Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

uTorrent(1).exe

windows10-2004-x64

8

uTorrent(1).exe

windows11-21h2-x64

8

utorrent(1...er.exe

windows10-2004-x64

10

utorrent(1...er.exe

windows11-21h2-x64

10

utorrent(1...nt.exe

windows10-2004-x64

8

utorrent(1...nt.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    129s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/05/2024, 16:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    utorrent(1)/adguardinstaller.exe

  • Size

    142KB

  • MD5

    cd3581d9db9d066b4c08a42df3d6c1ac

  • SHA1

    deb0c2bcc63cd5f8b6e63a00cbf731475045898e

  • SHA256

    17eeb4a4eec555bdcbb1bd52be92d1b766c402e9ebd320fe3134a9f7d349fcb2

  • SHA512

    4218916a98a9c8816e780744dd7ef9679c000fba219ad21f9188c4421bd6afaebedc2d57382b97fb20c7b230e498f61d7ce606713c0a064158237d79563b819d

  • SSDEEP

    3072:K4qZHnMyBV3vChLFvGyfmKvK9MkBrF8wvFx+:K4qZHdV3vevK9MkhRvW

Score
10/10
zgratdiscoverypersistencerat

Malware Config

Signatures

  • Detect ZGRat V1 8 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Drops file in Drivers directory 4 IoCs
  • Manipulates Digital Signatures 1 TTPs 12 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 10 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 54 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\utorrent(1)\adguardinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\utorrent(1)\adguardinstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
      C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe "AID=25774"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Windows\Temp\{EF0741D0-5A4C-46E0-BC5F-DC184F6E4D12}\.cr\setup.exe
        "C:\Windows\Temp\{EF0741D0-5A4C-46E0-BC5F-DC184F6E4D12}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=732 -burn.filehandle.self=728 "AID=25774"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:472
        • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.be\adgSetup.exe
          "C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.be\adgSetup.exe" -q -burn.elevated BurnPipe.{0E8A59AB-BF74-4CE8-A347-3A37032540D2} {EC143B94-3011-4EE5-BC14-4F2615F4A9D0} 472
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:5012
        • C:\Windows\SysWOW64\sc.exe
          "sc" query adgnetworktdidrv
          4⤵
          • Launches sc.exe
          PID:1960
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 57FBBAEF9D0FE842E2524F6D42EC9F7D
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIAF8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240651093 2 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstall
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2660
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI2259.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240657015 14 Adguard.CustomActions!Adguard.CustomActions.CustomActions.PermanentActions
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:3568
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI2B34.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240659265 33 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallInitialize
        3⤵
        • Manipulates Digital Signatures
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:4900
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI2D69.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240659828 59 Adguard.CustomActions!Adguard.CustomActions.CustomActions.CheckServiceStop
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2896
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3408.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240661593 101 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallFinalize
        3⤵
        • Manipulates Digital Signatures
        • Adds Run key to start application
        • Drops file in Windows directory
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Windows\system32\ie4uinit.exe
          "ie4uinit.exe" -show
          4⤵
          • Modifies Installed Components in the registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:2296
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /C "net start "Adguard Service""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\system32\net.exe
            net start "Adguard Service"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3464
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start "Adguard Service"
              6⤵
                PID:2740
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI4B69.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240667500 141 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          PID:1312
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7C40D5371D75660C9FC58F304C9434CD
        2⤵
        • Loads dropped DLL
        PID:2984
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C343B27376E8EA3134A7154557A35EF4 E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:4548
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:232
      • C:\Program Files\AdGuard\AdguardSvc.exe
        "C:\Program Files\AdGuard\AdguardSvc.exe"
        1⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:2880
        • C:\Program Files\AdGuard\Adguard.BrowserExtensionHost.exe
          "Adguard.BrowserExtensionHost.exe" /register
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2336
        • C:\Windows\SysWOW64\cmd.exe
          /c "schtasks /create /xml "C:\Program Files\AdGuard\config-69cd1a658bc742bbb9da0bbea48a7d97.xml" /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /xml "C:\Program Files\AdGuard\config-69cd1a658bc742bbb9da0bbea48a7d97.xml" /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f
            3⤵
            • Creates scheduled task(s)
            PID:4920
        • C:\Windows\SYSTEM32\sc.exe
          "sc" sdshow "Adguard Service"
          2⤵
          • Launches sc.exe
          PID:3044
        • C:\Windows\SYSTEM32\sc.exe
          "sc" sdset "Adguard Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
          2⤵
          • Launches sc.exe
          PID:3748
        • C:\Program Files\AdGuard\Adguard.Tools.exe
          "C:\Program Files\AdGuard\Adguard.Tools.exe" /clean_runouce
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          PID:1136
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C "schtasks /run /tn 69cd1a658bc742bbb9da0bbea48a7d97"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Windows\system32\schtasks.exe
            schtasks /run /tn 69cd1a658bc742bbb9da0bbea48a7d97
            3⤵
              PID:5000
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /C "schtasks /delete /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4228
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f
              3⤵
                PID:3568
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C "ipconfig /flushdns"
              2⤵
                PID:1212
                • C:\Windows\system32\ipconfig.exe
                  ipconfig /flushdns
                  3⤵
                  • Gathers network information
                  PID:2648
              • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1748
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /C "ipconfig /flushdns"
                2⤵
                  PID:632
                  • C:\Windows\system32\ipconfig.exe
                    ipconfig /flushdns
                    3⤵
                    • Gathers network information
                    PID:4904
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /C "ipconfig /flushdns"
                  2⤵
                    PID:1556
                    • C:\Windows\system32\ipconfig.exe
                      ipconfig /flushdns
                      3⤵
                      • Gathers network information
                      PID:1152
                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    "Drivers\x64\AdguardNetReg.exe" -u adgnetworkwfpdrv
                    2⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:3808
                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
                    2⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4960
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /C "ipconfig /flushdns"
                    2⤵
                      PID:1296
                      • C:\Windows\system32\ipconfig.exe
                        ipconfig /flushdns
                        3⤵
                        • Gathers network information
                        PID:2648
                  • C:\Program Files\AdGuard\Adguard.exe
                    "C:\Program Files\AdGuard\Adguard.exe" /nosplash
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:3588

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Config.Msi\e57f918.rbs
                    Filesize

                    358KB

                    MD5

                    20fb669cd9cb7aeec13816d5bcc6d10a

                    SHA1

                    2ebd4368f0ad9d0780ebb52aa5f99312731a9e88

                    SHA256

                    9c4615fc5931d412bed59182f9a165f116b69b441577e732ac1cbf2357d6b1ad

                    SHA512

                    cd33f6399844b5c096f5a89e1bf15a7a8fd8d49fc4179d555161e7f0d3a911109c9e838711fa118e551ca09c4ef4eb8bca45d60ac44bb15a24beb277d33d3272

                    Download Submit

                  • C:\Program Files\AdGuard\Adguard.exe
                    Filesize

                    6.8MB

                    MD5

                    269d75aecda348d7036692d27e09af3c

                    SHA1

                    46a11632f13c8be9bf978bc00493d09f105d216e

                    SHA256

                    aa15aaaaf06cf68387f07435d95a7e738aab868bfa28941703680d1ef6d2c8da

                    SHA512

                    db96e23a546dac5f65ff18c5b2e95b0a2ca93013a49e9281e39496b114748dde20fd79833063950891c75998878b1a80b1115d7e071b3799f2c5cfcfd4280f1d

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm64\AdguardNetLib.dll
                    Filesize

                    192KB

                    MD5

                    7257436b13445d12a54aaf9cbff8f029

                    SHA1

                    45c908ae57133fb87ea77d0aef20ad268b0c721b

                    SHA256

                    374512cb07d70a9ccf2b43affb96ab99fc02dcf07ef70b7b38f0c279b12991ca

                    SHA512

                    69c13443db0b7128099cfaa914018393c043ca96c25764b1be10035bba0db8efeabe2725473b95aef704e9de971462c3e615610188e5479a5067331d6096d764

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm64\AdguardNetReg.exe
                    Filesize

                    127KB

                    MD5

                    0c6bc1676b5e7a48a52a015405925f8f

                    SHA1

                    c8b85daec736ce4217ddcc3a41f9c261ff635053

                    SHA256

                    32826a974608c145b2a2ffc925d5698e179cf08e04bc957aea3293344d9616a3

                    SHA512

                    3f750d99e8b01545afd1261883d5fa6990fd8ecdfabe62564c3e7cc1f423f0e409b6305cba2582f89e439c6690aa6c4f8ba5a71a0d7d0494f29692304dc3b858

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\AdguardNetLib.dll
                    Filesize

                    153KB

                    MD5

                    520658c251bcde9fe6c71fb0f0d20986

                    SHA1

                    db75ddf587c128c315a3ba98e1c96749111a3374

                    SHA256

                    09d7da40bb51e62000ae46cc625490f559c035d6d059bd8657ef8b6d103cab20

                    SHA512

                    2785563612e0c4507256dc260c195919f0072aa730f2d5a842cd59823a5fc1db45303c9dbf6537bbe1e971a8a61cc436c4d6d2a4ad79bb727cc8c6f3835169dc

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe
                    Filesize

                    101KB

                    MD5

                    8e37e56d595056bf58e4840b2e0a6312

                    SHA1

                    5f82d763f0eb83ae16f0a51dd9b64c3f1db8a3f2

                    SHA256

                    3bcd226bf0a6de378ee6ff79e5a2c19260f15f28633174ce23472fbfc8aa331a

                    SHA512

                    f35b6da8d6454f52e8555c001fcf216b6c8d04486c2cd28a59028354be596cd6a4cecfe6f6537070f4ed21cf303849cbc4009ed72540efc84f6fdf5ee19c309a

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys
                    Filesize

                    60KB

                    MD5

                    fcb1f6082b2dd42faae9e2fd76de5920

                    SHA1

                    fd312dee422bdae43cfd9beec596e2e1a806efe4

                    SHA256

                    2b743aac00d054e7c041200c88950305035c70da3d415c05eeb7844b040d93ce

                    SHA512

                    52db56608282ff6d18c380710a1d495c45f1c4cd0ed224abbd58a77ded237f347fec96401036b6510fba0735d65721799c65d070436b919bf92b07dc2ff05dfe

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\arm64\adgnetworkwfpdrv.sys
                    Filesize

                    88KB

                    MD5

                    7d26090469f422f0dab254be116f1917

                    SHA1

                    55943137295bb8a9400ac73f5dadd648df6fe155

                    SHA256

                    4d3d8984523fafd3aa4ba35b9eeb348ea5a6b284b54e92a03e608dc17f71f44d

                    SHA512

                    8bd3b4a3ab71a2b22b7ce268605f739a76a12ae2976cce76a81279746890c39a281cf2aa98840178520056924c30d145374402b9a5f4a219eb978f9ccb0a9f1e

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys
                    Filesize

                    68KB

                    MD5

                    4a83e369a535895500cef8f099cc1818

                    SHA1

                    4d5697c783f877f823f03e6b77e1a07f79e17b9c

                    SHA256

                    2458d32c657b52a79703c26db4ee0503164ea4b764580c67492bfbbb9522596b

                    SHA512

                    956932d81026d1648d2adccb3a2ffbdd7a6ac14f1642e154dae98218c4fe500fd9d729fb5c0b96a51d49a711560ee7bfaabf610af562e7f2d4701c63935dc4e3

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworkwfpdrv.sys
                    Filesize

                    87KB

                    MD5

                    73210a1c72d9946fd168c961c2d0916e

                    SHA1

                    ab848f3bbac8334275c8093e30b561fd71c46ccc

                    SHA256

                    274b4429872e302bd0672a52b8b8d43b3cf497d288af57d851ef02c2defc9586

                    SHA512

                    a3acbd11d5c3d132bf968ce75842a456bde3bacdd39a2d60ccf0513d00ab5b8d62d86346b68dd89eb42b87240e18825fa74b68e1eb0d6dda35c09ed995cdcfb9

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworktdidrv.sys
                    Filesize

                    62KB

                    MD5

                    a216964ab28f54e9ec12f73207c1fe91

                    SHA1

                    a8b9a3049233c1603ca7b71ca1ac442de13e1436

                    SHA256

                    ec8d1f0035069d6552b3a12aee85c2307a10c94c4769d4ddd4868e9e10b33afc

                    SHA512

                    6c806ffc7ae23c1818539257576e711ef0296ca1d0a132da0fc77145dab43c33a41cf54bd58abf9fa1135335c00596e8cff4a0f31231986230a14d93029f26f8

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys
                    Filesize

                    75KB

                    MD5

                    2f5b7ce78c3a9d47f2f288051fc57e36

                    SHA1

                    b59bad8ac2762e1d473c5fc75a2bf6c6936c9c72

                    SHA256

                    2635b3ee42749a58138347ac577b59240047513166876c2b9ff5fac25f184652

                    SHA512

                    05b98b2d45d3654865aba3a99717dc8a3a35b1b7c510beaa085bb4a4eb39caa5dde973883bd0a3b92e61c86cc1d5a0a286375b73f8a6c70af9823160289424c6

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetLib.dll
                    Filesize

                    200KB

                    MD5

                    7ec3d16685f1a49e0ea7ffa4536d239d

                    SHA1

                    1603e6b9e9910accfc35dc711792581bf6468854

                    SHA256

                    a8acc0c9798946de909555f143f99c4a20bffdc1d0affa30addac4e902c72f74

                    SHA512

                    327ed37c214c1ff5afa8159e21f9aad83fcc3ff28c3246a0da16bc824c77002bccc7a6483a8e06fd1e8333514c71525ea84e94d56e9fdf0ee5b44d8e44d3d2e3

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    Filesize

                    134KB

                    MD5

                    ce1898aaefa0685319b0b1ce9edeb355

                    SHA1

                    280d1ab8788faf7bc1326567c95b84bb741d8395

                    SHA256

                    15d7010351178309baf929953b404c53284f7c3a5dd1b6e336db52a278c6d58f

                    SHA512

                    15d4d32e1043a6f1152d6a13cc37e11ceab98aaf362b47b68f35e0d3e8a90d295977fbf74524e89c3619e966b8b6be66b614c91b6ac94a83f7a978dd5786abf1

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\adgnetworktdidrv.sys
                    Filesize

                    68KB

                    MD5

                    a766442b6595bf4c242684d7a285ef84

                    SHA1

                    07e35acad189c43a9a3dedc66853e06541a9e73c

                    SHA256

                    6c0a27448725c857de552b84642670481d2fe5c3fd7cf5533cc67146d60f1669

                    SHA512

                    174613c8296f5aa5c01daf94f9b3346eb14d854630a0bd1c40ce9e86d2dfb90c8ad64cf340fff1e31c8df985837915dcdf28af312ea2a72b91881cb47d569c95

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\adgnetworkwfpdrv.sys
                    Filesize

                    112KB

                    MD5

                    0f54c2c61c86f31ff652c457886eaf39

                    SHA1

                    fdeeab13d5faaa008d11cba4b9114d2192363585

                    SHA256

                    fd7855f73f30f12042ea28e6502c723fc8c7e108844dcd48239f952eb59fdfb1

                    SHA512

                    f238e216c397e017605af51c6966aadd5843207924e4089d6280ea7491c388176fadce11db4987f47cc6e53329026bc58f10ddd3a6645fbd84860a559e9fcafe

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\AdguardNetLib.dll
                    Filesize

                    164KB

                    MD5

                    9ca27a976342edfd9ea1381a7802b8b6

                    SHA1

                    87a55f2524ccea1d7b6ab89236aa506d6a2a455e

                    SHA256

                    560cf2a72005278f373cf09196198c31967ab506b1f194414a7293a29bb1805e

                    SHA512

                    9d59b1842b5f522a68a5f4e6d8a9f81de49c631c6667f18a98774011dc1644038cfbeb78ef51a3f68e5bc67a66592c83f70aa17079812e375bf87aabe6416a9c

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\AdguardNetReg.exe
                    Filesize

                    114KB

                    MD5

                    cf841c8ac4724a43295b6d857639b4a7

                    SHA1

                    abd6b869e5074271eecd88e1cbbd8e852f91fadf

                    SHA256

                    800642e9cc36cfc4ccc8e985320b0730efea8d8a5c1489980eb4e07f7349af28

                    SHA512

                    a623b08c1ca9632963668bf3bbcedcfb4be9b8f4ad0c615260bc5a68f2b4db82c584bab381bd0bcfc30b43fc903f0cdd8c46030060276bc3adfaff97fde3b11b

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\adgnetworktdidrv.sys
                    Filesize

                    62KB

                    MD5

                    9c5bc33aaa22573400a055cedf321b5f

                    SHA1

                    45e242506c6990b1f51d8430833c29481ebac468

                    SHA256

                    ae056708a1c7d93c08c52bcd108f26e610373f882943a87be98aea96b3db4809

                    SHA512

                    940920b7d1cec62c827d821c91324fcf78ade1ad42db4c3c46773a22ed156d8191c42c4ca89621a14c14e3dd7e36a2be9871ad22ba178ef9c018f6d733e3b6e0

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\adgnetworkwfpdrv.sys
                    Filesize

                    105KB

                    MD5

                    5e969448b7f189719cc1d37e85f0f6a3

                    SHA1

                    38efabdbe17c63ea0511b7fdc395eda531f15018

                    SHA256

                    ebc648139bcd1847befdd7f059c407a7d70b00d33def0218077ae660c9329f26

                    SHA512

                    c819ab1cf11f6c1ebc85546de5a013d2b0e9b6ee382b5afae8dd9d8b01be32ccbda8f5ef6afa37957cd5251a7182573cebfc30bf704b47388258b9881170160b

                    Download Submit

                  • C:\ProgramData\Adguard\Backups\user_S-1-5-21-1474490143-3221292397-4168103503-1000.config
                    Filesize

                    322B

                    MD5

                    b6ea95711f0e237d9de49dd1cc9aee82

                    SHA1

                    3f178836b34480aab8d0b70897f418b2b0d326ba

                    SHA256

                    df0cc242fa69d2e977dca8bafe5c4539171bbb7f5a146397683fdb7be6ebce04

                    SHA512

                    43459d257968d49fbc6060c6ccd63d67ede48515b4b6cdca30c46c67cb6bd75c211bebf44d71ee6eaf56a76d3b0a885271167c6dccaf333598da14a8612b9871

                    Download Submit

                  • C:\ProgramData\Adguard\Core\sfbr.db
                    Filesize

                    44KB

                    MD5

                    84b7679ab9ca3356d6e760deacb99360

                    SHA1

                    1fb57f42c2c4a669c808255460b6ece3a5a64ad5

                    SHA256

                    7f75536c9907bde92890ba00772756b632b1ed6f10088ce02eba0535671eaad4

                    SHA512

                    223c8d9070c9dc3c23493d928542b220d59ed22f9eb9be0cd6ca3e7fb833c27cd51aa5f582f4194bd21d34e97383751b5012c96a934e7c2bc916064658422d2c

                    Download Submit

                  • C:\ProgramData\Adguard\DnsFilters\09e64f5f276440b0b034c43d76fce356\dns_filter_15.txt
                    Filesize

                    1.3MB

                    MD5

                    944e57aa00fdd46c02cc108ada88a667

                    SHA1

                    b3f61ac3314076e904d34005a677b0a9173a13d6

                    SHA256

                    fd2645cb2b1b9aeee70df96f4096942a39025fcfb04746fbec4242b29368f378

                    SHA512

                    9791671dd0071b8de744827eabfed19cf370e249fecd2e21479a14c2ecc1f1d6643a6d85c8b00b3a92fa1b34b8e20405b3f1ed30692a059200730a76bf15defd

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    dbb8697f6a680af899ac2819893d4dce

                    SHA1

                    a2d3e20202d678cfbb41fed5ca4f12dd46f76251

                    SHA256

                    7b1e2e65dc1530cde96c249c30b5b62c70a5283a7e80933127036548fbdc5d0c

                    SHA512

                    997e326f93b4a9575c7c1d7eb6f2cb1c591370f11d5e9dd8b3837bb0659e1ddb5dd3511f04a697acc61246709e78507f4ccc4e33d4c5a8d1ca7a7661f0fbd98f

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    f3911cff451f387ac688217091091f05

                    SHA1

                    4f853f369cf35f4d1b6efe8208933176964490d6

                    SHA256

                    5f47d370b1b93fb3a05e838ea820d2a76901d46c357baccd0ba2d88b1b113b9e

                    SHA512

                    0b103f0e15b1c8e671a8ee2eb80538e648ba10e382e8200180278c4c05e11d892438d6bc77807dc83dd1d2ae07720e08dde6633d6627203ab68f80fbf875d3c4

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    a2e93e814107576f2821f51166900bfc

                    SHA1

                    687cc9ed2e3c5176d8f8996d6b00f952a39a746c

                    SHA256

                    4133fba8ad95da03cb2ecd8602a91ff7f3828134621d8c0805163ab6902ca410

                    SHA512

                    708151f529b8eb0ded89da0b03bb9547e458bd366db5b4235150e078253294cf9b2f365248066bb5aae621842ffaa1cbc319dc22d353f131939c62c7a9bc57a2

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    d3575ee4ec23e7fe7b2f708a0ad2c2ff

                    SHA1

                    8d3d4f1c648563b649a3e9ef9e15d4fad1f9e377

                    SHA256

                    9897599db710206fff7d4a8830b03f5506d21bc3fcee85e10348065a87c52b6d

                    SHA512

                    93cf33de8675619c6a3f3499a90f6d026f890f5ede37bd0d2cd2e5f59ef28085f8ee85a2b09224d2caf292908051a780d05ae651c7b51cbee19a9c99cf2cfd59

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    a49a457343dd6c959f498bb1f8d17add

                    SHA1

                    6b4f35a83e644a81e85e5d17a9ee23768b1912e9

                    SHA256

                    28b8fce653a731555d6c832fb8a31fb700a77c7639b6fcde079df7e46a453e72

                    SHA512

                    fef4f3ec7f03386c20966fa7db35aee2d7fa53f19b13df2861f3313f7e183b563a8530112a33d9accbdb8938051b486571ee1ee04648ed50157ef70e088de6ed

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    aa9010e1442fe7c2046d976928223ce9

                    SHA1

                    5e8521c98c95df893991f5989372ee763c19ad06

                    SHA256

                    219b337b3065b2a525cbd1225e2126e8cc58afd3b7e14cc73e0f717a36bfa341

                    SHA512

                    2cfef9afb1101bbda8670dc030476a9b4c9c9f3ee118a9fa834da9dcfe094822ca4d2fb43626d5ed4ad2d2d265a78754582854ad24b5c02767742db1919cca93

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    27.3MB

                    MD5

                    3c8a8849d24e184712efeab67b9f47ea

                    SHA1

                    7fa7bdb396352233cdba739cf24e15652bd63327

                    SHA256

                    4cd0325da9804ce27dcd9e4715a7d77d3441d4d3f16a5d293e8c28c29852d552

                    SHA512

                    53382fe879c95461ae686ae3137173dac20f8c3af63a6c08df4faf3088322a030c653d33738b68fa37051b8dbc30e287794e833f3a5fdb583ff99af75ec3b915

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    8KB

                    MD5

                    fe08f91005abddd75cb2d3c35bb02918

                    SHA1

                    5e13771120fb9cfbcf7f04eda42a86705499782e

                    SHA256

                    30f794f55ac9374fbaddd4c98cba6987edc65493e93dd824e38211a36a1a23ee

                    SHA512

                    441d64e9a16d9177d1db7d0a89c41f0255c9ec2c4d40503f5e874ec2a5165578fa2a454e8e1585419c8d637a57f9f8513b34793ce0f33f13393d60b6b3d75ea0

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    16KB

                    MD5

                    5bd550f60d394babe481ad520973be5f

                    SHA1

                    09636251c32d55ef8e2536fcf65f4a309a48a52b

                    SHA256

                    c3cb870d5699a95e8e2a1d824c28a27af15a77af736379463e897b18b94184cb

                    SHA512

                    e1df471faae794520c8200ed7cec68527559a15ebeb71da20e0b95fe59065d6631dfb2f1c9e0a8b4edfaab7ed7f78fab4d58d4d64f4d8c961d1fb9150b72fd6d

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    16KB

                    MD5

                    c3fc8b0445af1425fe319fe241a3f6d5

                    SHA1

                    997617c45ffb21fccedec777abd40ab8736eb673

                    SHA256

                    f2805deb39d830d0d212d7f80cf3116b63d2a07ae63d93fe3425b1c0ff392072

                    SHA512

                    02e8270473d14429ce55cdf995580b87aaa8ac00425accc6641a7b2ec400a10da00496dbec3fc54ae512c2fd22b22c09bdce8f39d4eba160d41819e2286f12a4

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    30d39be0d98134dcefe8149ba8dbc729

                    SHA1

                    4ad8507a77d5bc445fe85329290dcc0e57a81483

                    SHA256

                    853d9941f85e7c3c2a5b757c785ecb8f1f1a0243b3127e915ecfce4ba641a8fe

                    SHA512

                    15f8cbb94f8cede9331a0fbbe7b4b672b9822a56cd85beb476724f42281e9e9ce53948166288bdfab010f560c23fcab4ad1429ab4fe90c4a0883d8fb519fa0f0

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.4MB

                    MD5

                    4e5e69fa3a300abc35b48734f5a1f2ed

                    SHA1

                    3349efaf93e03c7466edc7882fc83b29926ebe65

                    SHA256

                    2145d9d698ee4b71ba8ef55f69a68336275bc58324fc1f139175875cc9f2fb9c

                    SHA512

                    59a743fec2dc8913c57f460d7e92dde131547cb72ce8f026513fe622e85e54a4bef02c5786d4bb55587b5434a29c0d7e5357dc83c1ff4dd6b7eb65eacf67ee78

                    Download Submit

                  • C:\ProgramData\Microsoft\Windows\Caches\{2843ADA2-0F67-4F78-92E2-B7A4AB26A670}.2.ver0x0000000000000002.db
                    Filesize

                    44KB

                    MD5

                    45681a07a4652f2d638c77d506fbb1ee

                    SHA1

                    a517d4eed3ceaf819cc253fccd6894196a18dbf8

                    SHA256

                    3adfbcb59c44c3d773dd7e3ff823d0f5c99fafa8d7d60477a0b11f50bb2f9d45

                    SHA512

                    d76f777718ecce896c3ee1e85fa4367cba844f43168c38ab787eb412e7e22bcab3ab4db8fc0648f2a542c231266061a5c314468846a7c2acdab5e0e1bbce7d89

                    Download Submit

                  • C:\ProgramData\fontcacheev1.dat
                    Filesize

                    259B

                    MD5

                    849985cca0747e719c2ece94788a251d

                    SHA1

                    3b6c50851ef51a485a61a5f5b3ec8255a9788312

                    SHA256

                    28e4ac47a045f921afba8882b8a734d4eda80d7274105377d8d2670525ed2e63

                    SHA512

                    05db7ea038dca03b0f73c1bf25ba774365df18a074b0245262a9fda537e105581fa1f88abf47a62b76328a57d1baf162424f9a781b0d7d11f4448435d68d365e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\muqgv5xw.newcfg
                    Filesize

                    1KB

                    MD5

                    92ef2b438ca5bf0a36a11165102af092

                    SHA1

                    1b9409047b80ceba51b18ff1b08fed068e0a4c7c

                    SHA256

                    0854f1df92d97e676fe753e90c97513482ea9976a072bbcf73fb7e8c4a387784

                    SHA512

                    6de4749de0a34674fb6e10a5d5922073e05c52bf08ca9a358c48c3f9acb403029309be1dd8fb8029a762255dbb00ad2927667866855b39ff5b013c2c9126c9da

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config
                    Filesize

                    1KB

                    MD5

                    1543a151c570c3fd0b6fa8ad13ca53c5

                    SHA1

                    6f0a295ab64a7d46a4676b583ef5268480cafb7e

                    SHA256

                    fc8ad8662e39f99604a2cf9eec0e04520172a5b17207a212fbc280373eaa2b58

                    SHA512

                    3cc2f55ecc8b71d3a7acc1662de98e0c61824d563dbc051716914d07553cd1198ced7c6d3523f3b9b3146f11ff347caff56be8455ba5dd5b3fb4be10bd2a1487

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
                    Filesize

                    651B

                    MD5

                    79dd9d574bf7da4d10dee390db653a12

                    SHA1

                    ddb3e64a2e79b01101cbd6d553eda0659451bc84

                    SHA256

                    4c0cac895c138615c44f674f0a92304ec664e87fbd3721eb9f403cc03f2fea34

                    SHA512

                    f08b39971a8cc77761dea295906bead275aac4011821a3ea1c0a78ae1162bbbb1cf51cc93fbbb7c72cc4ac1bd2cb7d69cdd27ef6ff93d31ef66be8f97615e4b7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Adguard\Adguard_20240506164849_000_Msi64BitPackage.log
                    Filesize

                    1KB

                    MD5

                    9097962cf60dc2e7a007e604591b92c1

                    SHA1

                    effa2d4ad344e162d25a566509e81116cf7a9301

                    SHA256

                    1ab9a19d4c0b6961cf1b8354a4daf004f74748916a1d5023493623fd7b4ff14b

                    SHA512

                    4627522d791875e757f1bd19ae135e496900f855149fcf6791de51ec6ba4e826b4443ceccd627333de63b3e7e6f165e47cca2d273412e4428da07c9fe02b92d7

                    Download Submit

                  • C:\Windows\Installer\MSI2259.tmp-\CustomAction.config
                    Filesize

                    228B

                    MD5

                    d044d23e8084c869cbdae714ba47b866

                    SHA1

                    40d25b0fec3e43b7d966d02928d60904e32bd84a

                    SHA256

                    f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd

                    SHA512

                    62d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9

                    Download Submit

                  • C:\Windows\Installer\MSI2259.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                    Filesize

                    179KB

                    MD5

                    1a5caea6734fdd07caa514c3f3fb75da

                    SHA1

                    f070ac0d91bd337d7952abd1ddf19a737b94510c

                    SHA256

                    cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                    SHA512

                    a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                    Download Submit

                  • C:\Windows\Installer\MSI2C1F.tmp
                    Filesize

                    211KB

                    MD5

                    a3ae5d86ecf38db9427359ea37a5f646

                    SHA1

                    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                    SHA256

                    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                    SHA512

                    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                    Download Submit

                  • C:\Windows\Installer\MSI2D69.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll
                    Filesize

                    32KB

                    MD5

                    82deb78891f430007e871a35ce28fac4

                    SHA1

                    4e490d7ec139a6cde53e3932d3122a48aa379904

                    SHA256

                    2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237

                    SHA512

                    e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a

                    Download Submit

                  • C:\Windows\Installer\MSI2E26.tmp
                    Filesize

                    127KB

                    MD5

                    93394d2866590fb66759f5f0263453f2

                    SHA1

                    2f0903d4b21a0231add1b4cd02e25c7c4974da84

                    SHA256

                    5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

                    SHA512

                    f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

                    Download Submit

                  • C:\Windows\Installer\MSIAF8.tmp
                    Filesize

                    693KB

                    MD5

                    52159f784cc0f57bddf39a17857a8ac2

                    SHA1

                    0788b586b3210cf004c827d396d8ccd851472ee4

                    SHA256

                    4fb676db4f1de07697fe85568bcb6c1cd79c079a818add24cd15cc81ed29f20a

                    SHA512

                    208911765072ca824613e3b65658b23f553c82390b8296f8aff7e07f702cd431cb6fdee7067f13525b85bf582062dea077be2e4f27e12d00bae3b0b244471201

                    Download Submit

                  • C:\Windows\Installer\MSIAF8.tmp-\Adguard.CustomActions.dll
                    Filesize

                    475KB

                    MD5

                    b3259d1ef57ca51f12a28cd7cb5a03a3

                    SHA1

                    a127b32a20540678be8554ddc53017e7df25f314

                    SHA256

                    59e6e20cf85d317b5abd18078e5a551b21c56ca18e20fe1e45759bd3038482e7

                    SHA512

                    1d8bfd6ad0c90b7278803f51c9c1bbeb429fe448779ef9abffb7758a8fcd6db704ae71a1af65da64b6c712b32c8af54884c3a77ef13b337f499c91e097114834

                    Download Submit

                  • C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe
                    Filesize

                    384KB

                    MD5

                    e1769fd831d70274d0183e3e68994684

                    SHA1

                    5db7df3a9a0cf3489272ed99d8cdf6105dc9a620

                    SHA256

                    f6558d3f7c36fea39912c10e20d878244a079594a01173dd31918043b250f681

                    SHA512

                    504f28d6ff9e72a6662500b192b0263735662c65adae507c65881bef865092f29473af576ce286a30a061a08a2098c078726ce8f6f8c932331fcb52317d76649

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\AdGuard.Utils.Base.dll
                    Filesize

                    879KB

                    MD5

                    39b2236a3c083292a14f65585ad73e28

                    SHA1

                    012a24cc5993cbc33ebace8cace1c1dae1e899c3

                    SHA256

                    4b930935f4a6ecf9908c9c50f969c5daea41c3de2bd6540cd6f220fd83bffe8d

                    SHA512

                    d3b2f971fc856e3927603334ed428658000b4228776039c4c1c0c9811551209073873aea7130ae46dde2971f694d7fedd2a37dafd5ba325a7d0db24a8451f889

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\AdGuard.Utils.Installer.dll
                    Filesize

                    55KB

                    MD5

                    abd2f4a5cfa8a9608fb14e3fbf44871f

                    SHA1

                    b5249f54a6a73c27bcbbdc07fb6c86d9745be35f

                    SHA256

                    06c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5

                    SHA512

                    7dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\AdGuard.Utils.UI.dll
                    Filesize

                    621KB

                    MD5

                    ec3d9350a9a400fb3271c7327f5bf5a8

                    SHA1

                    0eea26f71e7d03579303b9ffc34549fa7ac843e9

                    SHA256

                    aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4

                    SHA512

                    a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\AdGuard.Utils.dll
                    Filesize

                    1.8MB

                    MD5

                    1f79f405d3659eb62779f948a397967d

                    SHA1

                    c01403d8ae03c41726f9f5d72f1b79dc3e96191b

                    SHA256

                    b262d6ab962e2dfd034e63df34ad8aed15f1caf1ac1b1259facba9535fca71e4

                    SHA512

                    b5a397b6f62ee5c7c2dae0cebcd509127200deb5f651eb5d850a2e9182a5eea67925e96df0e3b1ba9cb0f17a4ad78e29833ed3baf22e5e9ec07ff06d47d64ced

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\Adguard.Burn.dll
                    Filesize

                    279KB

                    MD5

                    96010203c9ad85132c021ce2d86536f9

                    SHA1

                    6db1c233ae2e5ab52798a027a597601c43a02715

                    SHA256

                    8215daa9d609cf32d2b2344eb33d7cb612fa91fc2e1210929fd64b5eca6b1b85

                    SHA512

                    ee4132abc306e60c1c29707bace7747128cc8f8f71bb3dc86407817dfa71e624e173b597a8da35a5f908095219e8d184cf040a62995aff988a12ecfa14d302cd

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\BootstrapperCore.config
                    Filesize

                    1KB

                    MD5

                    898c2a320bea0580f37beeccda8f2378

                    SHA1

                    eccab214a148e6a7a9535bf1c83b714c756dabf2

                    SHA256

                    4440270efc95c694150a665b62ca89b8b93b1271dfb2757e8dd1a68ef2705498

                    SHA512

                    e4608aab984c6e97b00e80d2635a283392f1eb24bdb65f5fce92851eb63ad474e5050ac46e5cafe2dbd438dd026269253bd4ec427f08b2a09788d6b1d49bcc84

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\BootstrapperCore.dll
                    Filesize

                    87KB

                    MD5

                    b0d10a2a622a322788780e7a3cbb85f3

                    SHA1

                    04d90b16fa7b47a545c1133d5c0ca9e490f54633

                    SHA256

                    f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

                    SHA512

                    62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\Newtonsoft.Json.dll
                    Filesize

                    647KB

                    MD5

                    5afda7c7d4f7085e744c2e7599279db3

                    SHA1

                    3a833eb7c6be203f16799d7b7ccd8b8c9d439261

                    SHA256

                    f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

                    SHA512

                    7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\SharpRaven.dll
                    Filesize

                    114KB

                    MD5

                    89a2762f19597b82d5c501366e5b2f29

                    SHA1

                    f5df7962015164e4bfed0ae361f988c1e581677e

                    SHA256

                    a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167

                    SHA512

                    bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.ba\mbahost.dll
                    Filesize

                    119KB

                    MD5

                    c59832217903ce88793a6c40888e3cae

                    SHA1

                    6d9facabf41dcf53281897764d467696780623b8

                    SHA256

                    9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

                    SHA512

                    1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

                    Download Submit

                  • C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\Msi64BitPackage
                    Filesize

                    41.4MB

                    MD5

                    d7677284befc5f541d560e631a0861ad

                    SHA1

                    bbed67a5a597df83cf3d2a7ca7c26716571cb87f

                    SHA256

                    eaf4cc8809c1ad671e63b8c4bae50eda8924e23e507df272a0f0f6fad4d23cf8

                    SHA512

                    0fd95dcb5efffbc06c3b21e60ad9c4112cc59aa462e20067ab4f19843ee46f3ea6e7e9a5af3b8e49f9cf93df6b8e3819450c0b6724d049c04be7ee4189b76fd2

                    Download Submit

                  • C:\Windows\Temp\{EF0741D0-5A4C-46E0-BC5F-DC184F6E4D12}\.cr\setup.exe
                    Filesize

                    3.1MB

                    MD5

                    b25f06e4ed0166ac822e48068e334b00

                    SHA1

                    5f44162e567a979323a1b734e651b60affaad674

                    SHA256

                    a66066c6fbaabee2011956619a0bdf3606b40f4eddedecabb82bb321ceeb2f72

                    SHA512

                    03280db188f38387d7d11073f36caf9ed05fd266b3d155b4bf0ba4ac1bccce422d552ccc39465e2b5ff0996b0a24904304d6f5b269f3e38432cc73235fface50

                    Download Submit

                  • memory/472-146-0x000000000C490000-0x000000000C4D0000-memory.dmp

                    Filesize

                    256KB

                    Download

                  • memory/472-131-0x0000000006810000-0x000000000682E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/472-125-0x0000000006AD0000-0x0000000006C94000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/472-107-0x00000000061E0000-0x000000000622C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/472-100-0x0000000003690000-0x00000000036A8000-memory.dmp

                    Filesize

                    96KB

                    Download

                  • memory/472-121-0x0000000006850000-0x00000000068EE000-memory.dmp

                    Filesize

                    632KB

                    Download

                  • memory/472-111-0x00000000061B0000-0x00000000061C2000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/472-147-0x000000000B9C0000-0x000000000B9F8000-memory.dmp

                    Filesize

                    224KB

                    Download

                  • memory/472-148-0x000000000B990000-0x000000000B99E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/472-145-0x000000000C040000-0x000000000C048000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/472-140-0x0000000007150000-0x00000000074A7000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/472-139-0x0000000006DF0000-0x0000000006E12000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/472-136-0x00000000070A0000-0x0000000007148000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/472-115-0x0000000006450000-0x0000000006530000-memory.dmp

                    Filesize

                    896KB

                    Download

                  • memory/952-11-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/952-5-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/1136-1672-0x00000143A20D0000-0x00000143A2194000-memory.dmp

                    Filesize

                    784KB

                    Download

                  • memory/1312-711-0x000001EC4D3A0000-0x000001EC4D416000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/1312-714-0x000001EC34E70000-0x000001EC34E8E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2336-753-0x000001BA78200000-0x000001BA782E6000-memory.dmp

                    Filesize

                    920KB

                    Download

                  • memory/2660-194-0x000002EE05E50000-0x000002EE05E7E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/2660-198-0x000002EE1EF40000-0x000002EE1EFBC000-memory.dmp

                    Filesize

                    496KB

                    Download

                  • memory/2880-565-0x0000024B4B300000-0x0000024B4B36C000-memory.dmp

                    Filesize

                    432KB

                    Download

                  • memory/2880-566-0x0000024B4A430000-0x0000024B4A4BE000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/2880-732-0x00007FF92BD30000-0x00007FF92BD40000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2880-731-0x00007FF92BD40000-0x00007FF92BD50000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2880-712-0x0000024B4B390000-0x0000024B4B3AE000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2880-574-0x0000024B4AA30000-0x0000024B4AA56000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2880-573-0x0000024B4AC90000-0x0000024B4ACCA000-memory.dmp

                    Filesize

                    232KB

                    Download

                  • memory/2880-572-0x0000024B4C970000-0x0000024B4CD4A000-memory.dmp

                    Filesize

                    3.9MB

                    Download

                  • memory/2880-571-0x0000024B4B7D0000-0x0000024B4B82A000-memory.dmp

                    Filesize

                    360KB

                    Download

                  • memory/2880-570-0x0000024B4BB00000-0x0000024B4BBA8000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/2880-1559-0x0000024B4BC80000-0x0000024B4BC92000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/2880-1560-0x0000024B4BE50000-0x0000024B4BE8C000-memory.dmp

                    Filesize

                    240KB

                    Download

                  • memory/2880-569-0x0000024B4BA60000-0x0000024B4BAFE000-memory.dmp

                    Filesize

                    632KB

                    Download

                  • memory/2880-568-0x0000024B4B9B0000-0x0000024B4BA58000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/2880-544-0x0000024B305C0000-0x0000024B30688000-memory.dmp

                    Filesize

                    800KB

                    Download

                  • memory/2880-545-0x0000024B4A430000-0x0000024B4A4BE000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/2880-546-0x0000024B4A700000-0x0000024B4A8C4000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/2880-547-0x0000024B4A8D0000-0x0000024B4A9B0000-memory.dmp

                    Filesize

                    896KB

                    Download

                  • memory/2880-548-0x0000024B4A5C0000-0x0000024B4A642000-memory.dmp

                    Filesize

                    520KB

                    Download

                  • memory/2880-549-0x0000024B4AA80000-0x0000024B4AB42000-memory.dmp

                    Filesize

                    776KB

                    Download

                  • memory/2880-564-0x0000024B4B3D0000-0x0000024B4B494000-memory.dmp

                    Filesize

                    784KB

                    Download

                  • memory/2880-737-0x0000024B4BBE0000-0x0000024B4BC02000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/2880-567-0x0000024B4B8C0000-0x0000024B4B9A6000-memory.dmp

                    Filesize

                    920KB

                    Download

                  • memory/2880-558-0x0000024B4AA80000-0x0000024B4AB42000-memory.dmp

                    Filesize

                    776KB

                    Download

                  • memory/2880-559-0x0000024B4B270000-0x0000024B4B300000-memory.dmp

                    Filesize

                    576KB

                    Download

                  • memory/2880-563-0x0000024B4BEB0000-0x0000024B4C58C000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2880-562-0x0000024B4B660000-0x0000024B4B7C2000-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2880-561-0x0000024B4B4B0000-0x0000024B4B660000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/2880-560-0x0000024B4B1E0000-0x0000024B4B246000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2880-557-0x0000024B4B170000-0x0000024B4B1D2000-memory.dmp

                    Filesize

                    392KB

                    Download

                  • memory/2880-556-0x0000024B4A5C0000-0x0000024B4A642000-memory.dmp

                    Filesize

                    520KB

                    Download

                  • memory/2880-555-0x0000024B4AC10000-0x0000024B4AC86000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/2880-554-0x0000024B4AB50000-0x0000024B4AC06000-memory.dmp

                    Filesize

                    728KB

                    Download

                  • memory/2880-553-0x0000024B4A9B0000-0x0000024B4AA2A000-memory.dmp

                    Filesize

                    488KB

                    Download

                  • memory/2880-552-0x0000024B4A700000-0x0000024B4A8C4000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/2880-551-0x0000024B4AB50000-0x0000024B4AC06000-memory.dmp

                    Filesize

                    728KB

                    Download

                  • memory/2880-550-0x0000024B4ACE0000-0x0000024B4AE68000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/3588-1694-0x0000016267880000-0x0000016267890000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/3588-1692-0x0000016267710000-0x000001626771A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/3588-1693-0x0000016267720000-0x0000016267728000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/3588-1691-0x00000162677F0000-0x0000016267852000-memory.dmp

                    Filesize

                    392KB

                    Download

                  • memory/3588-1687-0x0000016267550000-0x00000162675CA000-memory.dmp

                    Filesize

                    488KB

                    Download

                  • memory/3588-1682-0x000001624AFA0000-0x000001624B67C000-memory.dmp

                    Filesize

                    6.9MB

                    Download