Overview

overview

10

Static

static

1

uTorrent(1).exe

windows10-2004-x64

8

uTorrent(1).exe

windows11-21h2-x64

8

utorrent(1...er.exe

windows10-2004-x64

10

utorrent(1...er.exe

windows11-21h2-x64

10

utorrent(1...nt.exe

windows10-2004-x64

8

utorrent(1...nt.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 16:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    utorrent(1)/adguardinstaller.exe

  • Size

    142KB

  • MD5

    cd3581d9db9d066b4c08a42df3d6c1ac

  • SHA1

    deb0c2bcc63cd5f8b6e63a00cbf731475045898e

  • SHA256

    17eeb4a4eec555bdcbb1bd52be92d1b766c402e9ebd320fe3134a9f7d349fcb2

  • SHA512

    4218916a98a9c8816e780744dd7ef9679c000fba219ad21f9188c4421bd6afaebedc2d57382b97fb20c7b230e498f61d7ce606713c0a064158237d79563b819d

  • SSDEEP

    3072:K4qZHnMyBV3vChLFvGyfmKvK9MkBrF8wvFx+:K4qZHdV3vevK9MkhRvW

Score
10/10
zgratdiscoverypersistencerat

Malware Config

Signatures

  • Detect ZGRat V1 8 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Drops file in Drivers directory 4 IoCs
  • Manipulates Digital Signatures 1 TTPs 12 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 63 IoCs
  • Executes dropped EXE 10 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\utorrent(1)\adguardinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\utorrent(1)\adguardinstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
      C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe "AID=25774"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Windows\Temp\{55A8A3B6-0F1E-404A-9ED5-352D71ED983F}\.cr\setup.exe
        "C:\Windows\Temp\{55A8A3B6-0F1E-404A-9ED5-352D71ED983F}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=728 -burn.filehandle.self=836 "AID=25774"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.be\adgSetup.exe
          "C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.be\adgSetup.exe" -q -burn.elevated BurnPipe.{1B47C4FC-2D80-4457-85C4-3D8E14AE4EC6} {3639EFB7-4D0B-45AC-BB6C-D1CCF4A667F3} 2896
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4988
        • C:\Windows\SysWOW64\sc.exe
          "sc" query adgnetworktdidrv
          4⤵
          • Launches sc.exe
          PID:1160
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 9501440A00538DC0AA41C2062AF5D914
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID002.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636046 2 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstall
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE62B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240641640 14 Adguard.CustomActions!Adguard.CustomActions.CustomActions.PermanentActions
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:4092
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIEF92.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240644125 33 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallInitialize
        3⤵
        • Manipulates Digital Signatures
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:2688
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIF235.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240644703 59 Adguard.CustomActions!Adguard.CustomActions.CustomActions.CheckServiceStop
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1848
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIFA0C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646656 101 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallFinalize
        3⤵
        • Manipulates Digital Signatures
        • Adds Run key to start application
        • Drops file in Windows directory
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\system32\ie4uinit.exe
          "ie4uinit.exe" -show
          4⤵
          • Modifies Installed Components in the registry
          • Registers COM server for autorun
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:3116
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /C "net start "Adguard Service""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2220
          • C:\Windows\system32\net.exe
            net start "Adguard Service"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3008
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start "Adguard Service"
              6⤵
                PID:2688
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI13EE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653281 141 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          PID:3244
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C7FE0D00B2681E4B6E3AEC16D47F7C42
        2⤵
        • Loads dropped DLL
        PID:1756
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 16D9961487414C8F063E641DBA2A087B E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:4456
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:920
      • C:\Program Files\AdGuard\AdguardSvc.exe
        "C:\Program Files\AdGuard\AdguardSvc.exe"
        1⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Program Files\AdGuard\Adguard.BrowserExtensionHost.exe
          "Adguard.BrowserExtensionHost.exe" /register
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          PID:844
        • C:\Windows\SYSTEM32\sc.exe
          "sc" sdshow "Adguard Service"
          2⤵
          • Launches sc.exe
          PID:4916
        • C:\Windows\SysWOW64\cmd.exe
          /c "schtasks /create /xml "C:\Program Files\AdGuard\config-1661e56ed3c742239cb48202e746bb12.xml" /tn 1661e56ed3c742239cb48202e746bb12 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /xml "C:\Program Files\AdGuard\config-1661e56ed3c742239cb48202e746bb12.xml" /tn 1661e56ed3c742239cb48202e746bb12 /f
            3⤵
            • Creates scheduled task(s)
            PID:920
        • C:\Windows\SYSTEM32\sc.exe
          "sc" sdset "Adguard Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
          2⤵
          • Launches sc.exe
          PID:2156
        • C:\Program Files\AdGuard\Adguard.Tools.exe
          "C:\Program Files\AdGuard\Adguard.Tools.exe" /clean_runouce
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          PID:2212
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C "schtasks /run /tn 1661e56ed3c742239cb48202e746bb12"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Windows\system32\schtasks.exe
            schtasks /run /tn 1661e56ed3c742239cb48202e746bb12
            3⤵
              PID:5092
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /C "schtasks /delete /tn 1661e56ed3c742239cb48202e746bb12 /f"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1076
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /tn 1661e56ed3c742239cb48202e746bb12 /f
              3⤵
                PID:4548
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C "ipconfig /flushdns"
              2⤵
                PID:3404
                • C:\Windows\system32\ipconfig.exe
                  ipconfig /flushdns
                  3⤵
                  • Gathers network information
                  PID:1756
              • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
                2⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Loads dropped DLL
                PID:4408
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /C "ipconfig /flushdns"
                2⤵
                  PID:4700
                  • C:\Windows\system32\ipconfig.exe
                    ipconfig /flushdns
                    3⤵
                    • Gathers network information
                    PID:4160
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /C "ipconfig /flushdns"
                  2⤵
                    PID:4728
                    • C:\Windows\system32\ipconfig.exe
                      ipconfig /flushdns
                      3⤵
                      • Gathers network information
                      PID:3528
                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    "Drivers\x64\AdguardNetReg.exe" -u adgnetworkwfpdrv
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1580
                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
                    2⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:3748
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /C "ipconfig /flushdns"
                    2⤵
                      PID:2312
                      • C:\Windows\system32\ipconfig.exe
                        ipconfig /flushdns
                        3⤵
                        • Gathers network information
                        PID:1844
                  • C:\Program Files\AdGuard\Adguard.exe
                    "C:\Program Files\AdGuard\Adguard.exe" /nosplash
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:3396

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Config.Msi\e57c75a.rbs
                    Filesize

                    358KB

                    MD5

                    19804c7373418cdfe7c80e0345c5e0eb

                    SHA1

                    272b3d15186051076151b625611a552a8b3cc758

                    SHA256

                    ef4129de1a07b390d3b54ea4cb5a4ca941bde490905c56ce010d0dad8624156c

                    SHA512

                    c79a50155ec83129ec70b8f28c76e9ba74de2e4f06203df1d6459c0048963d006bd1bd67f44c88b00f253c453be75874049c3cc597c6c273922ae808acd7bc90

                    Download Submit

                  • C:\Program Files\AdGuard\Adguard.exe
                    Filesize

                    6.8MB

                    MD5

                    269d75aecda348d7036692d27e09af3c

                    SHA1

                    46a11632f13c8be9bf978bc00493d09f105d216e

                    SHA256

                    aa15aaaaf06cf68387f07435d95a7e738aab868bfa28941703680d1ef6d2c8da

                    SHA512

                    db96e23a546dac5f65ff18c5b2e95b0a2ca93013a49e9281e39496b114748dde20fd79833063950891c75998878b1a80b1115d7e071b3799f2c5cfcfd4280f1d

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm64\AdguardNetLib.dll
                    Filesize

                    192KB

                    MD5

                    7257436b13445d12a54aaf9cbff8f029

                    SHA1

                    45c908ae57133fb87ea77d0aef20ad268b0c721b

                    SHA256

                    374512cb07d70a9ccf2b43affb96ab99fc02dcf07ef70b7b38f0c279b12991ca

                    SHA512

                    69c13443db0b7128099cfaa914018393c043ca96c25764b1be10035bba0db8efeabe2725473b95aef704e9de971462c3e615610188e5479a5067331d6096d764

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm64\AdguardNetReg.exe
                    Filesize

                    127KB

                    MD5

                    0c6bc1676b5e7a48a52a015405925f8f

                    SHA1

                    c8b85daec736ce4217ddcc3a41f9c261ff635053

                    SHA256

                    32826a974608c145b2a2ffc925d5698e179cf08e04bc957aea3293344d9616a3

                    SHA512

                    3f750d99e8b01545afd1261883d5fa6990fd8ecdfabe62564c3e7cc1f423f0e409b6305cba2582f89e439c6690aa6c4f8ba5a71a0d7d0494f29692304dc3b858

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\AdguardNetLib.dll
                    Filesize

                    153KB

                    MD5

                    520658c251bcde9fe6c71fb0f0d20986

                    SHA1

                    db75ddf587c128c315a3ba98e1c96749111a3374

                    SHA256

                    09d7da40bb51e62000ae46cc625490f559c035d6d059bd8657ef8b6d103cab20

                    SHA512

                    2785563612e0c4507256dc260c195919f0072aa730f2d5a842cd59823a5fc1db45303c9dbf6537bbe1e971a8a61cc436c4d6d2a4ad79bb727cc8c6f3835169dc

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe
                    Filesize

                    101KB

                    MD5

                    8e37e56d595056bf58e4840b2e0a6312

                    SHA1

                    5f82d763f0eb83ae16f0a51dd9b64c3f1db8a3f2

                    SHA256

                    3bcd226bf0a6de378ee6ff79e5a2c19260f15f28633174ce23472fbfc8aa331a

                    SHA512

                    f35b6da8d6454f52e8555c001fcf216b6c8d04486c2cd28a59028354be596cd6a4cecfe6f6537070f4ed21cf303849cbc4009ed72540efc84f6fdf5ee19c309a

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys
                    Filesize

                    60KB

                    MD5

                    fcb1f6082b2dd42faae9e2fd76de5920

                    SHA1

                    fd312dee422bdae43cfd9beec596e2e1a806efe4

                    SHA256

                    2b743aac00d054e7c041200c88950305035c70da3d415c05eeb7844b040d93ce

                    SHA512

                    52db56608282ff6d18c380710a1d495c45f1c4cd0ed224abbd58a77ded237f347fec96401036b6510fba0735d65721799c65d070436b919bf92b07dc2ff05dfe

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\arm64\adgnetworkwfpdrv.sys
                    Filesize

                    88KB

                    MD5

                    7d26090469f422f0dab254be116f1917

                    SHA1

                    55943137295bb8a9400ac73f5dadd648df6fe155

                    SHA256

                    4d3d8984523fafd3aa4ba35b9eeb348ea5a6b284b54e92a03e608dc17f71f44d

                    SHA512

                    8bd3b4a3ab71a2b22b7ce268605f739a76a12ae2976cce76a81279746890c39a281cf2aa98840178520056924c30d145374402b9a5f4a219eb978f9ccb0a9f1e

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys
                    Filesize

                    68KB

                    MD5

                    4a83e369a535895500cef8f099cc1818

                    SHA1

                    4d5697c783f877f823f03e6b77e1a07f79e17b9c

                    SHA256

                    2458d32c657b52a79703c26db4ee0503164ea4b764580c67492bfbbb9522596b

                    SHA512

                    956932d81026d1648d2adccb3a2ffbdd7a6ac14f1642e154dae98218c4fe500fd9d729fb5c0b96a51d49a711560ee7bfaabf610af562e7f2d4701c63935dc4e3

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworkwfpdrv.sys
                    Filesize

                    87KB

                    MD5

                    73210a1c72d9946fd168c961c2d0916e

                    SHA1

                    ab848f3bbac8334275c8093e30b561fd71c46ccc

                    SHA256

                    274b4429872e302bd0672a52b8b8d43b3cf497d288af57d851ef02c2defc9586

                    SHA512

                    a3acbd11d5c3d132bf968ce75842a456bde3bacdd39a2d60ccf0513d00ab5b8d62d86346b68dd89eb42b87240e18825fa74b68e1eb0d6dda35c09ed995cdcfb9

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworktdidrv.sys
                    Filesize

                    62KB

                    MD5

                    a216964ab28f54e9ec12f73207c1fe91

                    SHA1

                    a8b9a3049233c1603ca7b71ca1ac442de13e1436

                    SHA256

                    ec8d1f0035069d6552b3a12aee85c2307a10c94c4769d4ddd4868e9e10b33afc

                    SHA512

                    6c806ffc7ae23c1818539257576e711ef0296ca1d0a132da0fc77145dab43c33a41cf54bd58abf9fa1135335c00596e8cff4a0f31231986230a14d93029f26f8

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys
                    Filesize

                    75KB

                    MD5

                    2f5b7ce78c3a9d47f2f288051fc57e36

                    SHA1

                    b59bad8ac2762e1d473c5fc75a2bf6c6936c9c72

                    SHA256

                    2635b3ee42749a58138347ac577b59240047513166876c2b9ff5fac25f184652

                    SHA512

                    05b98b2d45d3654865aba3a99717dc8a3a35b1b7c510beaa085bb4a4eb39caa5dde973883bd0a3b92e61c86cc1d5a0a286375b73f8a6c70af9823160289424c6

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetLib.dll
                    Filesize

                    200KB

                    MD5

                    7ec3d16685f1a49e0ea7ffa4536d239d

                    SHA1

                    1603e6b9e9910accfc35dc711792581bf6468854

                    SHA256

                    a8acc0c9798946de909555f143f99c4a20bffdc1d0affa30addac4e902c72f74

                    SHA512

                    327ed37c214c1ff5afa8159e21f9aad83fcc3ff28c3246a0da16bc824c77002bccc7a6483a8e06fd1e8333514c71525ea84e94d56e9fdf0ee5b44d8e44d3d2e3

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    Filesize

                    134KB

                    MD5

                    ce1898aaefa0685319b0b1ce9edeb355

                    SHA1

                    280d1ab8788faf7bc1326567c95b84bb741d8395

                    SHA256

                    15d7010351178309baf929953b404c53284f7c3a5dd1b6e336db52a278c6d58f

                    SHA512

                    15d4d32e1043a6f1152d6a13cc37e11ceab98aaf362b47b68f35e0d3e8a90d295977fbf74524e89c3619e966b8b6be66b614c91b6ac94a83f7a978dd5786abf1

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\adgnetworktdidrv.sys
                    Filesize

                    68KB

                    MD5

                    a766442b6595bf4c242684d7a285ef84

                    SHA1

                    07e35acad189c43a9a3dedc66853e06541a9e73c

                    SHA256

                    6c0a27448725c857de552b84642670481d2fe5c3fd7cf5533cc67146d60f1669

                    SHA512

                    174613c8296f5aa5c01daf94f9b3346eb14d854630a0bd1c40ce9e86d2dfb90c8ad64cf340fff1e31c8df985837915dcdf28af312ea2a72b91881cb47d569c95

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\adgnetworkwfpdrv.sys
                    Filesize

                    112KB

                    MD5

                    0f54c2c61c86f31ff652c457886eaf39

                    SHA1

                    fdeeab13d5faaa008d11cba4b9114d2192363585

                    SHA256

                    fd7855f73f30f12042ea28e6502c723fc8c7e108844dcd48239f952eb59fdfb1

                    SHA512

                    f238e216c397e017605af51c6966aadd5843207924e4089d6280ea7491c388176fadce11db4987f47cc6e53329026bc58f10ddd3a6645fbd84860a559e9fcafe

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\AdguardNetLib.dll
                    Filesize

                    164KB

                    MD5

                    9ca27a976342edfd9ea1381a7802b8b6

                    SHA1

                    87a55f2524ccea1d7b6ab89236aa506d6a2a455e

                    SHA256

                    560cf2a72005278f373cf09196198c31967ab506b1f194414a7293a29bb1805e

                    SHA512

                    9d59b1842b5f522a68a5f4e6d8a9f81de49c631c6667f18a98774011dc1644038cfbeb78ef51a3f68e5bc67a66592c83f70aa17079812e375bf87aabe6416a9c

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\AdguardNetReg.exe
                    Filesize

                    114KB

                    MD5

                    cf841c8ac4724a43295b6d857639b4a7

                    SHA1

                    abd6b869e5074271eecd88e1cbbd8e852f91fadf

                    SHA256

                    800642e9cc36cfc4ccc8e985320b0730efea8d8a5c1489980eb4e07f7349af28

                    SHA512

                    a623b08c1ca9632963668bf3bbcedcfb4be9b8f4ad0c615260bc5a68f2b4db82c584bab381bd0bcfc30b43fc903f0cdd8c46030060276bc3adfaff97fde3b11b

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\adgnetworktdidrv.sys
                    Filesize

                    62KB

                    MD5

                    9c5bc33aaa22573400a055cedf321b5f

                    SHA1

                    45e242506c6990b1f51d8430833c29481ebac468

                    SHA256

                    ae056708a1c7d93c08c52bcd108f26e610373f882943a87be98aea96b3db4809

                    SHA512

                    940920b7d1cec62c827d821c91324fcf78ade1ad42db4c3c46773a22ed156d8191c42c4ca89621a14c14e3dd7e36a2be9871ad22ba178ef9c018f6d733e3b6e0

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\adgnetworkwfpdrv.sys
                    Filesize

                    105KB

                    MD5

                    5e969448b7f189719cc1d37e85f0f6a3

                    SHA1

                    38efabdbe17c63ea0511b7fdc395eda531f15018

                    SHA256

                    ebc648139bcd1847befdd7f059c407a7d70b00d33def0218077ae660c9329f26

                    SHA512

                    c819ab1cf11f6c1ebc85546de5a013d2b0e9b6ee382b5afae8dd9d8b01be32ccbda8f5ef6afa37957cd5251a7182573cebfc30bf704b47388258b9881170160b

                    Download Submit

                  • C:\ProgramData\Adguard\Backups\user_S-1-5-21-17203666-93769886-2545153620-1000.config
                    Filesize

                    322B

                    MD5

                    b6ea95711f0e237d9de49dd1cc9aee82

                    SHA1

                    3f178836b34480aab8d0b70897f418b2b0d326ba

                    SHA256

                    df0cc242fa69d2e977dca8bafe5c4539171bbb7f5a146397683fdb7be6ebce04

                    SHA512

                    43459d257968d49fbc6060c6ccd63d67ede48515b4b6cdca30c46c67cb6bd75c211bebf44d71ee6eaf56a76d3b0a885271167c6dccaf333598da14a8612b9871

                    Download Submit

                  • C:\ProgramData\Adguard\Core\sfbr.db
                    Filesize

                    44KB

                    MD5

                    84b7679ab9ca3356d6e760deacb99360

                    SHA1

                    1fb57f42c2c4a669c808255460b6ece3a5a64ad5

                    SHA256

                    7f75536c9907bde92890ba00772756b632b1ed6f10088ce02eba0535671eaad4

                    SHA512

                    223c8d9070c9dc3c23493d928542b220d59ed22f9eb9be0cd6ca3e7fb833c27cd51aa5f582f4194bd21d34e97383751b5012c96a934e7c2bc916064658422d2c

                    Download Submit

                  • C:\ProgramData\Adguard\DnsFilters\cfaa363a7013473fb8f4c6ab0b06f63a\dns_filter_15.txt
                    Filesize

                    1.3MB

                    MD5

                    944e57aa00fdd46c02cc108ada88a667

                    SHA1

                    b3f61ac3314076e904d34005a677b0a9173a13d6

                    SHA256

                    fd2645cb2b1b9aeee70df96f4096942a39025fcfb04746fbec4242b29368f378

                    SHA512

                    9791671dd0071b8de744827eabfed19cf370e249fecd2e21479a14c2ecc1f1d6643a6d85c8b00b3a92fa1b34b8e20405b3f1ed30692a059200730a76bf15defd

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.0MB

                    MD5

                    0eafefa408e7de8709c46993a0151c4c

                    SHA1

                    71a5ff1eadbba067f95b3f13400e46a6d9bba95a

                    SHA256

                    4ad66dab458119d670fc477516a84f441a4113ef790ea928c4044bc2f1736990

                    SHA512

                    a99719d6856f9e266e39df834805e5d2e7969f6b424d73dceea058f5cb71f0424eb0c28afc1e155ec03cd08380d83cdb23161c9d890556b093ae0a5f15f230cd

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    fe7f5c643ad21b02ca4ddf722c96b559

                    SHA1

                    7f920f572662ac01daedf63c464d88975b0bf267

                    SHA256

                    8783d73bc261a33e107c0c2a62dc3406df93e03f1f883ab59fedd11415302af2

                    SHA512

                    57efca1ac9d05a1364e42d44ebfe5bb552456306b527c95d09243b4d2372a770cb62515af0c255ac437af9584791dd30d65543eb77bdecda187c3a4fdffc38b9

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    896514b85da04db295138f50faac6c02

                    SHA1

                    37e0d8c0b13a53df5013f01283ce1f57181db57d

                    SHA256

                    f48df72691a23d76ce4db2c72084586c3e88382582bfe2ae0acc9016fb246b37

                    SHA512

                    1c14da5622c54d638665757fe75ba7561ffe9393906b344663c1335aa3b320fbab45128de68cb01c5e9ad989b3c276ead0cf5e5b3a1532919802e3896a4a499b

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    d0043ec3d4782be4b1907551d71e8fc4

                    SHA1

                    59d820a10a52dc799553c4ce275965bac72b7472

                    SHA256

                    606ac693959c438c176c7247875d136dcd0834ccbddbaaec3aec591abcd878ff

                    SHA512

                    7a55b8a189fd0be3402dca76ef5040949a333d1ce98feb83b36222aba459e88bf25f4db620bfecd5590056edbc539e00a0372d0c01f87006b06116a128b3ef2d

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    f915bff21c2a01c466d5499d54e721c2

                    SHA1

                    8beaa4b6379dd0329cf61a531f1e02f06186b025

                    SHA256

                    6dfa35fa1d8241f2ef5e8bd679843362493699b02a405c55430ef2d15bb58989

                    SHA512

                    e40475f5320ea4a66a70d62880728bb7f627dd903c50ea739cd010a36675d59ff6b9223738a631ab0318303be5f9ea50d3b1bc67c89f28d1e40a8624ed9c2a30

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    e1b6d421601475ba424a4cc6440c0da9

                    SHA1

                    4cf8f17accbe4c606c9a0b729029235ed1ae4b5b

                    SHA256

                    c95db940da98264d1ce0fc955611e11bfeab6e8228fc3315ac568de1db01eb0c

                    SHA512

                    f9a5f0474c3c5d2cf3956cd37e4a44d0e1685c6077326bfe10ad3db7cf2228ead7c998bda5ae10667dcf7aced7d03763d9d1a685a93ca62d302c8e859e041997

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    a45648bf1e1aad1c30d368672a8b0760

                    SHA1

                    a1780f288e977b454246406af78a26fedda79f4c

                    SHA256

                    6fb5857a2d41d8ebd7c4ad028d9a6e1d569ed0384804059fadf36b285ba0c267

                    SHA512

                    8b0c74b6d098f1fe654f45d8fe83f3543c0fc51bd010bfdee741f28b2827f6a17971bd367767ddce34a58ac40f6edd09f99dc0c97a201ccde4d90aa03f1a3cb1

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    35e0da1a73955d248008dc23834d5265

                    SHA1

                    0fcc37d4126eeeab34312246b58cf4db5632d531

                    SHA256

                    2dd4a60954db860d62376eae01ff558d095758c4f9225eb9e5266a12554e0328

                    SHA512

                    18b08dc69c5550e1b2881e9276ce864eb27751adc80f29bb30636f45722de7d7bf458214847fd77a5f0d899478f3c0f125ecc8ee3e0690726780d9306d2fe5c7

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    c4b3020d338a0e56b22d9d735eef0bea

                    SHA1

                    cdc67387916d93ecb38c7ef389c2a08f50e4e8ea

                    SHA256

                    c20f9330326513d327ec4e2b2c5a5be4a4f54464ae332312ee2f8649c3a61a07

                    SHA512

                    07169db51945ca88c489334ed77293429d4d49d48cd8aaa64ef2259e8da2b895c65876daa600a23b9626f2db57d0f6d7a55e9f7c529ff97e86885a3938f5ddae

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    52c408aa53f0cc6476ceeb5fe76362b3

                    SHA1

                    7b97e8840e43559e0a8ca89aa469836039379f16

                    SHA256

                    d12a35531d8162f45a983fb1fe5eddaef58a41506dbe5aafb10362fd26772196

                    SHA512

                    58ea79e82a1c19253440040088ec78fb9770c2660d187033e6fd2a8bcf43b4b81d89e6dd2a1b51a8ad01086ecdb1652577453da0992e0877d58af50f75c7ebba

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    27.3MB

                    MD5

                    9956c785dfefeb8d471db1a7cbdaa5ff

                    SHA1

                    0d0b7888389df033e29999c64d1ffb3efa705c5b

                    SHA256

                    4ef59d623293a00cb87a4a53419491d7b557c21ea0a241886fedf4c1de321a1b

                    SHA512

                    7211988120206b886ca285a3a6132f879e99028e3174022200273cfcfc34bba03d74ca9a59c3ae0046de8100e7b18498db8dafdeef663b5feb552be111931340

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    8KB

                    MD5

                    fe08f91005abddd75cb2d3c35bb02918

                    SHA1

                    5e13771120fb9cfbcf7f04eda42a86705499782e

                    SHA256

                    30f794f55ac9374fbaddd4c98cba6987edc65493e93dd824e38211a36a1a23ee

                    SHA512

                    441d64e9a16d9177d1db7d0a89c41f0255c9ec2c4d40503f5e874ec2a5165578fa2a454e8e1585419c8d637a57f9f8513b34793ce0f33f13393d60b6b3d75ea0

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    16KB

                    MD5

                    5bd550f60d394babe481ad520973be5f

                    SHA1

                    09636251c32d55ef8e2536fcf65f4a309a48a52b

                    SHA256

                    c3cb870d5699a95e8e2a1d824c28a27af15a77af736379463e897b18b94184cb

                    SHA512

                    e1df471faae794520c8200ed7cec68527559a15ebeb71da20e0b95fe59065d6631dfb2f1c9e0a8b4edfaab7ed7f78fab4d58d4d64f4d8c961d1fb9150b72fd6d

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    16KB

                    MD5

                    c3fc8b0445af1425fe319fe241a3f6d5

                    SHA1

                    997617c45ffb21fccedec777abd40ab8736eb673

                    SHA256

                    f2805deb39d830d0d212d7f80cf3116b63d2a07ae63d93fe3425b1c0ff392072

                    SHA512

                    02e8270473d14429ce55cdf995580b87aaa8ac00425accc6641a7b2ec400a10da00496dbec3fc54ae512c2fd22b22c09bdce8f39d4eba160d41819e2286f12a4

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.0MB

                    MD5

                    5b808f459237b2332e77b4896726bd98

                    SHA1

                    7dc64a474a6227e2c8b9baf8caf3bb090552804c

                    SHA256

                    a96d298d7133caf32c414a86d48b3718e14729e6a787881b8ff932cf238208db

                    SHA512

                    f58d8f28d64aedf915a81f5665d8660077dbec034adc5ea0d3b79be27570a4a18648ad4f5c86aefaa90e36a76400379267f224005b90ccc047857705be99fa3d

                    Download Submit

                  • C:\ProgramData\Microsoft\Windows\Caches\{2843ADA2-0F67-4F78-92E2-B7A4AB26A670}.2.ver0x0000000000000002.db
                    Filesize

                    44KB

                    MD5

                    46f91e01ff5af187259af4391a2f4932

                    SHA1

                    845106a45c9b80c4d3062d9c1cdba61c83a36a13

                    SHA256

                    a4f5991c1c100313429065f2cbf2ca057bbbd443c50762ea6b4a97a82169b4ca

                    SHA512

                    9e564c94349e5cea31d53faa6fbb2022af6f1b7aa96353707e0e873c94ce4f03c125a6bf81b6908404af0ed47cce8a52a35ad82912e82851b46e2a60a3f62308

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config
                    Filesize

                    1KB

                    MD5

                    1543a151c570c3fd0b6fa8ad13ca53c5

                    SHA1

                    6f0a295ab64a7d46a4676b583ef5268480cafb7e

                    SHA256

                    fc8ad8662e39f99604a2cf9eec0e04520172a5b17207a212fbc280373eaa2b58

                    SHA512

                    3cc2f55ecc8b71d3a7acc1662de98e0c61824d563dbc051716914d07553cd1198ced7c6d3523f3b9b3146f11ff347caff56be8455ba5dd5b3fb4be10bd2a1487

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config
                    Filesize

                    1KB

                    MD5

                    92ef2b438ca5bf0a36a11165102af092

                    SHA1

                    1b9409047b80ceba51b18ff1b08fed068e0a4c7c

                    SHA256

                    0854f1df92d97e676fe753e90c97513482ea9976a072bbcf73fb7e8c4a387784

                    SHA512

                    6de4749de0a34674fb6e10a5d5922073e05c52bf08ca9a358c48c3f9acb403029309be1dd8fb8029a762255dbb00ad2927667866855b39ff5b013c2c9126c9da

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
                    Filesize

                    651B

                    MD5

                    00bfeb783aeff425ce898d55718d506d

                    SHA1

                    aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f

                    SHA256

                    d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580

                    SHA512

                    2209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Adguard\Adguard_20240506164836_000_Msi64BitPackage.log
                    Filesize

                    1KB

                    MD5

                    34c1abfb25ff4cb3c4d65fd3eb43a266

                    SHA1

                    6bf180b5116e829525864805754513205d47b750

                    SHA256

                    4ca4d0e35ec32639b2174969c10d680060f2c0364b7dcd6b7f57f37813281a97

                    SHA512

                    8fc54ff59ac68d3c01d1c39d265d29e194b59422dbe1d7e8fbadf2a94662dab9f26883c42e206395575236f45fff4abc21da3e4b205f245f03bbc3e0a6efd607

                    Download Submit

                  • C:\Windows\Installer\MSID002.tmp
                    Filesize

                    693KB

                    MD5

                    52159f784cc0f57bddf39a17857a8ac2

                    SHA1

                    0788b586b3210cf004c827d396d8ccd851472ee4

                    SHA256

                    4fb676db4f1de07697fe85568bcb6c1cd79c079a818add24cd15cc81ed29f20a

                    SHA512

                    208911765072ca824613e3b65658b23f553c82390b8296f8aff7e07f702cd431cb6fdee7067f13525b85bf582062dea077be2e4f27e12d00bae3b0b244471201

                    Download Submit

                  • C:\Windows\Installer\MSID002.tmp-\Adguard.CustomActions.dll
                    Filesize

                    475KB

                    MD5

                    b3259d1ef57ca51f12a28cd7cb5a03a3

                    SHA1

                    a127b32a20540678be8554ddc53017e7df25f314

                    SHA256

                    59e6e20cf85d317b5abd18078e5a551b21c56ca18e20fe1e45759bd3038482e7

                    SHA512

                    1d8bfd6ad0c90b7278803f51c9c1bbeb429fe448779ef9abffb7758a8fcd6db704ae71a1af65da64b6c712b32c8af54884c3a77ef13b337f499c91e097114834

                    Download Submit

                  • C:\Windows\Installer\MSIE62B.tmp-\CustomAction.config
                    Filesize

                    228B

                    MD5

                    d044d23e8084c869cbdae714ba47b866

                    SHA1

                    40d25b0fec3e43b7d966d02928d60904e32bd84a

                    SHA256

                    f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd

                    SHA512

                    62d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9

                    Download Submit

                  • C:\Windows\Installer\MSIE62B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                    Filesize

                    179KB

                    MD5

                    1a5caea6734fdd07caa514c3f3fb75da

                    SHA1

                    f070ac0d91bd337d7952abd1ddf19a737b94510c

                    SHA256

                    cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                    SHA512

                    a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                    Download Submit

                  • C:\Windows\Installer\MSIF0DB.tmp
                    Filesize

                    211KB

                    MD5

                    a3ae5d86ecf38db9427359ea37a5f646

                    SHA1

                    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                    SHA256

                    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                    SHA512

                    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                    Download Submit

                  • C:\Windows\Installer\MSIF235.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll
                    Filesize

                    32KB

                    MD5

                    82deb78891f430007e871a35ce28fac4

                    SHA1

                    4e490d7ec139a6cde53e3932d3122a48aa379904

                    SHA256

                    2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237

                    SHA512

                    e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a

                    Download Submit

                  • C:\Windows\Installer\MSIF311.tmp
                    Filesize

                    127KB

                    MD5

                    93394d2866590fb66759f5f0263453f2

                    SHA1

                    2f0903d4b21a0231add1b4cd02e25c7c4974da84

                    SHA256

                    5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

                    SHA512

                    f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

                    Download Submit

                  • C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe
                    Filesize

                    384KB

                    MD5

                    e1769fd831d70274d0183e3e68994684

                    SHA1

                    5db7df3a9a0cf3489272ed99d8cdf6105dc9a620

                    SHA256

                    f6558d3f7c36fea39912c10e20d878244a079594a01173dd31918043b250f681

                    SHA512

                    504f28d6ff9e72a6662500b192b0263735662c65adae507c65881bef865092f29473af576ce286a30a061a08a2098c078726ce8f6f8c932331fcb52317d76649

                    Download Submit

                  • C:\Windows\System32\drivers\vwifikerneldrv.sys
                    Filesize

                    258B

                    MD5

                    23c617d1ab157123589f30f0f45a8d2d

                    SHA1

                    40ccc822c4c6addd0f1d5fe7c05dfaf961b691f3

                    SHA256

                    dbbabcead8d4e5eec2813a806bf3b548abcd476144f106aef5eedb278f14b651

                    SHA512

                    b5783ff0c92b1703678d40f2742ab93c797faa463bd784b77ca087aef76dfccaea71d659a58637bd904e085ea0f19bdc35d6a9fabfba349948c73cc18c421542

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\AdGuard.Utils.Base.dll
                    Filesize

                    879KB

                    MD5

                    39b2236a3c083292a14f65585ad73e28

                    SHA1

                    012a24cc5993cbc33ebace8cace1c1dae1e899c3

                    SHA256

                    4b930935f4a6ecf9908c9c50f969c5daea41c3de2bd6540cd6f220fd83bffe8d

                    SHA512

                    d3b2f971fc856e3927603334ed428658000b4228776039c4c1c0c9811551209073873aea7130ae46dde2971f694d7fedd2a37dafd5ba325a7d0db24a8451f889

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\AdGuard.Utils.Installer.dll
                    Filesize

                    55KB

                    MD5

                    abd2f4a5cfa8a9608fb14e3fbf44871f

                    SHA1

                    b5249f54a6a73c27bcbbdc07fb6c86d9745be35f

                    SHA256

                    06c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5

                    SHA512

                    7dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\AdGuard.Utils.UI.dll
                    Filesize

                    621KB

                    MD5

                    ec3d9350a9a400fb3271c7327f5bf5a8

                    SHA1

                    0eea26f71e7d03579303b9ffc34549fa7ac843e9

                    SHA256

                    aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4

                    SHA512

                    a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\AdGuard.Utils.dll
                    Filesize

                    1.8MB

                    MD5

                    1f79f405d3659eb62779f948a397967d

                    SHA1

                    c01403d8ae03c41726f9f5d72f1b79dc3e96191b

                    SHA256

                    b262d6ab962e2dfd034e63df34ad8aed15f1caf1ac1b1259facba9535fca71e4

                    SHA512

                    b5a397b6f62ee5c7c2dae0cebcd509127200deb5f651eb5d850a2e9182a5eea67925e96df0e3b1ba9cb0f17a4ad78e29833ed3baf22e5e9ec07ff06d47d64ced

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\Adguard.Burn.dll
                    Filesize

                    279KB

                    MD5

                    96010203c9ad85132c021ce2d86536f9

                    SHA1

                    6db1c233ae2e5ab52798a027a597601c43a02715

                    SHA256

                    8215daa9d609cf32d2b2344eb33d7cb612fa91fc2e1210929fd64b5eca6b1b85

                    SHA512

                    ee4132abc306e60c1c29707bace7747128cc8f8f71bb3dc86407817dfa71e624e173b597a8da35a5f908095219e8d184cf040a62995aff988a12ecfa14d302cd

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\BootstrapperCore.config
                    Filesize

                    1KB

                    MD5

                    898c2a320bea0580f37beeccda8f2378

                    SHA1

                    eccab214a148e6a7a9535bf1c83b714c756dabf2

                    SHA256

                    4440270efc95c694150a665b62ca89b8b93b1271dfb2757e8dd1a68ef2705498

                    SHA512

                    e4608aab984c6e97b00e80d2635a283392f1eb24bdb65f5fce92851eb63ad474e5050ac46e5cafe2dbd438dd026269253bd4ec427f08b2a09788d6b1d49bcc84

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\BootstrapperCore.dll
                    Filesize

                    87KB

                    MD5

                    b0d10a2a622a322788780e7a3cbb85f3

                    SHA1

                    04d90b16fa7b47a545c1133d5c0ca9e490f54633

                    SHA256

                    f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

                    SHA512

                    62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\Newtonsoft.Json.dll
                    Filesize

                    647KB

                    MD5

                    5afda7c7d4f7085e744c2e7599279db3

                    SHA1

                    3a833eb7c6be203f16799d7b7ccd8b8c9d439261

                    SHA256

                    f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

                    SHA512

                    7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\SharpRaven.dll
                    Filesize

                    114KB

                    MD5

                    89a2762f19597b82d5c501366e5b2f29

                    SHA1

                    f5df7962015164e4bfed0ae361f988c1e581677e

                    SHA256

                    a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167

                    SHA512

                    bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\.ba\mbahost.dll
                    Filesize

                    119KB

                    MD5

                    c59832217903ce88793a6c40888e3cae

                    SHA1

                    6d9facabf41dcf53281897764d467696780623b8

                    SHA256

                    9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

                    SHA512

                    1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

                    Download Submit

                  • C:\Windows\Temp\{262170E6-089A-4BB6-9D6A-D16158347EDB}\Msi64BitPackage
                    Filesize

                    41.4MB

                    MD5

                    d7677284befc5f541d560e631a0861ad

                    SHA1

                    bbed67a5a597df83cf3d2a7ca7c26716571cb87f

                    SHA256

                    eaf4cc8809c1ad671e63b8c4bae50eda8924e23e507df272a0f0f6fad4d23cf8

                    SHA512

                    0fd95dcb5efffbc06c3b21e60ad9c4112cc59aa462e20067ab4f19843ee46f3ea6e7e9a5af3b8e49f9cf93df6b8e3819450c0b6724d049c04be7ee4189b76fd2

                    Download Submit

                  • C:\Windows\Temp\{55A8A3B6-0F1E-404A-9ED5-352D71ED983F}\.cr\setup.exe
                    Filesize

                    3.1MB

                    MD5

                    b25f06e4ed0166ac822e48068e334b00

                    SHA1

                    5f44162e567a979323a1b734e651b60affaad674

                    SHA256

                    a66066c6fbaabee2011956619a0bdf3606b40f4eddedecabb82bb321ceeb2f72

                    SHA512

                    03280db188f38387d7d11073f36caf9ed05fd266b3d155b4bf0ba4ac1bccce422d552ccc39465e2b5ff0996b0a24904304d6f5b269f3e38432cc73235fface50

                    Download Submit

                  • memory/536-5-0x0000000000630000-0x0000000000657000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/536-11-0x0000000000630000-0x0000000000657000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/844-752-0x0000020A080B0000-0x0000020A08196000-memory.dmp

                    Filesize

                    920KB

                    Download

                  • memory/1116-197-0x0000023376230000-0x00000233762AC000-memory.dmp

                    Filesize

                    496KB

                    Download

                  • memory/1116-193-0x000002335DC70000-0x000002335DC9E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/2212-1581-0x00000287259B0000-0x0000028725A74000-memory.dmp

                    Filesize

                    784KB

                    Download

                  • memory/2896-138-0x0000000007C10000-0x0000000007C32000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/2896-135-0x0000000007EE0000-0x0000000007F88000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/2896-99-0x0000000003CB0000-0x0000000003CC8000-memory.dmp

                    Filesize

                    96KB

                    Download

                  • memory/2896-106-0x0000000007060000-0x00000000070AC000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/2896-110-0x0000000004D00000-0x0000000004D12000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/2896-114-0x00000000073D0000-0x00000000074B0000-memory.dmp

                    Filesize

                    896KB

                    Download

                  • memory/2896-120-0x0000000007690000-0x000000000772E000-memory.dmp

                    Filesize

                    632KB

                    Download

                  • memory/2896-124-0x0000000007910000-0x0000000007AD4000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/2896-146-0x000000000C650000-0x000000000C688000-memory.dmp

                    Filesize

                    224KB

                    Download

                  • memory/2896-145-0x000000000CD20000-0x000000000CD60000-memory.dmp

                    Filesize

                    256KB

                    Download

                  • memory/2896-130-0x0000000007650000-0x000000000766E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2896-147-0x000000000C620000-0x000000000C62E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/2896-139-0x0000000007F90000-0x00000000082E4000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/2896-144-0x000000000CCD0000-0x000000000CCD8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/3244-712-0x000001DDFF050000-0x000001DDFF06E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/3244-710-0x000001DDFF190000-0x000001DDFF206000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/3396-1694-0x000001E1EFE90000-0x000001E1EFEA0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/3396-1693-0x000001E1EFB70000-0x000001E1EFB78000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/3396-1692-0x000001E1EFB60000-0x000001E1EFB6A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/3396-1691-0x000001E1EFAD0000-0x000001E1EFB32000-memory.dmp

                    Filesize

                    392KB

                    Download

                  • memory/3396-1687-0x000001E1EFCC0000-0x000001E1EFD3A000-memory.dmp

                    Filesize

                    488KB

                    Download

                  • memory/3396-1682-0x000001E1EC3F0000-0x000001E1ECACC000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/4092-237-0x000001FCF8670000-0x000001FCF87DA000-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/4576-568-0x000001AECADB0000-0x000001AECAE4E000-memory.dmp

                    Filesize

                    632KB

                    Download

                  • memory/4576-713-0x000001AECABB0000-0x000001AECABCE000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/4576-559-0x000001AECA530000-0x000001AECA596000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/4576-562-0x000001AECB200000-0x000001AECB8DC000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/4576-564-0x000001AECA650000-0x000001AECA6BC000-memory.dmp

                    Filesize

                    432KB

                    Download

                  • memory/4576-1570-0x000001AECB1B0000-0x000001AECB1C2000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/4576-1571-0x000001AECB920000-0x000001AECB95C000-memory.dmp

                    Filesize

                    240KB

                    Download

                  • memory/4576-560-0x000001AECA800000-0x000001AECA9B0000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/4576-565-0x000001AEC97B0000-0x000001AEC983E000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/4576-566-0x000001AECAC10000-0x000001AECACF6000-memory.dmp

                    Filesize

                    920KB

                    Download

                  • memory/4576-563-0x000001AECA720000-0x000001AECA7E4000-memory.dmp

                    Filesize

                    784KB

                    Download

                  • memory/4576-567-0x000001AECAD00000-0x000001AECADA8000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/4576-571-0x000001AECBCC0000-0x000001AECC09A000-memory.dmp

                    Filesize

                    3.9MB

                    Download

                  • memory/4576-736-0x000001AECB070000-0x000001AECB092000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/4576-569-0x000001AECAE50000-0x000001AECAEF8000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/4576-731-0x00007FFBB08F0000-0x00007FFBB0900000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4576-547-0x000001AEC9840000-0x000001AEC98C2000-memory.dmp

                    Filesize

                    520KB

                    Download

                  • memory/4576-730-0x00007FFBB0900000-0x00007FFBB0910000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4576-558-0x000001AECA5C0000-0x000001AECA650000-memory.dmp

                    Filesize

                    576KB

                    Download

                  • memory/4576-561-0x000001AECA9B0000-0x000001AECAB12000-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/4576-557-0x000001AEC9DC0000-0x000001AEC9E82000-memory.dmp

                    Filesize

                    776KB

                    Download

                  • memory/4576-570-0x000001AECA6C0000-0x000001AECA71A000-memory.dmp

                    Filesize

                    360KB

                    Download

                  • memory/4576-556-0x000001AEC9990000-0x000001AEC99F2000-memory.dmp

                    Filesize

                    392KB

                    Download

                  • memory/4576-543-0x000001AEB0600000-0x000001AEB06C8000-memory.dmp

                    Filesize

                    800KB

                    Download

                  • memory/4576-555-0x000001AEC9840000-0x000001AEC98C2000-memory.dmp

                    Filesize

                    520KB

                    Download

                  • memory/4576-544-0x000001AEC97B0000-0x000001AEC983E000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/4576-553-0x000001AEC9E90000-0x000001AEC9F46000-memory.dmp

                    Filesize

                    728KB

                    Download

                  • memory/4576-545-0x000001AEC9AF0000-0x000001AEC9CB4000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/4576-554-0x000001AECA1B0000-0x000001AECA226000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/4576-573-0x000001AEC9920000-0x000001AEC9946000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/4576-552-0x000001AEC9F50000-0x000001AEC9FCA000-memory.dmp

                    Filesize

                    488KB

                    Download

                  • memory/4576-551-0x000001AEC9AF0000-0x000001AEC9CB4000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/4576-572-0x000001AECABD0000-0x000001AECAC0A000-memory.dmp

                    Filesize

                    232KB

                    Download

                  • memory/4576-550-0x000001AEC9E90000-0x000001AEC9F46000-memory.dmp

                    Filesize

                    728KB

                    Download

                  • memory/4576-549-0x000001AECA020000-0x000001AECA1A6000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/4576-548-0x000001AEC9DC0000-0x000001AEC9E82000-memory.dmp

                    Filesize

                    776KB

                    Download

                  • memory/4576-546-0x000001AEC9A00000-0x000001AEC9AE0000-memory.dmp

                    Filesize

                    896KB

                    Download