Overview

overview

8

Static

static

3

CyberGhost...up.exe

windows10-2004-x64

8

CyberGhost...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    869s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/09/2026, 16:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CyberGhostVPNSetup.exe
  • Size 127KB
  • Sample260908-vddr4agg73
  • SHA256 f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 42 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Program Files\74caa6a9-45df-4597-8774-2406317bee96\9d17b6b4-876b-4f75-bd5a-cefc22cf9c6d.exe
      "C:\Program Files\74caa6a9-45df-4597-8774-2406317bee96\9d17b6b4-876b-4f75-bd5a-cefc22cf9c6d.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Program Files\CyberGhost 8\Dashboard.exe
        "C:\Program Files\CyberGhost 8\Dashboard.exe" /install
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Program Files\CyberGhost 8\Dashboard.Service.exe
          "C:\Program Files\CyberGhost 8\Dashboard.Service.exe" --install
          4⤵
          • Executes dropped EXE
          PID:1036
        • C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\Win10\amd64\devcon.exe
          "C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\Win10\amd64\devcon.exe" install "C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\Win10\amd64\OemVista.inf" tap0901
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:1484
  • C:\Program Files\CyberGhost 8\Dashboard.Service.exe
    "C:\Program Files\CyberGhost 8\Dashboard.Service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Program Files\CyberGhost 8\wyUpdate.exe
      "C:\Program Files\CyberGhost 8\wyUpdate.exe" /justcheck /quickcheck /noerr -server="https://download.cyberghostvpn.com/windows/updates/8/nt/wyserver.wys"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • C:\Windows\system32\netsh.exe
      "netsh" interface ip set address "Local Area Connection" static 169.254.123.187 255.255.0.0
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:5008
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Local Area Connection" /d *
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3204
    • C:\Windows\system32\netsh.exe
      "netsh" interface set interface "Local Area Connection" DISABLED
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:5228
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Local Area Connection" /e ms_tcpip
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:5508
    • C:\Windows\system32\netsh.exe
      "netsh" interface set interface "Local Area Connection" ENABLED
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:5624
    • C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
      "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Local Area Connection" /e ms_tcpip6
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:5704
    • C:\Windows\system32\netsh.exe
      "netsh" interface ipv6 set teredo disable
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:5796
    • C:\Windows\system32\netsh.exe
      "netsh" interface ip set address "Local Area Connection" static 169.254.123.105 255.255.0.0
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:5808
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
    1⤵
      PID:664
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2216
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bcbe94db-af10-8f44-b93c-4fa25548a6da}\oemvista.inf" "9" "4d14a44ff" "0000000000000134" "WinSta0\Default" "0000000000000158" "208" "c:\program files\cyberghost 8\applications\vpn\data\openvpn\x64\win10\amd64"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4272
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:tap0901," "4d14a44ff" "0000000000000134"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1436
    • C:\Program Files\CyberGhost 8\Dashboard.exe
      "C:\Program Files\CyberGhost 8\Dashboard.exe" /firststart
      1⤵
      • Manipulates Digital Signatures
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5324
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5448
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1700
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:5540
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          2⤵
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5516
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {b68bfaf4-74b5-4a60-b6f1-763ae4ad12aa} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            3⤵
              PID:5812
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {b41e4bca-cb40-47d6-8c53-71786e31d590} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              3⤵
                PID:5952
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 27276 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {39f12230-2f27-4414-8fb6-ae7d57e80d9d} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                3⤵
                • Checks processor information in registry
                PID:3284
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27276 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {35e88909-77b9-4780-9896-19ba4886e193} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                3⤵
                  PID:5200
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4360 -prefsLen 34775 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {834148d1-2a9f-42c8-bc38-c85edb10c1e3} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  3⤵
                  • Checks processor information in registry
                  PID:1104
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4860 -prefsLen 35012 -prefMapHandle 4500 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {368b8014-6043-4fd8-b962-307d816a4ea0} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  3⤵
                  • Checks processor information in registry
                  PID:6836
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5000 -prefsLen 32952 -prefMapHandle 5004 -prefMapSize 270279 -jsInitHandle 5008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5016 -initialChannelId {ce95b839-97ef-4296-a625-b3a51c3badda} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  3⤵
                  • Checks processor information in registry
                  PID:6852
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5260 -prefsLen 32952 -prefMapHandle 5264 -prefMapSize 270279 -jsInitHandle 5268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5276 -initialChannelId {908a3d51-fc1f-492e-8188-3ded1457870e} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  3⤵
                  • Checks processor information in registry
                  PID:6864
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {7bd72035-fc4e-4d8e-848b-436a3eee9e76} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  3⤵
                  • Checks processor information in registry
                  PID:6888
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4304 -prefsLen 33132 -prefMapHandle 6380 -prefMapSize 270279 -jsInitHandle 6432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2700 -initialChannelId {4aabe0eb-bacb-4ef0-8e61-4ca227af7fd5} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  3⤵
                  • Checks processor information in registry
                  PID:6560
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6172 -prefsLen 33132 -prefMapHandle 6104 -prefMapSize 270279 -jsInitHandle 6428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6520 -initialChannelId {404e2059-6d5d-421f-a6c9-5c1e217e887b} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                  3⤵
                  • Checks processor information in registry
                  PID:5944
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6760 -prefsLen 33132 -prefMapHandle 6764 -prefMapSize 270279 -jsInitHandle 6768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6776 -initialChannelId {65b40bfa-084c-4573-b79a-d163a01d0f3d} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                  3⤵
                  • Checks processor information in registry
                  PID:6740
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 33132 -prefMapHandle 6752 -prefMapSize 270279 -jsInitHandle 6756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {4d99f921-e28b-4ef8-81ce-91623d6ad219} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
                  3⤵
                  • Checks processor information in registry
                  PID:6364
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7144 -prefsLen 33132 -prefMapHandle 7140 -prefMapSize 270279 -jsInitHandle 7196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7204 -initialChannelId {ef789354-3a36-4cfd-be05-3e8e75cf6c9c} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
                  3⤵
                  • Checks processor information in registry
                  PID:6424
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7500 -prefsLen 33704 -prefMapHandle 7504 -prefMapSize 270279 -jsInitHandle 7508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7452 -initialChannelId {e306f208-4508-4afc-92ea-12a592ebfec6} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
                  3⤵
                  • Checks processor information in registry
                  PID:7008
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6352 -prefsLen 37302 -prefMapHandle 6296 -prefMapSize 270279 -jsInitHandle 6312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6348 -initialChannelId {b2e0dccf-c9f5-45bc-adb6-b8a058cce629} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
                  3⤵
                  • Checks processor information in registry
                  PID:7472
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6364 -prefsLen 37302 -prefMapHandle 6184 -prefMapSize 270279 -jsInitHandle 6332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6180 -initialChannelId {b2c97584-f371-47b8-9cd8-8caaf2baf6b9} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
                  3⤵
                  • Checks processor information in registry
                  PID:7464
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8656 -prefsLen 37302 -prefMapHandle 9232 -prefMapSize 270279 -jsInitHandle 13232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1656 -initialChannelId {45845cce-141e-46f1-b233-6cf80325025b} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
                  3⤵
                  • Checks processor information in registry
                  PID:1388
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7408 -prefsLen 37302 -prefMapHandle 7520 -prefMapSize 270279 -jsInitHandle 7148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7596 -initialChannelId {a13df507-0e92-4eab-95d5-d80433e6fbfa} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
                  3⤵
                  • Checks processor information in registry
                  PID:7340
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9816 -prefsLen 37302 -prefMapHandle 17416 -prefMapSize 270279 -jsInitHandle 17336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10784 -initialChannelId {ea1c314c-14ea-44e1-b89e-9606ab74b577} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
                  3⤵
                  • Checks processor information in registry
                  PID:4920
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7340 -prefsLen 37302 -prefMapHandle 7180 -prefMapSize 270279 -jsInitHandle 7172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17416 -initialChannelId {ccde4dcd-452f-402c-b843-49829c4311c7} -parentPid 5516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
                  3⤵
                  • Checks processor information in registry
                  PID:4388
            • C:\Program Files\CyberGhost 8\Dashboard.exe
              "C:\Program Files\CyberGhost 8\Dashboard.exe" /autostart /min
              1⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:6428
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault6363fd15hb16fh4cd9ha745h0c32efa9f26f
              1⤵
                PID:816
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault6363fd15hb16fh4cd9ha745h0c32efa9f26f --edge-skip-compat-layer-relaunch
                  2⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  PID:5528
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2f4,0x7ffbc68ec188,0x7ffbc68ec194,0x7ffbc68ec1a0
                    3⤵
                      PID:5036
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6345965535523887464,17733949360419425553,524288 --field-trial-handle=2024,i,8600518161917290620,6216277512001697421,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
                      3⤵
                      • System Time Discovery
                      PID:7080
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,5907030072480639620,11384475202520263126,262144 --field-trial-handle=2024,i,8600518161917290620,6216277512001697421,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
                      3⤵
                        PID:7052
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,3811552754317489800,86142762753676541,524288 --field-trial-handle=2024,i,8600518161917290620,6216277512001697421,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
                        3⤵
                          PID:7040
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3188,i,7776120632859243429,11391994092876071847,2097152 --field-trial-handle=2024,i,8600518161917290620,6216277512001697421,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:2
                          3⤵
                            PID:7196
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                        1⤵
                          PID:4220
                        • C:\Windows\system32\SystemSettingsAdminFlows.exe
                          "C:\Windows\system32\SystemSettingsAdminFlows.exe" SetDateTime
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:8124
                        • C:\Program Files\CyberGhost 8\Dashboard.exe
                          "C:\Program Files\CyberGhost 8\Dashboard.exe"
                          1⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:7384

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Modify Registry

                              3
                              T1112

                              Subvert Trust Controls

                              2
                              T1553

                              Install Root Certificate

                              1
                              T1553.004

                              SIP and Trust Provider Hijacking

                              1
                              T1553.003

                              Credential Access

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Peripheral Device Discovery

                              1
                              T1120

                              Query Registry

                              6
                              T1012

                              System Information Discovery

                              5
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Time Discovery

                              1
                              T1124

                              Lateral Movement

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              9d17b6b4-876b-4f75-bd5a-cefc22cf9c6d.exe
                              • Path C:\Program Files\74caa6a9-45df-4597-8774-2406317bee96\9d17b6b4-876b-4f75-bd5a-cefc22cf9c6d.exe
                              • Size 5.0MB
                              • SHA256 3a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.Core.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\AntiVirus.Core.dll
                              • Size 197KB
                              • SHA256 56c19aa09614cb9293b061074cdad406177dbc42fe3496cb74ce0c14068123a8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\AntiVirus.dll
                              • Size 343KB
                              • SHA256 cdeff8f58fb9ba1fd6c89bd35d46af06b634a38a0e5b2b3e0a31dc7e7a5834bc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Extensions.DependencyInjection.Abstractions.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Extensions.DependencyInjection.Abstractions.dll
                              • Size 35KB
                              • SHA256 ef3540398ad34c08ba4295708a49418891f0b102b075350c8fb18d34c51d52ae
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Web.WebView2.WinForms.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Web.WebView2.WinForms.dll
                              • Size 37KB
                              • SHA256 45cab2ad41dda066345034a0209be9cf1b770481c6a5c0503832232cc6d44341
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Web.WebView2.Wpf.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.Web.WebView2.Wpf.dll
                              • Size 79KB
                              • SHA256 f045a9ca0684b671b951288348483093129aece9bd31cf01b108601ad0550acb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              RudderAnalytics.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\RudderAnalytics.dll
                              • Size 53KB
                              • SHA256 9b20e702851d73c6a80917ccf148cc82243a3ec58ad81492522404cea8a4a5db
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.Threading.Channels.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\System.Threading.Channels.dll
                              • Size 71KB
                              • SHA256 e7a194f3a37e07c4f3a15af3cd174137afcacf219925addd2b863a88c41c1291
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ZstdSharp.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\ZstdSharp.dll
                              • Size 423KB
                              • SHA256 a81715cdb3acddce7a010e173b9307d44884824bf2223d9a4db25f09ad9dec82
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\de\AntiVirus.resources.dll
                              • Size 44KB
                              • SHA256 995faabc14e8bf5342e3ad7407656ed192f2618476b226e85000a743324c3362
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\es\AntiVirus.resources.dll
                              • Size 44KB
                              • SHA256 e12ba876fcca2c8df51cf618723fcbb87321193854ce02a8048b154aa8ffe0a3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\fr\AntiVirus.resources.dll
                              • Size 44KB
                              • SHA256 da26cfaedd4019536981e122474d6c539ad9bebac4d7f4cddcba7b62f9d24e5a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\it\AntiVirus.resources.dll
                              • Size 43KB
                              • SHA256 405026a45f1fbd70f70fa7b89d9cfc4a0eb8834b8a7e23d6d5434e9a6eaf268c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\ko\AntiVirus.resources.dll
                              • Size 44KB
                              • SHA256 48001cc64dd84e0c32cca74ca5ea193520720b2de0a3d8e224f45e2c62adb0ad
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\pl\AntiVirus.resources.dll
                              • Size 44KB
                              • SHA256 9fba01fd91782ba722580b3e9a71238d74978b5cabfc5e6209136e20774406c2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\pt\AntiVirus.resources.dll
                              • Size 44KB
                              • SHA256 2c36e75034c6c9165ae2c9ab12c33b432f7d78fa8844578a036a831430b70624
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\ro\AntiVirus.resources.dll
                              • Size 44KB
                              • SHA256 6edc46654ea17df7beb61e1a47540714c1b0043eb0b2316f1af71fb38e2bb282
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AntiVirus.resources.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\AntiVirus\ru\AntiVirus.resources.dll
                              • Size 52KB
                              • SHA256 b263013c4c9ae0b84e0d623ccc8ffd6f0f8b587579b8b7a08fc0852eb3e0a080
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CyberGhost.Browser.dll.config
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\CyberGhost.Browser.dll.config
                              • Size 780B
                              • SHA256 6fb1c5765b496209f3811ce6cce41682110e6a59fbbacc367cb34350ab7b789a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Microsoft.Extensions.DependencyInjection.Abstractions.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Extensions.DependencyInjection.Abstractions.dll
                              • Size 35KB
                              • SHA256 ac8433b4582941e8c99aedcebe6b9b29f71de6cfc1160e650c0564dcac867873
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Web.WebView2.WinForms.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Web.WebView2.WinForms.dll
                              • Size 37KB
                              • SHA256 392ac3be791b27f88cf1dc3b0c9688387003db46300cc5642ecc332b9ada91d3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Web.WebView2.Wpf.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Microsoft.Web.WebView2.Wpf.dll
                              • Size 79KB
                              • SHA256 9d5d92398a6ef34912d44f89421974d328c9cf58748e7a5368bc2c3b92377ba8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              PrivacyGuard.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\PrivacyGuard.dll
                              • Size 739KB
                              • SHA256 ce241136ea0161616ff0868bdcb2f8b16d4178ea1fab2eea124a6a847b06223e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              RudderAnalytics.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\RudderAnalytics.dll
                              • Size 53KB
                              • SHA256 76484b42c6ace019d161b86ccdb3023c4ee35a614f8ccfb32cbbb13e13f757bd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.Threading.Channels.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\System.Threading.Channels.dll
                              • Size 71KB
                              • SHA256 8bc6a183d39b7424028a40275ee61a7676b20b5f1b173a282ea08db0d07e0970
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ZstdSharp.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\ZstdSharp.dll
                              • Size 423KB
                              • SHA256 b79ef29e1e53134edbd2950a82e65bbc259cf34337888ec32dff08db747882bc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Extensions.DependencyInjection.Abstractions.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Extensions.DependencyInjection.Abstractions.dll
                              • Size 35KB
                              • SHA256 ce5daf57ea20f0f491b4d98bdebb3f22945e208f6fb30bfb495ba84d633b9fb7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Web.WebView2.WinForms.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Web.WebView2.WinForms.dll
                              • Size 37KB
                              • SHA256 13c6a697b9328aa6913e848c3aaf0828f6dcb443fa9b1ff7d9406e3a376d5258
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Microsoft.Web.WebView2.Wpf.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\Microsoft.Web.WebView2.Wpf.dll
                              • Size 79KB
                              • SHA256 332ed9fb08fb1485320e43b9eb2524933cd88f45262a468bd172a3cb51866023
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              RudderAnalytics.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\RudderAnalytics.dll
                              • Size 51KB
                              • SHA256 a7179834ba258996570526a1fc81bdc5d5c09725cc85589859d3bb030a42aead
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.Threading.Channels.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\System.Threading.Channels.dll
                              • Size 71KB
                              • SHA256 0117b5577b97ffc51988d6c4e99b846a6da61f429af1b08d8b115952659dbbf4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Updater.Core.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\Updater.Core.dll
                              • Size 110KB
                              • SHA256 f9af032028d4d1838ecbaf4e63910e9905c23603bc9580fc4d7c40690a43cc7b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Updater.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\Updater.dll
                              • Size 175KB
                              • SHA256 ff43af44d5dcf4ba91442fe98415c488646324719bd707cf4163a701a4e60696
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ZstdSharp.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\Updater\ZstdSharp.dll
                              • Size 423KB
                              • SHA256 1ff56404b36b59ca2e2abce3d92d5aff828d2fcb33b31cf2c5316caab3901d0e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CyberGhost.VPN.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\VPN\CyberGhost.VPN.dll
                              • Size 853KB
                              • SHA256 d18d4bda682632642ecb43d1b96dfaf2d7f9ef0364a29d847685a0e20bb250f6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CyberGhost.VPNServices.dll
                              • Path C:\Program Files\CyberGhost 8\Applications\VPN\CyberGhost.VPNServices.dll
                              • Size 152KB
                              • SHA256 788a61a3a634c00a5c3c423904ac8b928afa06e6af238f398bbccb04a383f1c3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CP.png
                              • Path C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\CP.png
                              • Size 136B
                              • SHA256 e58c331133d8f780738133e2aa966c8bcb5b17a07c860a990bc401afd6382e1a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              FR.png
                              • Path C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\FR.png
                              • Size 114B
                              • SHA256 1ef1946b6e352f2d5a4b003367b968374d6af122c5b645c6b4d9577645fb819d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Castle.Core.dll
                              • Path C:\Program Files\CyberGhost 8\Castle.Core.dll
                              • Size 427KB
                              • SHA256 d6822f2af3b94bb444d544ac899ca04d4e7dc4ac28391846cca2de7cc514ad24
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Castle.Windsor.dll
                              • Path C:\Program Files\CyberGhost 8\Castle.Windsor.dll
                              • Size 355KB
                              • SHA256 93d91909be8b93ece3f38b45cd67323dc8ff4ae1b7f25fdbdbf68d1a6fe9bacf
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CyberGhost.Browser.dll
                              • Path C:\Program Files\CyberGhost 8\CyberGhost.Browser.dll
                              • Size 45KB
                              • SHA256 d113fd7ff315ef9cc60b700cfdca40f969821567573cb5cc1ab3fff3ef7eebcc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CyberGhost.Controls.dll
                              • Path C:\Program Files\CyberGhost 8\CyberGhost.Controls.dll
                              • Size 624KB
                              • SHA256 624a4ea0288999e54cd4a299f5efe32fe7b7da02ccf9294dbdddfb198945c488
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.Contracts.dll
                              • Path C:\Program Files\CyberGhost 8\Dashboard.Contracts.dll
                              • Size 207KB
                              • SHA256 e30e6e5301329ea960daea18f55a715ea07992d5ecc709ae13aad0cc790ca418
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.Core.dll
                              • Path C:\Program Files\CyberGhost 8\Dashboard.Core.dll
                              • Size 173KB
                              • SHA256 d51e5553803f08371def9558fa4283a525fcb49e5d9639290836eef17c2830e0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.MPAHelper.dll
                              • Path C:\Program Files\CyberGhost 8\Dashboard.MPAHelper.dll
                              • Size 136KB
                              • SHA256 f50fca7e57ce9848957b62e2dffb29a2171b040ca3025f30127acc4623898138
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.Pipes.dll
                              • Path C:\Program Files\CyberGhost 8\Dashboard.Pipes.dll
                              • Size 41KB
                              • SHA256 e8881f7283d1eca7c133ef3a0464d4f6acb0d69f8f1e2020cd582ab2f7b232ea
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.Service.exe
                              • Path C:\Program Files\CyberGhost 8\Dashboard.Service.exe
                              • Size 69KB
                              • SHA256 6a27a6b4e9151347fc479156c29ea6b364b9fd8cf0ece7c3182e588060e1728c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.Service.exe.config
                              • Path C:\Program Files\CyberGhost 8\Dashboard.Service.exe.config
                              • Size 3KB
                              • SHA256 7ce46632a76f2450b4787d093ef28ef0fda918612fda66130b7c9e8100c2e71f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Dashboard.exe
                              • Path C:\Program Files\CyberGhost 8\Dashboard.exe
                              • Size 1.4MB
                              • SHA256 1389628ed5df5d68751c7cb3f0cd1b5ef6858c4039d925ea6fa51ada6adc2988
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.exe.config
                              • Path C:\Program Files\CyberGhost 8\Dashboard.exe.config
                              • Size 3KB
                              • SHA256 ff4b924bdae70ecdc6c01496aee7068b0282215b82531644542732761d731c80
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              MobileConcepts45.dll
                              • Path C:\Program Files\CyberGhost 8\MobileConcepts45.dll
                              • Size 667KB
                              • SHA256 4d5013d2323a6e2c2a93744c0ccfd2b38ab830280f3a7177dc7815a17ad56d97
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Newtonsoft.Json.dll
                              • Path C:\Program Files\CyberGhost 8\Newtonsoft.Json.dll
                              • Size 692KB
                              • SHA256 9a014ae06b44ca5a50b6e3dd3fe85461246fa2134b711d1a0647c21a9151c8fd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Sentry.dll
                              • Path C:\Program Files\CyberGhost 8\Sentry.dll
                              • Size 696KB
                              • SHA256 353215acd8e63f3c674fd45d7e67b327746aee37587c6a715af9eb5f97e7d94a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Serilog.Formatting.Compact.dll
                              • Path C:\Program Files\CyberGhost 8\Serilog.Formatting.Compact.dll
                              • Size 19KB
                              • SHA256 ee844fbb901973c584a3dbc1725ddc711192d772113c451ed11cc4f8a1184aa2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Serilog.dll
                              • Path C:\Program Files\CyberGhost 8\Serilog.dll
                              • Size 168KB
                              • SHA256 441be85237ff8f7464abac80d7c3f279ab6645a5b14223a886ed42064bd51eae
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.Diagnostics.DiagnosticSource.dll
                              • Path C:\Program Files\CyberGhost 8\System.Diagnostics.DiagnosticSource.dll
                              • Size 183KB
                              • SHA256 1cbc8d1d1ffec3f73e95b896320ab3dd203c6e63a160d966ca861f879de7a252
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.Text.Json.dll
                              • Path C:\Program Files\CyberGhost 8\System.Text.Json.dll
                              • Size 502KB
                              • SHA256 f241f2579973d49931c1e29bb297198b2946d127cc52b0aa577a79a88491bcf6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.Threading.Tasks.Extensions.dll
                              • Path C:\Program Files\CyberGhost 8\System.Threading.Tasks.Extensions.dll
                              • Size 25KB
                              • SHA256 4c45bb02e54fdec127e3b3df4c57cc5fa4cb76fd7a8fbac28b4cfa50e3083b0a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              WPFLocalizeExtension.dll
                              • Path C:\Program Files\CyberGhost 8\WPFLocalizeExtension.dll
                              • Size 86KB
                              • SHA256 33f18a90122e6c6ed8b32c7ef4ad12e0eb7e9da4b0c1f9560aa9e76422da997b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              XAMLMarkupExtensions.dll
                              • Path C:\Program Files\CyberGhost 8\XAMLMarkupExtensions.dll
                              • Size 38KB
                              • SHA256 711ad1855b811be2190dda827b2a19a46bb177f78a1bc63bf71b8e16379dac46
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.resources.dll
                              • Path C:\Program Files\CyberGhost 8\de\Dashboard.resources.dll
                              • Size 54KB
                              • SHA256 c514b90a65e8b7ef5b4098e8a066c0781cee572117a5501d6d33c2f72df59baa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.resources.dll
                              • Path C:\Program Files\CyberGhost 8\es\Dashboard.resources.dll
                              • Size 54KB
                              • SHA256 60919510ec1ff993c66e212de71cdd76da5bd1a8ac33a6d32372ead47457ddc0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Dashboard.resources.dll
                              • Path C:\Program Files\CyberGhost 8\fr\Dashboard.resources.dll
                              • Size 56KB
                              • SHA256 356701747b739c9361fedb040d2d036037fe1d476c505ff8198a9562756d8e42
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              flags_S0td7PcCqbmH-CN0EUoV65zMXaO5_Q95MSzq75VQsHg=
                              • Path C:\Users\Admin\AppData\Local\IsolatedStorage\v0adt3oy.k2p\4prsj4pk.g2o\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\StrongName.rmlqlgqfxofim1u4xzzctovqokmokpip\Files\LaunchDarkly_QUEtxzTz76Ad8h9-oQ6Z5qLlzl8ZwK6bWWpos3tjUh4=\flags_S0td7PcCqbmH-CN0EUoV65zMXaO5_Q95MSzq75VQsHg=
                              • Size 23KB
                              • SHA256 721d7d684c884d186e81ce5d831fafe2fce1007f622152942afc09434879222d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              identity.dat
                              • Path C:\Users\Admin\AppData\Local\IsolatedStorage\v0adt3oy.k2p\4prsj4pk.g2o\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\StrongName.rmlqlgqfxofim1u4xzzctovqokmokpip\identity.dat
                              • Size 529B
                              • SHA256 e793e9fe1e0b527892288333ac536ac6dc3caef299bd6cfeab65346529a9caeb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              identity.dat
                              • Path C:\Users\Admin\AppData\Local\IsolatedStorage\v0adt3oy.k2p\4prsj4pk.g2o\StrongName.1r34rtndphgwhqowmyxywu5guyuf1gh2\identity.dat
                              • Size 516B
                              • SHA256 c0e19b908c5785d7bcd8787a91f63063e202b4d504501c167c76ffbc7b06facd
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Edge Profile.ico
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                              • Size 70KB
                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                              • Size 61B
                              • SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              Preferences
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              • Size 7KB
                              • SHA256 ecaf6fe01a71328aee307991b82a9bca6e1e4f2a5a9a6913b4d09c97fa524463
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Secure Preferences
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                              • Size 26KB
                              • SHA256 0dc09a7e14c55da6adfb12392f6dafc69884aac7aea3380ea6dd96df0b7d64a2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 8KB
                              • SHA256 8ff9be06c8f555d53f44537b66e73b399f52c07e6035c5a9b35fa3d8e7e0ca51
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 8KB
                              • SHA256 d3ce3ccfcac0a199814eac159986241d676297d9b155e86ff85e1b6e770ed31a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 9KB
                              • SHA256 3ff45e239c5ae4fdc62400bc8aa493dbd4ca773d07474fa3373d10aa29cbfe19
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 9KB
                              • SHA256 13112a2f7e6c995beae813b5861652b797c96555defb80e58ee7a2d37e4782c0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              activity-stream.contile.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\activity-stream.contile.json
                              • Size 5KB
                              • SHA256 c9872378a0bf80b03c7e270ce70e61e63116c0ca2eb497b30ab0b0adf3e2e491
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              activity-stream.discovery_stream.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\activity-stream.discovery_stream.json
                              • Size 74KB
                              • SHA256 2fc28b0ac3a07665021e631bd823c759692b554332b5a3b65dc95379b187e5d1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              activity-stream.discovery_stream.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\activity-stream.discovery_stream.json
                              • Size 74KB
                              • SHA256 a64bf6e360cb723f2aae0b3cb72f187082298dd951d16229781722aa3a2107f3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              10670
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\doomed\10670
                              • Size 13KB
                              • SHA256 197fb5faeaf6b91e6d84417e30c8540231b4d22513f62dbfbf780d7a43f55516
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              1939EA2F1DFBDA1AA5BB2860ED3E82D7B85986B2
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\1939EA2F1DFBDA1AA5BB2860ED3E82D7B85986B2
                              • Size 169KB
                              • SHA256 1dddc2a445f3995042cbf57da1054ee1521c696e0a4ef95a031adc00d40b9a3e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              1DD44DBB6873E30880AA9BFC6906078BF2E8CDBC
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\1DD44DBB6873E30880AA9BFC6906078BF2E8CDBC
                              • Size 172KB
                              • SHA256 bedcedbb807417687e495a0ffcfc1520e5074416f53341201d42807ed19ad40a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              39172F2924E6689A994995A9C4E51BECDC2078DD
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\39172F2924E6689A994995A9C4E51BECDC2078DD
                              • Size 23KB
                              • SHA256 f3b7c1cb8d2b19dabeaef98319699a6c0cb048f6e72a29c47e0f230508ab956c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              420D4D79D30BA519EDFD01D0037E65CC05CBAA34
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\420D4D79D30BA519EDFD01D0037E65CC05CBAA34
                              • Size 25KB
                              • SHA256 92e492b0b088eef599cdbfbc22682a3f2233290ebac43e70e0b1bd91a0829cdd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              564637E46060EEB6FEE5331806348CD57D1B75EC
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\564637E46060EEB6FEE5331806348CD57D1B75EC
                              • Size 109KB
                              • SHA256 fb2d5408230bfbe6ffe5578d0abe5e2d4c8b9bfbd41e62717f9f8c2b71cc33b6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                              • Size 16KB
                              • SHA256 b7f118eef172e551a00525eb382ed1e67ec972c19f131e94facbd5a390e66eb1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              658F0D350A6E49CBAFDC790E89325AA031999915
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\658F0D350A6E49CBAFDC790E89325AA031999915
                              • Size 30KB
                              • SHA256 22a0277311f31e816c0bf63722ac084640c0adffa046f83289b2b41bd361bf07
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              6D89348819C8881868053197CA0754F36784BF5F
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                              • Size 16KB
                              • SHA256 a6bb4495d43ab34c928544d2adbb7768a83057d7df0478954850b75774b01bbf
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ABA94A27434BB61E122DD3F9A3D3A9F32E734F47
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\ABA94A27434BB61E122DD3F9A3D3A9F32E734F47
                              • Size 111KB
                              • SHA256 8b454b2cb2b588e8ecfe8795cb022f2b17251b7089085aba288965a5c704e25b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              C4699774B6C1D613A92AB9DC9ED29048F8B8E8FD
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\C4699774B6C1D613A92AB9DC9ED29048F8B8E8FD
                              • Size 353KB
                              • SHA256 c185f6fd539b2f3d89905a53994a3346bec722061ae66d125a4b2a1f93cabf63
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              D7144331E9D5ECDC66C368A2A10E9002B8F1AED0
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\D7144331E9D5ECDC66C368A2A10E9002B8F1AED0
                              • Size 21KB
                              • SHA256 ae9c77a2ebe56cf54bb0760cce83688586dd5266b7e9dd40bbc4ab9f72fe9a57
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_arts_and_entertainment.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                              • Size 67KB
                              • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_autos_and_vehicles.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                              • Size 44KB
                              • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_beauty_and_fitness.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                              • Size 33KB
                              • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_blogging_resources_and_services.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                              • Size 33KB
                              • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_books_and_literature.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                              • Size 67KB
                              • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_business_and_industrial.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                              • Size 45KB
                              • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_computers_and_electronics.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                              • Size 45KB
                              • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_finance.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_finance.json
                              • Size 33KB
                              • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_food_and_drink.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                              • Size 67KB
                              • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_games.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_games.json
                              • Size 44KB
                              • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_health.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_health.json
                              • Size 33KB
                              • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_hobbies_and_leisure.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                              • Size 67KB
                              • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_home_and_garden.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                              • Size 33KB
                              • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_internet_and_telecom.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                              • Size 67KB
                              • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_jobs_and_education.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                              • Size 33KB
                              • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_law_and_government.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                              • Size 68KB
                              • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_online_communities.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                              • Size 67KB
                              • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_people_and_society.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                              • Size 45KB
                              • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_pets_and_animals.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                              • Size 44KB
                              • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_real_estate.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                              • Size 67KB
                              • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_reference.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_reference.json
                              • Size 56KB
                              • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_science.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_science.json
                              • Size 56KB
                              • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_shopping.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_shopping.json
                              • Size 67KB
                              • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_sports.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_sports.json
                              • Size 56KB
                              • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nb_model_build_attachment_travel.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\nb_model_build_attachment_travel.json
                              • Size 67KB
                              • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              recipe_attachment.json
                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\personality-provider\recipe_attachment.json
                              • Size 1KB
                              • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              570bd9cc-25d1-45fd-80e6-955fca453364.zip
                              • Path C:\Users\Admin\AppData\Local\Temp\570bd9cc-25d1-45fd-80e6-955fca453364.zip
                              • Size 3.8MB
                              • SHA256 0f26d820b4bbdca26b02e76d6c0647153ad7e1839222f15361fd2ee9016c8e25
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              TmpA2D3.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\TmpA2D3.tmp
                              • Size 2KB
                              • SHA256 732dee732e0261afbfba21eca43008a5009cfc9e4c405ece8826a9746564cceb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              remote-settings-startup-bundle-
                              • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                              • Size 573KB
                              • SHA256 69a940086f0c420c28d491364abceac671ba9338afa361f93880597c04ec73c4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tmpaddon
                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              • Size 11KB
                              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tmpaddon
                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              • Size 502KB
                              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              oemvista.inf
                              • Path C:\Users\Admin\AppData\Local\Temp\{bcbe94db-af10-8f44-b93c-4fa25548a6da}\oemvista.inf
                              • Size 7KB
                              • SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tap0901.cat
                              • Path C:\Users\Admin\AppData\Local\Temp\{bcbe94db-af10-8f44-b93c-4fa25548a6da}\tap0901.cat
                              • Size 11KB
                              • SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tap0901.sys
                              • Path C:\Users\Admin\AppData\Local\Temp\{bcbe94db-af10-8f44-b93c-4fa25548a6da}\tap0901.sys
                              • Size 40KB
                              • SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              6824f4a902c78fbd.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                              • Size 11KB
                              • SHA256 12c6d662e50ef643f76f2f425a08b2a2e53999064bdfaf241dad19f5cee6a960
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              6824f4a902c78fbd.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                              • Size 15KB
                              • SHA256 9efb511e712fb61a9f60ec2d6e5f964284b8ae833cdbfcb9e8e90740dc0c220d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AlternateServices.bin
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
                              • Size 13KB
                              • SHA256 328545e42e1bdc3a5bc90f0ca80be8f334fc1987dd744f27e5f5302f7935486a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AlternateServices.bin
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
                              • Size 27KB
                              • SHA256 e77d2ce19297d9f683b3957bebda1befaa9195b3a2c44f93c8f5be5a5f8f002d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AlternateServices.bin
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
                              • Size 32KB
                              • SHA256 0a5c6208ca73e0f137541aacc4bd421b3807bba66c36beb231cee60435f26ad4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AlternateServices.bin
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
                              • Size 32KB
                              • SHA256 67a6c06410f5cdcb1aebdbbc70b64be42f07c0417ee99e51b5478f98d095ab1e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AlternateServices.bin
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
                              • Size 32KB
                              • SHA256 039aa28848d76e28d182b1b0419fd9792c0f7e8914778ad70d265ac45dff5d4a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SiteSecurityServiceState.bin
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\SiteSecurityServiceState.bin
                              • Size 4KB
                              • SHA256 3fc7b3d264607ccf525ef259c49a61bf8bb4715bd034b4701c8394b10f76171f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              addonStartup.json.lz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\addonStartup.json.lz4
                              • Size 4KB
                              • SHA256 543416212d485e20b3eec922a550446028cc1cb783be138cbfab43a707d50171
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              bookmarks-2026-09-08_10_JnjXAYouuCVi6BSR-t8kHuSXfBMAmCfTUy33QB59_i8=.jsonlz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\bookmarkbackups\bookmarks-2026-09-08_10_JnjXAYouuCVi6BSR-t8kHuSXfBMAmCfTUy33QB59_i8=.jsonlz4
                              • Size 862B
                              • SHA256 d8b8424ca9d5ee2d5915d647c17da2557cf2e337643c925d080eb2f3dae1a94d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              data.safe.tmp
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
                              • Size 4KB
                              • SHA256 5dbaa5e07041a664d6607e154c39cb4fade7f5af4c9521b359575b1058385f27
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data.safe.tmp
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
                              • Size 7KB
                              • SHA256 d3dfc8fd9291a27a60dd8bb7a962ad0e2b79dfd3b67a219732487819ef4e45db
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data.safe.tmp
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
                              • Size 7KB
                              • SHA256 72d2e1d90505e8f409ca8b78d7ceacff23eb72df6f2eb4a10dfb83dd8c284b54
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data.safe.tmp
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
                              • Size 138KB
                              • SHA256 69a72ecab069ecba35708283c6d27c441fb199db995cea860e74ad13e328417a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data.safe.tmp
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
                              • Size 138KB
                              • SHA256 ea32e4512a5d4b6d4c4a77fb23b06dfe036a6e89a23368b6e754b1c4de28c421
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data.safe.tmp
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
                              • Size 138KB
                              • SHA256 3c43528ba584aa98002d991a6117be8166d5cf0eee2f8aecc73740d82c6511b9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              events
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
                              • Size 1KB
                              • SHA256 2b49429ee2640e0b35dbca703ea4ba0d5d0dc58557b80e6b4a0a19bdbd0eab10
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              events
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
                              • Size 5KB
                              • SHA256 c420f69f6acca8821cf3d7b32b256972a7efa617e8e3ec102bf33de9b9bb96b0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              25044fd9-9481-4cda-8ace-2a88b26ebcac
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\25044fd9-9481-4cda-8ace-2a88b26ebcac
                              • Size 235B
                              • SHA256 bcae72577a31156a440831575ffc37dca2b3979a6fc7305a29dd83a06f40ad9e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              58cc875a-8ed8-496c-9489-e2a28dd8bce8
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\58cc875a-8ed8-496c-9489-e2a28dd8bce8
                              • Size 15KB
                              • SHA256 6d25bfcf9450ff24631f1d7c35f934371ea23dfcd1c74ff0cef4be0c63189bc2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              6df68e89-95dc-4e84-ab2f-4049f0294705
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\6df68e89-95dc-4e84-ab2f-4049f0294705
                              • Size 235B
                              • SHA256 122e838b9cc9c06cd4a8a23c1cd9e7c6dfbbe545888463b3b5d37d6df3966f7b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              7dbe6822-6c52-46fb-9f5b-632129dabe03
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\7dbe6822-6c52-46fb-9f5b-632129dabe03
                              • Size 886B
                              • SHA256 2a37816a089a83d03ce34e2783d4168b38c20d93c468e21f7295eb978d691663
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              a33302ba-550c-4d49-9ba1-06aff4b3a83b
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\a33302ba-550c-4d49-9ba1-06aff4b3a83b
                              • Size 883B
                              • SHA256 39f6d0aa8a00f027e4f1591bdd9d37d1643a5d5fef70af674624fa4f0c8200c0
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              a45dd47c-294d-475a-a751-8b69f03931dc
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\a45dd47c-294d-475a-a751-8b69f03931dc
                              • Size 2KB
                              • SHA256 93b01c546d40bb3aee9416919ed27b4ea5abc3fbf6dbdf74c69a6ce95841d62a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              extension-preferences.json
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extension-preferences.json
                              • Size 942B
                              • SHA256 56d9dfe54a41438ec90ae6cdeacdbfadb3e3b04f5403a220e844a1775e1ba21f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              extensions.json
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
                              • Size 16KB
                              • SHA256 797181e6074c87855cfba5c71902428d369c9e4ea6ae5beeeaee4fad2da0b966
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              gmpopenh264.dll
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                              • Size 1.1MB
                              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              gmpopenh264.info
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                              • Size 116B
                              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              manifest.json
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                              • Size 1002B
                              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              widevinecdm.dll
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                              • Size 21.6MB
                              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              prefs-1.js
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
                              • Size 8KB
                              • SHA256 6e5718f3048e9c55fdc2889d855553f97f1c6d4f59b7753e1a6ad9a9c70e95c1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              prefs-1.js
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
                              • Size 12KB
                              • SHA256 103f3cc5461e3912a4b42ca55fef15d192e2f067bd13752152d90858986f51e4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              prefs-1.js
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
                              • Size 12KB
                              • SHA256 2947d5e7633082f32d4cb496591e16cf1edaee491a18c13191362e219a260ad7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              prefs.js
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
                              • Size 6KB
                              • SHA256 634f95f5adfe34c0cb350f4474a48bfcc42750866c2221f1ff96fb33d0c5ed1e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              prefs.js
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
                              • Size 7KB
                              • SHA256 42732be77f6e2ef7fe68af7fee4b2dc4573b274837e8a4788b5e71c9289026af
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              prefs.js
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
                              • Size 6KB
                              • SHA256 0ff82f5f4b1fe6f1eca646f15ff7e214d6f9afc6598ec385b9bdcee9c0547c82
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              prefs.js
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
                              • Size 6KB
                              • SHA256 a0b4fdc4166e7ff4fef0504465265162330ec13dddea1d73690d9140c8badaf4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              recovery.baklz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
                              • Size 1KB
                              • SHA256 63e3bbfd88a41cf78950aa186789b9b7070ca066d01568552ba0ac296f06d74a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              recovery.baklz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
                              • Size 7KB
                              • SHA256 a5a6506ad0f0be32d9f2c81851adc14512e91df63263aa9ef1aeeab7c64a3053
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              recovery.baklz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
                              • Size 7KB
                              • SHA256 fb0f74acd600e8d82b12f6fcd365e7eae5e89795c51255baa1a5acbbfea2017b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              recovery.baklz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
                              • Size 8KB
                              • SHA256 cc715a213114fd1bea6c060d777efb8a82cedf708fe2aa7cd83c07d1aea2cae3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              recovery.baklz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
                              • Size 10KB
                              • SHA256 5e1f3a8ca7e1501207f7fd065a16ba8ffa866f4c96bd4cb7628008d582166f00
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              recovery.jsonlz4
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.jsonlz4
                              • Size 7KB
                              • SHA256 72750a46b8a7260d4edaea6ede1cfaebe270847fcb12f91b8b4a0e7e2ab98ae3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              3870112724rsegmnoittet-es.sqlite
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                              • Size 4.5MB
                              • SHA256 51a277cc41d7df32182b7dc26ae7a8a3eb458badca34b1ceb00a784ec301f438
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              3870112724rsegmnoittet-es.sqlite
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                              • Size 11.8MB
                              • SHA256 4ef6be79c09b6099ef671b01d2afc0ef4404553d41e45f5b260ceaf6022b14a9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              xulstore.json
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\xulstore.json
                              • Size 167B
                              • SHA256 c1bed5f53e44f988d50469fe36ee52ab0bfe2215cc126514ad06b5c0c28dfd87
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/1036-1472-0x000001C8FD9A0000-0x000001C8FD9DC000-memory.dmp
                              Download

                              memory/1036-1471-0x000001C8E4D80000-0x000001C8E4D92000-memory.dmp
                              Download

                              memory/1036-1458-0x000001C8E3180000-0x000001C8E3194000-memory.dmp
                              Download

                              memory/1432-57-0x000001ACF2F70000-0x000001ACF2F8A000-memory.dmp
                              Download

                              memory/1432-64-0x000001ACF4160000-0x000001ACF4168000-memory.dmp
                              Download

                              memory/1432-77-0x000001ACF6E20000-0x000001ACF6E58000-memory.dmp
                              Download

                              memory/1432-74-0x000001ACF6D50000-0x000001ACF6D58000-memory.dmp
                              Download

                              memory/1432-78-0x000001ACF7DA0000-0x000001ACF7DDA000-memory.dmp
                              Download

                              memory/1432-103-0x000001ACF82E0000-0x000001ACF82EA000-memory.dmp
                              Download

                              memory/1432-91-0x000001ACF7E10000-0x000001ACF7E32000-memory.dmp
                              Download

                              memory/1432-69-0x000001ACF44A0000-0x000001ACF44A8000-memory.dmp
                              Download

                              memory/1432-92-0x000001ACF6DC0000-0x000001ACF6DCA000-memory.dmp
                              Download

                              memory/1432-93-0x000001ACF7E40000-0x000001ACF7E7A000-memory.dmp
                              Download

                              memory/1432-94-0x000001ACF7E80000-0x000001ACF7F32000-memory.dmp
                              Download

                              memory/1432-95-0x000001ACF7F30000-0x000001ACF7F42000-memory.dmp
                              Download

                              memory/1432-48-0x000001ACD8520000-0x000001ACD8A30000-memory.dmp
                              Download

                              memory/1432-97-0x000001ACF30C0000-0x000001ACF30D0000-memory.dmp
                              Download

                              memory/1432-67-0x000001ACF42A0000-0x000001ACF42A8000-memory.dmp
                              Download

                              memory/1432-100-0x000001ACF91B0000-0x000001ACF9242000-memory.dmp
                              Download

                              memory/1432-49-0x000001ACF30C0000-0x000001ACF30D0000-memory.dmp
                              Download

                              memory/1432-101-0x000001ACF9240000-0x000001ACF9266000-memory.dmp
                              Download

                              memory/1432-68-0x000001ACF4440000-0x000001ACF4448000-memory.dmp
                              Download

                              memory/1432-66-0x000001ACF4260000-0x000001ACF4268000-memory.dmp
                              Download

                              memory/1432-65-0x000001ACF4200000-0x000001ACF4208000-memory.dmp
                              Download

                              memory/1432-51-0x000001ACD8E60000-0x000001ACD8E68000-memory.dmp
                              Download

                              memory/1432-63-0x000001ACF3B60000-0x000001ACF3B68000-memory.dmp
                              Download

                              memory/1432-62-0x000001ACF3800000-0x000001ACF3808000-memory.dmp
                              Download

                              memory/1432-61-0x000001ACF3500000-0x000001ACF3508000-memory.dmp
                              Download

                              memory/1432-60-0x000001ACF34D0000-0x000001ACF34FA000-memory.dmp
                              Download

                              memory/1432-59-0x000001ACF34C0000-0x000001ACF34CE000-memory.dmp
                              Download

                              memory/1432-58-0x000001ACF3330000-0x000001ACF3376000-memory.dmp
                              Download

                              memory/1432-73-0x000001ACF6D40000-0x000001ACF6D48000-memory.dmp
                              Download

                              memory/1432-75-0x000001ACF6DE0000-0x000001ACF6E18000-memory.dmp
                              Download

                              memory/1432-70-0x000001ACF4580000-0x000001ACF4588000-memory.dmp
                              Download

                              memory/1432-102-0x000001ACF82F0000-0x000001ACF82F8000-memory.dmp
                              Download

                              memory/1432-50-0x000001ACF2EA0000-0x000001ACF2F36000-memory.dmp
                              Download

                              memory/1432-1403-0x000001ACF92C0000-0x000001ACF9310000-memory.dmp
                              Download

                              memory/1432-71-0x000001ACF4600000-0x000001ACF4608000-memory.dmp
                              Download

                              memory/1432-1404-0x000001ACF9390000-0x000001ACF9406000-memory.dmp
                              Download

                              memory/1432-56-0x000001ACF3160000-0x000001ACF3200000-memory.dmp
                              Download

                              memory/1432-55-0x000001ACF2F40000-0x000001ACF2F4A000-memory.dmp
                              Download

                              memory/1432-54-0x000001ACD8E80000-0x000001ACD8E8A000-memory.dmp
                              Download

                              memory/1432-53-0x000001ACF30D0000-0x000001ACF3164000-memory.dmp
                              Download

                              memory/1432-52-0x000001ACDA770000-0x000001ACDA778000-memory.dmp
                              Download

                              memory/1432-76-0x000001ACF6DB0000-0x000001ACF6DBE000-memory.dmp
                              Download

                              memory/1432-72-0x000001ACF4760000-0x000001ACF4776000-memory.dmp
                              Download

                              memory/2340-0-0x0000000000580000-0x00000000005A2000-memory.dmp
                              Download

                              memory/2340-3-0x000000001C840000-0x000000001CD68000-memory.dmp
                              Download

                              memory/2340-1-0x000000001B300000-0x000000001B310000-memory.dmp
                              Download

                              memory/2340-2-0x000000001C670000-0x000000001C832000-memory.dmp
                              Download

                              memory/2340-96-0x000000001B300000-0x000000001B310000-memory.dmp
                              Download

                              memory/3016-1519-0x000001BFD43A0000-0x000001BFD445C000-memory.dmp
                              Download

                              memory/3016-1490-0x000001BFD3B30000-0x000001BFD3BB2000-memory.dmp
                              Download

                              memory/3016-1503-0x000001BFD3E20000-0x000001BFD3E7A000-memory.dmp
                              Download

                              memory/3016-1505-0x000001BFD3DC0000-0x000001BFD3DF6000-memory.dmp
                              Download

                              memory/3016-1501-0x000001BFD3A10000-0x000001BFD3A1E000-memory.dmp
                              Download

                              memory/3016-1488-0x000001BFD3A70000-0x000001BFD3B22000-memory.dmp
                              Download

                              memory/3016-1513-0x000001BFD3A30000-0x000001BFD3A3A000-memory.dmp
                              Download

                              memory/3016-1529-0x000001BFD3F40000-0x000001BFD3F56000-memory.dmp
                              Download

                              memory/3016-1522-0x000001BFD3F40000-0x000001BFD3F56000-memory.dmp
                              Download

                              memory/3016-1531-0x000001BFD3F70000-0x000001BFD3FA0000-memory.dmp
                              Download

                              memory/3016-1536-0x000001BFD4CF0000-0x000001BFD4DCA000-memory.dmp
                              Download

                              memory/3016-1538-0x000001BFD4310000-0x000001BFD433A000-memory.dmp
                              Download

                              memory/3016-1511-0x000001BFD3A40000-0x000001BFD3A56000-memory.dmp
                              Download

                              memory/3016-1533-0x000001BFD3F40000-0x000001BFD3F60000-memory.dmp
                              Download

                              memory/3404-1448-0x00000270B5850000-0x00000270B5882000-memory.dmp
                              Download

                              memory/3404-1549-0x00000270B5F40000-0x00000270B5F50000-memory.dmp
                              Download

                              memory/3404-1551-0x00000270B5F50000-0x00000270B5F60000-memory.dmp
                              Download

                              memory/3404-1553-0x00000270B60B0000-0x00000270B60C0000-memory.dmp
                              Download

                              memory/3404-1555-0x00000270B60C0000-0x00000270B60CE000-memory.dmp
                              Download

                              memory/3404-1557-0x00000270B60D0000-0x00000270B60E0000-memory.dmp
                              Download

                              memory/3404-1559-0x00000270B60E0000-0x00000270B60F0000-memory.dmp
                              Download

                              memory/3404-1561-0x00000270B60F0000-0x00000270B6100000-memory.dmp
                              Download

                              memory/3404-1563-0x00000270B6240000-0x00000270B6250000-memory.dmp
                              Download

                              memory/3404-1565-0x00000270B6270000-0x00000270B6282000-memory.dmp
                              Download

                              memory/3404-1567-0x00000270B6290000-0x00000270B62A2000-memory.dmp
                              Download

                              memory/3404-1569-0x00000270B62B0000-0x00000270B62C2000-memory.dmp
                              Download

                              memory/3404-1571-0x00000270B6480000-0x00000270B6492000-memory.dmp
                              Download

                              memory/3404-1572-0x00000270B64A0000-0x00000270B64B2000-memory.dmp
                              Download

                              memory/3404-1573-0x00000270B64C0000-0x00000270B64D2000-memory.dmp
                              Download

                              memory/3404-1574-0x00000270B64E0000-0x00000270B64F2000-memory.dmp
                              Download

                              memory/3404-1575-0x00000270B6500000-0x00000270B6512000-memory.dmp
                              Download

                              memory/3404-1436-0x00000270B57E0000-0x00000270B584E000-memory.dmp
                              Download

                              memory/3404-1438-0x00000270B5420000-0x00000270B5450000-memory.dmp
                              Download

                              memory/3404-1444-0x00000270B5770000-0x00000270B579E000-memory.dmp
                              Download

                              memory/3404-1446-0x000002709B270000-0x000002709B278000-memory.dmp
                              Download

                              memory/3404-1450-0x00000270B5950000-0x00000270B5A02000-memory.dmp
                              Download

                              memory/3404-1452-0x00000270B56A0000-0x00000270B56BA000-memory.dmp
                              Download

                              memory/3404-1454-0x00000270B5470000-0x00000270B547E000-memory.dmp
                              Download

                              memory/3404-1432-0x00000270B56C0000-0x00000270B576A000-memory.dmp
                              Download

                              memory/3404-1440-0x00000270B5670000-0x00000270B5696000-memory.dmp
                              Download

                              memory/3404-1442-0x000002709B280000-0x000002709B290000-memory.dmp
                              Download

                              memory/3404-1434-0x00000270B5610000-0x00000270B566C000-memory.dmp
                              Download

                              memory/3404-1430-0x00000270B53E0000-0x00000270B5418000-memory.dmp
                              Download

                              memory/3404-1428-0x00000270B5480000-0x00000270B5520000-memory.dmp
                              Download

                              memory/3404-1426-0x000002709ACD0000-0x000002709AE2E000-memory.dmp
                              Download