82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8

General

Target

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
Size

3.6MB
MD5

01a797fb3950fc40b793a2a930961b69
SHA1

e4a7a06b513e61baf2a3dbf7c1fff3946c6663cc
SHA256

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8
SHA512

60bec9c1fac173a161e4b84b0f151adbe76e14f6cad45268676f4bf2f8149e5475aeef244ed9ad312aa7ba15ac007cbb79a7fd4a18c912980cc8ec472a6a30ec
SSDEEP

49152:hDjeP+ApznKhqavgYjXOUzIeZwmX4N2hbYiPTUQmJTaId+s8KuqGaX0ToIBAUZL8:9jeP+ApznWI4XOiIGX4NuEmNJBAUZLO7

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2024-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2024-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

pid process

2024 82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

description ioc process

File opened for modification \??\PhysicalDrive0 82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376216381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88142461-6D64-11ED-A20B-4279513DF160} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000050df7bc722d6b86a94dc9942238a4014b9963ecc9a3c27ec665658ca9de05c04000000000e8000000002000020000000c0a89bcb1f224213856abaf4655e62c13c8bb4d519df002d1732486e4909fca820000000e9be7783b8660eb2fbaaa670ea8a3d552c1cd156470589e2418d66b71a5f0ee7400000003ad01a0bfa3b0e1d74469bf341c495ab5ea0769e9894ec10014a890319c1e61a5dbf4851d7d2da3fb315e45e863a8cd4fd74762e426755deadaff440c65c2ad2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\12345ee.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\12345ee.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000076aa52da07728dea5e9fd5cc93156ae10d7c9be5d0d9179cc9ac429b998b22b5000000000e800000000200002000000034b1afb2713e93695ffcf71aea4785064c978fc0cd159cfc6009ea9131c7ffd790000000d8a182f87fcdc1782e79c9dde626558896fe1536d5a4325eaa437b6354844f0ad6b8c4827b09a6a00ece186cc6e9b1546c597f4030abee757518ef68d319a1cf3abeb11071923e5fedc45fa929365e974d96b0da4180314c6eca9169d9f40a2b2567201b49e608dc653a8db4e5ed436d7d9f90c3c1e3ee78576448aa37c5f279c7433de07afad8477e5d112927d209ea400000002d983464d5e74a4c5237b1f6c997109f2d63331ac1ce98d68362ccac07418e7c1728512cc646c5dba8481759e982c4026126b2f59e720e1ec252930773636b4b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\12345ee.com\Total = "63"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408d48607101d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.12345ee.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.12345ee.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1740 iexplore.exe

pid	process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exeiexplore.exeIEXPLORE.EXE

pid	process
2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
1740	iexplore.exe
1740	iexplore.exe
464	IEXPLORE.EXE
464	IEXPLORE.EXE
464	IEXPLORE.EXE
464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exeiexplore.exe

description	pid	process	target process
PID 2024 wrote to memory of 1740	2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe	iexplore.exe
PID 2024 wrote to memory of 1740	2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe	iexplore.exe
PID 2024 wrote to memory of 1740	2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe	iexplore.exe
PID 2024 wrote to memory of 1740	2024	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe	iexplore.exe
PID 1740 wrote to memory of 464	1740	iexplore.exe	IEXPLORE.EXE
PID 1740 wrote to memory of 464	1740	iexplore.exe	IEXPLORE.EXE
PID 1740 wrote to memory of 464	1740	iexplore.exe	IEXPLORE.EXE
PID 1740 wrote to memory of 464	1740	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
"C:\Users\Admin\AppData\Local\Temp\82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.12345ee.com/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3887843e42bffef1ca8343eec187ba58

SHA1
7d7cba91b6fb2ceeb1f166ddff6f5adeb348e09c

SHA256
134ee66712462534f8648e41c02ed0b08c0965e3941b2d98f73b21642d942753

SHA512
1e212036e12f00dbaa495d30d9587ed51f7370a36747f8745b155246dc8a8bb3121c4e30fd66b063d2ba0285a249bbed26c70cc5724d271e3febdc830943ff3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
13KB

MD5
416f9d089f13c416873b0581085984e0

SHA1
6230a839c974d36213c48de154657cb9af78d852

SHA256
8f2dc83ce1938f9f988d6fb1c9c6ce9d992d345ba17cfac6712f51a93e03f76b

SHA512
6b25102d5f915e4e08e99b9f98ce02ee5352be5099feaa2f35b54ffba2c6ca2bc141ebd3da34335db9f074a87d1dfff03ff92c4c910f77fda019706f3b485768

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YB18UM2L.txt
Filesize
603B

MD5
964f26ec18ff8771a62a1d0488383a5e

SHA1
91e397524400c7618850d67ea341c3880745b7b7

SHA256
4a33247ff75d62e113e76e5d80cb96089c991bd83c392c203056f4d40b6f4748

SHA512
c229d2f163e860dc42635993616ada86eceb645a8a2041d734514bb9a5490310d0a5b284e7624e8820261669cc673954fafbbd1b72433651873c3fa9019977af

Download Submit
\Users\Admin\AppData\Local\Temp\CrackCaptchaAPI.dll
Filesize
1.3MB

MD5
9a4965011a94705227f62df0776f2ab6

SHA1
fe91972e1c993731cdacc7429c4f4760672adcf7

SHA256
a9ea79e9c5017616ca9085351ef166f35882ad5a201b92c4839ffdf1169e4113

SHA512
e74bc303d99a2151dd00b8f4da0aabd70b37fe46a74702034a5a0ab3da7cad9ad0b7d69b960a10d0876ad5b660e1b868c8956e8d05321f7120f480baee34378a

Download Submit
memory/2024-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2024-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2024-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads