafba9e0339c86f761cd4c6228e4bc7cafd4d6bb765971531e5a0c76dfd0c607fbc6cbad4970f171629759b4cf414d94d0686b694b35e0489

          • C:\Users\Admin\AppData\Local\IsolatedStorage\1zexnmjs.ruz\hiuyny40.stn\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\StrongName.bx0ds5js14qgmnal5bhexnafezsd5pyy\identity.dat

            Filesize

            529B

            MD5

            b81dfaf8c0f7f1e2f170f4c6cb8c5634

            SHA1

            c24612cfc0b9c1067c311b4a9e6f7a98feda645f

            SHA256

            1f8da753d2cdc1c999a1cf1331c7ce4156c3cccf9ac6ed14b6621e6697566fdf

            SHA512

            980f1be6a48154a65cfd92d45a5737b53b20e2da48f1d88afb0e8186cb0cd9079436d4f6ad422012e8a7bcacba5b5452558ed3fddf904cb1e5c5bbb6dae0c051

          • C:\Users\Admin\AppData\Local\IsolatedStorage\1zexnmjs.ruz\hiuyny40.stn\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\identity.dat

            Filesize

            516B

            MD5

            ddb6c9ec80f08e7b536510fe2ab4516a

            SHA1

            858da9c8457121f41c6b9a90517effa2b6603916

            SHA256

            3279e9e4aba9a713424b1e495e558182de1e096463d515fc6d35495e2a1b0f19

            SHA512

            f176a2aff227a3bdc583cbda7cc945dd996649c155fcb090a8d18bcb30979a95d66e282e5303776cea47472e0c664ff462ef8fa8883412cbf9bd6d4a4e6eb108

          • C:\Users\Admin\AppData\Local\IsolatedStorage\1zexnmjs.ruz\hiuyny40.stn\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\info.dat

            Filesize

            64B

            MD5

            737a981e818861f62642c7cf461348ab

            SHA1

            64bbe79684ebae71d36197596f840187a51b035e

            SHA256

            12c8756e2239a10e480ca4fba15abdf37d1f66a05cf935a46207e223f09511b2

            SHA512

            aed9a8772fc565c13bae15a7f8f50453ccef63daff41e2e760f8d121e97d9c77306ffa296b32891ff2f7f477c0569e287e17bf3ac1b203ccf1a6aec8a06065c7

          • C:\Users\Admin\AppData\Local\Temp\TmpA865.tmp

            Filesize

            2KB

            MD5

            647f843626b023aaaa748f924f95ac25

            SHA1

            652cacf99409e3dcd39b6eb8839c16d22b1800e8

            SHA256

            732dee732e0261afbfba21eca43008a5009cfc9e4c405ece8826a9746564cceb

            SHA512

            61093dcbe07efa5bdffec4933243168bf40b8159bc5a9840552bc3ea8e7c129156276a8548c658e5267bf0b8c4448dcb5c8ab10140c72ed48eb8910c075022fa

          • C:\Users\Admin\AppData\Local\Temp\nsv86B0.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • C:\Users\Admin\AppData\Local\Temp\nsv86B0.tmp\UserInfo.dll

            Filesize

            4KB

            MD5

            7579ade7ae1747a31960a228ce02e666

            SHA1

            8ec8571a296737e819dcf86353a43fcf8ec63351

            SHA256

            564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

            SHA512

            a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

          • C:\Users\Admin\AppData\Local\Temp\nsv86B0.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\tmp9896.tmp.exe

            Filesize

            5.0MB

            MD5

            72540194bd451dac050609406eb50a56

            SHA1

            57c33ec10f90f81f6abc612b4d251510c36ebd6b

            SHA256

            3a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74

            SHA512

            ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444

          • C:\Windows\System32\DriverStore\Temp\{04fbc966-eefc-0f4d-bb09-c5b9feaf98e6}\SET8884.tmp

            Filesize

            7KB

            MD5

            87868193626dc756d10885f46d76f42e

            SHA1

            94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

            SHA256

            b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

            SHA512

            79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

          • C:\Windows\System32\DriverStore\Temp\{04fbc966-eefc-0f4d-bb09-c5b9feaf98e6}\SET8885.tmp

            Filesize

            19KB

            MD5

            c757503bc0c5a6679e07fe15b93324d6

            SHA1

            6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

            SHA256

            91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

            SHA512

            efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

          • C:\Windows\System32\DriverStore\Temp\{04fbc966-eefc-0f4d-bb09-c5b9feaf98e6}\SET8886.tmp

            Filesize

            26KB

            MD5

            d765f43cbea72d14c04af3d2b9c8e54b

            SHA1

            daebe266073616e5fc931c319470fcf42a06867a

            SHA256

            89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

            SHA512

            ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

          • memory/8-1471-0x00000204FB110000-0x00000204FB1E8000-memory.dmp

            Filesize

            864KB

          • memory/8-1473-0x00000204FA710000-0x00000204FA73A000-memory.dmp

            Filesize

            168KB

          • memory/8-1469-0x00000204FA220000-0x00000204FA240000-memory.dmp

            Filesize

            128KB

          • memory/8-1467-0x00000204FA3B0000-0x00000204FA3E0000-memory.dmp

            Filesize

            192KB

          • memory/8-1460-0x00000204FA7D0000-0x00000204FA88C000-memory.dmp

            Filesize

            752KB

          • memory/8-1451-0x00000204FA1E0000-0x00000204FA214000-memory.dmp

            Filesize

            208KB

          • memory/8-1449-0x00000204FA240000-0x00000204FA29A000-memory.dmp

            Filesize

            360KB

          • memory/8-1447-0x00000204F91F0000-0x00000204F91FE000-memory.dmp

            Filesize

            56KB

          • memory/8-1435-0x00000204F9F40000-0x00000204F9FD6000-memory.dmp

            Filesize

            600KB

          • memory/8-1439-0x00000204F9070000-0x00000204F907A000-memory.dmp

            Filesize

            40KB

          • memory/8-1437-0x00000204F9050000-0x00000204F905A000-memory.dmp

            Filesize

            40KB

          • memory/2032-1505-0x000001AF34D60000-0x000001AF34D72000-memory.dmp

            Filesize

            72KB

          • memory/2032-1507-0x000001AF34F30000-0x000001AF34F42000-memory.dmp

            Filesize

            72KB

          • memory/2032-1377-0x000001AF33F90000-0x000001AF34030000-memory.dmp

            Filesize

            640KB

          • memory/2032-1375-0x000001AF18CC0000-0x000001AF18E1E000-memory.dmp

            Filesize

            1.4MB

          • memory/2032-1379-0x000001AF33E80000-0x000001AF33EB8000-memory.dmp

            Filesize

            224KB

          • memory/2032-1391-0x000001AF33EE0000-0x000001AF33EF0000-memory.dmp

            Filesize

            64KB

          • memory/2032-1389-0x000001AF34200000-0x000001AF34226000-memory.dmp

            Filesize

            152KB

          • memory/2032-1387-0x000001AF33EF0000-0x000001AF33F20000-memory.dmp

            Filesize

            192KB

          • memory/2032-1399-0x000001AF342E0000-0x000001AF342FA000-memory.dmp

            Filesize

            104KB

          • memory/2032-1481-0x000001AF349F0000-0x000001AF34A00000-memory.dmp

            Filesize

            64KB

          • memory/2032-1483-0x000001AF34A00000-0x000001AF34A10000-memory.dmp

            Filesize

            64KB

          • memory/2032-1485-0x000001AF34B70000-0x000001AF34B80000-memory.dmp

            Filesize

            64KB

          • memory/2032-1401-0x000001AF341F0000-0x000001AF341FE000-memory.dmp

            Filesize

            56KB

          • memory/2032-1487-0x000001AF34B60000-0x000001AF34B6E000-memory.dmp

            Filesize

            56KB

          • memory/2032-1503-0x000001AF34D40000-0x000001AF34D52000-memory.dmp

            Filesize

            72KB

          • memory/2032-1385-0x000001AF34240000-0x000001AF342AE000-memory.dmp

            Filesize

            440KB

          • memory/2032-1397-0x000001AF343A0000-0x000001AF34452000-memory.dmp

            Filesize

            712KB

          • memory/2032-1383-0x000001AF33F20000-0x000001AF33F7C000-memory.dmp

            Filesize

            368KB

          • memory/2032-1509-0x000001AF34F50000-0x000001AF34F62000-memory.dmp

            Filesize

            72KB

          • memory/2032-1511-0x000001AF34F70000-0x000001AF34F82000-memory.dmp

            Filesize

            72KB

          • memory/2032-1381-0x000001AF34120000-0x000001AF341C6000-memory.dmp

            Filesize

            664KB

          • memory/2032-1513-0x000001AF34F90000-0x000001AF34FA2000-memory.dmp

            Filesize

            72KB

          • memory/2032-1514-0x000001AF34FB0000-0x000001AF34FC2000-memory.dmp

            Filesize

            72KB

          • memory/2032-1515-0x000001AF34FD0000-0x000001AF34FE2000-memory.dmp

            Filesize

            72KB

          • memory/2032-1493-0x000001AF34BA0000-0x000001AF34BB0000-memory.dmp

            Filesize

            64KB

          • memory/2032-1495-0x000001AF34CF0000-0x000001AF34D00000-memory.dmp

            Filesize

            64KB

          • memory/2032-1497-0x000001AF34D20000-0x000001AF34D32000-memory.dmp

            Filesize

            72KB

          • memory/2032-1491-0x000001AF34B90000-0x000001AF34BA0000-memory.dmp

            Filesize

            64KB

          • memory/2032-1489-0x000001AF34B80000-0x000001AF34B90000-memory.dmp

            Filesize

            64KB

          • memory/2032-1393-0x000001AF342B0000-0x000001AF342D8000-memory.dmp

            Filesize

            160KB

          • memory/2032-1395-0x000001AF33ED0000-0x000001AF33ED8000-memory.dmp

            Filesize

            32KB

          • memory/3408-1405-0x0000019E18280000-0x0000019E18294000-memory.dmp

            Filesize

            80KB

          • memory/3408-1419-0x0000019E328E0000-0x0000019E3291C000-memory.dmp

            Filesize

            240KB

          • memory/3408-1418-0x0000019E18790000-0x0000019E187A2000-memory.dmp

            Filesize

            72KB

          • memory/3436-73-0x00000217C5D90000-0x00000217C5D98000-memory.dmp

            Filesize

            32KB

          • memory/3436-106-0x00000217CA2D0000-0x00000217CA2D8000-memory.dmp

            Filesize

            32KB

          • memory/3436-98-0x00000217C8F70000-0x00000217C9022000-memory.dmp

            Filesize

            712KB

          • memory/3436-59-0x00000217C49F0000-0x00000217C4A90000-memory.dmp

            Filesize

            640KB

          • memory/3436-58-0x00000217C4930000-0x00000217C493A000-memory.dmp

            Filesize

            40KB

          • memory/3436-57-0x00000217AC050000-0x00000217AC05A000-memory.dmp

            Filesize

            40KB

          • memory/3436-56-0x00000217C4960000-0x00000217C49F4000-memory.dmp

            Filesize

            592KB

          • memory/3436-53-0x00000217C4790000-0x00000217C4826000-memory.dmp

            Filesize

            600KB

          • memory/3436-64-0x00000217C4DE0000-0x00000217C4E0A000-memory.dmp

            Filesize

            168KB

          • memory/3436-65-0x00000217C4B30000-0x00000217C4B38000-memory.dmp

            Filesize

            32KB

          • memory/3436-55-0x00000217AC060000-0x00000217AC068000-memory.dmp

            Filesize

            32KB

          • memory/3436-54-0x00000217ABEF0000-0x00000217ABEF8000-memory.dmp

            Filesize

            32KB

          • memory/3436-66-0x00000217C4EF0000-0x00000217C4EF8000-memory.dmp

            Filesize

            32KB

          • memory/3436-52-0x00000217A9DA0000-0x00000217AA2B0000-memory.dmp

            Filesize

            5.1MB

          • memory/3436-67-0x00000217C5450000-0x00000217C5458000-memory.dmp

            Filesize

            32KB

          • memory/3436-51-0x00007FFCF0A10000-0x00007FFCF14D2000-memory.dmp

            Filesize

            10.8MB

          • memory/3436-1352-0x00000217CA330000-0x00000217CA380000-memory.dmp

            Filesize

            320KB

          • memory/3436-99-0x00000217C9020000-0x00000217C9032000-memory.dmp

            Filesize

            72KB

          • memory/3436-81-0x00000217C8710000-0x00000217C8748000-memory.dmp

            Filesize

            224KB

          • memory/3436-69-0x00000217C5AF0000-0x00000217C5AF8000-memory.dmp

            Filesize

            32KB

          • memory/3436-107-0x00000217C9530000-0x00000217C953A000-memory.dmp

            Filesize

            40KB

          • memory/3436-1353-0x00000217CA4A0000-0x00000217CA516000-memory.dmp

            Filesize

            472KB

          • memory/3436-68-0x00000217C5A50000-0x00000217C5A58000-memory.dmp

            Filesize

            32KB

          • memory/3436-60-0x00000217C4AE0000-0x00000217C4AFA000-memory.dmp

            Filesize

            104KB

          • memory/3436-97-0x00000217C8F30000-0x00000217C8F6A000-memory.dmp

            Filesize

            232KB

          • memory/3436-96-0x00000217C86B0000-0x00000217C86BA000-memory.dmp

            Filesize

            40KB

          • memory/3436-62-0x00007FFCF0A10000-0x00007FFCF14D2000-memory.dmp

            Filesize

            10.8MB

          • memory/3436-100-0x00007FFCF0A10000-0x00007FFCF14D2000-memory.dmp

            Filesize

            10.8MB

          • memory/3436-70-0x00000217C5B50000-0x00000217C5B58000-memory.dmp

            Filesize

            32KB

          • memory/3436-74-0x00000217C5E70000-0x00000217C5E78000-memory.dmp

            Filesize

            32KB

          • memory/3436-82-0x00000217C8E90000-0x00000217C8ECA000-memory.dmp

            Filesize

            232KB

          • memory/3436-101-0x00007FFCF0A10000-0x00007FFCF14D2000-memory.dmp

            Filesize

            10.8MB

          • memory/3436-75-0x00000217C5EF0000-0x00000217C5EF8000-memory.dmp

            Filesize

            32KB

          • memory/3436-95-0x00000217C8F00000-0x00000217C8F22000-memory.dmp

            Filesize

            136KB

          • memory/3436-104-0x00000217C94A0000-0x00000217C9532000-memory.dmp

            Filesize

            584KB

          • memory/3436-71-0x00000217C5B90000-0x00000217C5B98000-memory.dmp

            Filesize

            32KB

          • memory/3436-76-0x00000217C6050000-0x00000217C6066000-memory.dmp

            Filesize

            88KB

          • memory/3436-77-0x00000217C8630000-0x00000217C8638000-memory.dmp

            Filesize

            32KB

          • memory/3436-78-0x00000217C8640000-0x00000217C8648000-memory.dmp

            Filesize

            32KB

          • memory/3436-63-0x00000217C4B20000-0x00000217C4B2E000-memory.dmp

            Filesize

            56KB

          • memory/3436-80-0x00000217C86A0000-0x00000217C86AE000-memory.dmp

            Filesize

            56KB

          • memory/3436-79-0x00000217C86D0000-0x00000217C8708000-memory.dmp

            Filesize

            224KB

          • memory/3436-105-0x00000217CA2A0000-0x00000217CA2C6000-memory.dmp

            Filesize

            152KB

          • memory/3436-61-0x00000217C4C50000-0x00000217C4C96000-memory.dmp

            Filesize

            280KB

          • memory/3436-72-0x00000217C5D30000-0x00000217C5D38000-memory.dmp

            Filesize

            32KB

          • memory/4864-0-0x00007FFCF0A13000-0x00007FFCF0A15000-memory.dmp

            Filesize

            8KB

          • memory/4864-1-0x0000000000330000-0x0000000000350000-memory.dmp

            Filesize

            128KB

          • memory/4864-2-0x00007FFCF0A10000-0x00007FFCF14D2000-memory.dmp

            Filesize

            10.8MB

          • memory/4864-3-0x000000001BF70000-0x000000001C132000-memory.dmp

            Filesize

            1.8MB

          • memory/4864-4-0x000000001C670000-0x000000001CB98000-memory.dmp

            Filesize

            5.2MB

          • memory/4864-50-0x00007FFCF0A10000-0x00007FFCF14D2000-memory.dmp

            Filesize

            10.8MB