Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/05/2024, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
uTorrent(1).exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
uTorrent(1).exe
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
utorrent(1)/adguardinstaller.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral4
Sample
utorrent(1)/adguardinstaller.exe
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
utorrent(1)/utorrent.exe
Resource
win10v2004-20240226-en
General
-
Target
utorrent(1)/adguardinstaller.exe
-
Size
142KB
-
MD5
cd3581d9db9d066b4c08a42df3d6c1ac
-
SHA1
deb0c2bcc63cd5f8b6e63a00cbf731475045898e
-
SHA256
17eeb4a4eec555bdcbb1bd52be92d1b766c402e9ebd320fe3134a9f7d349fcb2
-
SHA512
4218916a98a9c8816e780744dd7ef9679c000fba219ad21f9188c4421bd6afaebedc2d57382b97fb20c7b230e498f61d7ce606713c0a064158237d79563b819d
-
SSDEEP
3072:K4qZHnMyBV3vChLFvGyfmKvK9MkBrF8wvFx+:K4qZHdV3vevK9MkhRvW
Malware Config
Signatures
-
Detect ZGRat V1 8 IoCs
resource yara_rule behavioral4/files/0x001900000002ab68-112.dat family_zgrat_v1 behavioral4/memory/472-115-0x0000000006450000-0x0000000006530000-memory.dmp family_zgrat_v1 behavioral4/memory/472-125-0x0000000006AD0000-0x0000000006C94000-memory.dmp family_zgrat_v1 behavioral4/files/0x001900000002ab65-123.dat family_zgrat_v1 behavioral4/memory/2880-546-0x0000024B4A700000-0x0000024B4A8C4000-memory.dmp family_zgrat_v1 behavioral4/memory/2880-547-0x0000024B4A8D0000-0x0000024B4A9B0000-memory.dmp family_zgrat_v1 behavioral4/memory/2880-552-0x0000024B4A700000-0x0000024B4A8C4000-memory.dmp family_zgrat_v1 behavioral4/memory/2880-561-0x0000024B4B4B0000-0x0000024B4B660000-memory.dmp family_zgrat_v1 -
Drops file in Drivers directory 4 IoCs
description ioc Process File created C:\Windows\system32\Drivers\vwifikerneldrv.sys AdguardSvc.exe File opened for modification C:\Windows\system32\Drivers\vwifikerneldrv.sys AdguardSvc.exe File created C:\Windows\system32\drivers\adgnetworkwfpdrv.sys AdguardSvc.exe File opened for modification C:\Windows\system32\drivers\adgnetworkwfpdrv.sys AdguardSvc.exe -
Manipulates Digital Signatures 1 TTPs 12 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500" AdguardSvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200" AdguardSvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200" AdguardSvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500" AdguardSvc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5} = "\"C:\\ProgramData\\Package Cache\\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\\adgSetup.exe\" /burn.runonce" adgSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adguard = "\"C:\\Program Files\\AdGuard\\Adguard.exe\" /nosplash" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adguard = "\"C:\\Program Files\\AdGuard\\Adguard.exe\" /nosplash" AdguardSvc.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 11 1544 msiexec.exe 12 1544 msiexec.exe 13 1544 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,348,22000,0" ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1" ie4uinit.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\prfc0003.dat.tmp AdguardSvc.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Adguard.BrowserExtensionHost.exe.log Adguard.BrowserExtensionHost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Adguard.Tools.exe.log Adguard.Tools.exe File created C:\Windows\system32\d3dx9_11.dll.tmp AdguardSvc.exe File opened for modification C:\Windows\system32\d3dx9_11.dll.tmp AdguardSvc.exe File created C:\Windows\system32\prfc0003.dat.tmp AdguardSvc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\AdGuard\Adguard.Service.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.mk.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.vi.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.id.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.sv.dll msiexec.exe File created C:\Program Files\AdGuard\x86\AdguardDns.dll msiexec.exe File created C:\Program Files\AdGuard\config-69cd1a658bc742bbb9da0bbea48a7d97.xml AdguardSvc.exe File created C:\Program Files\AdGuard\Adguard.DnsApi.dll msiexec.exe File created C:\Program Files\AdGuard\Adguard.UI.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.sv.dll msiexec.exe File created C:\Program Files\AdGuard\AdGuard.Updater.dll msiexec.exe File opened for modification C:\Program Files\AdGuard\Drivers\x64\adgnetworkwfpdrv.sys AdguardSvc.exe File opened for modification C:\Program Files\AdGuard\AdguardNetReg.log AdguardNetReg.exe File created C:\Program Files\AdGuard\Adguard.CoreApi.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.zh.dll msiexec.exe File created C:\Program Files\AdGuard\nss\libnspr4.dll msiexec.exe File created C:\Program Files\AdGuard\Adguard.Tools.exe msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.pl.dll msiexec.exe File created C:\Program Files\AdGuard\AdguardSvc.exe.config msiexec.exe File created C:\Program Files\AdGuard\Adguard.Global.dll msiexec.exe File created C:\Program Files\AdGuard\Adguard.Network.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.ru.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.ar.dll msiexec.exe File created C:\Program Files\AdGuard\nss\certutil.exe msiexec.exe File created C:\Program Files\AdGuard\ICSharpCode.AvalonEdit.dll msiexec.exe File opened for modification C:\Program Files\AdGuard\Drivers\arm64\AdguardNetLib.dll AdguardSvc.exe File created C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys AdguardSvc.exe File created C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.mk.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.he.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.hy.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.sr.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.fr.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.ar.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.cs.dll msiexec.exe File opened for modification C:\Program Files\AdGuard\AdguardNetReg.log AdguardNetReg.exe File created C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.de.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.fi.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.sl.dll msiexec.exe File created C:\Program Files\AdGuard\nss\sqlite3.dll msiexec.exe File opened for modification C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys AdguardSvc.exe File created C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworktdidrv.sys AdguardSvc.exe File opened for modification C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys AdguardSvc.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.el.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.es.dll msiexec.exe File created C:\Program Files\AdGuard\x86\AdguardCoreTools.dll msiexec.exe File created C:\Program Files\AdGuard\x86\AGIpHelperClose.dll msiexec.exe File created C:\Program Files\AdGuard\Adguard.Dns.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.fr.dll msiexec.exe File created C:\Program Files\AdGuard\AdGuard.Utils.dll msiexec.exe File created C:\Program Files\AdGuard\x86\AdguardCore.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.id.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.ko.dll msiexec.exe File created C:\Program Files\AdGuard\Arm64\AdguardCoreTools.dll msiexec.exe File opened for modification C:\Program Files\AdGuard\default.adg AdguardSvc.exe File created C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.pt-PT.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.hr.dll msiexec.exe File created C:\Program Files\AdGuard\langs\Adguard.UI.resources.no.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.fi.dll msiexec.exe File created C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.uk.dll msiexec.exe File created C:\Program Files\AdGuard\x64\AGIpHelperClose.dll msiexec.exe File created C:\Program Files\AdGuard\Microsoft.Expression.Interactions.dll msiexec.exe File created C:\Program Files\AdGuard\nss\nssutil3.dll msiexec.exe File created C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe AdguardSvc.exe File created C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys AdguardSvc.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4B69.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIAF8.tmp-\Adguard.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2E75.tmp msiexec.exe File opened for modification C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI33D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2B34.tmp-\warning.ico rundll32.exe File created C:\Windows\SystemTemp\~DFB2A7C37289B04B6A.TMP msiexec.exe File created C:\Windows\Installer\e57f919.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3408.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2259.tmp-\Adguard.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp-\Adguard.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4B69.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIAF8.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2259.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI2B34.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4B69.tmp-\Adguard.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2B34.tmp msiexec.exe File created C:\Windows\WinSxS\poqexecv2sys.log AdguardSvc.exe File created C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4B69.tmp-\AdGuard.Utils.Base.dll rundll32.exe File opened for modification C:\Windows\Installer\e57f915.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2259.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2259.tmp-\warning.ico rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2E26.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp-\warning.ico rundll32.exe File opened for modification C:\Windows\Installer\MSIAF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Uninstall.exe msiexec.exe File created C:\Windows\Installer\wix{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSI3408.tmp-\Adguard.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2259.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2B34.tmp-\AdGuard.Utils.Base.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp-\AdGuard.Utils.Base.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3408.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\SourceHash{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3} msiexec.exe File opened for modification C:\Windows\Installer\MSI2D58.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Uninstall.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI3408.tmp-\AdGuard.Utils.Base.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3408.tmp-\warning.ico rundll32.exe File created C:\Windows\Installer\e57f915.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIAF8.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI2E95.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAF8.tmp-\warning.ico rundll32.exe File opened for modification C:\Windows\Installer\MSI2259.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3408.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF527E4137897BFECF.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFBFA0F4E50D4A6CF5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2259.tmp-\AdGuard.Utils.Base.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2B34.tmp-\Adguard.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI325F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B69.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIAF8.tmp-\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\~DF7671BA5BCE6F57A9.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3408.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4B69.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B69.tmp-\warning.ico rundll32.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIAF8.tmp-\AdGuard.Utils.Base.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2B34.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll rundll32.exe -
Executes dropped EXE 10 IoCs
pid Process 4000 setup.exe 472 setup.exe 5012 adgSetup.exe 2880 AdguardSvc.exe 2336 Adguard.BrowserExtensionHost.exe 1136 Adguard.Tools.exe 3588 Adguard.exe 1748 AdguardNetReg.exe 3808 AdguardNetReg.exe 4960 AdguardNetReg.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1960 sc.exe 3044 sc.exe 3748 sc.exe -
Loads dropped DLL 64 IoCs
pid Process 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 472 setup.exe 1424 MsiExec.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 1424 MsiExec.exe 3568 rundll32.exe 3568 rundll32.exe 3568 rundll32.exe 1424 MsiExec.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 2984 MsiExec.exe 1424 MsiExec.exe 2896 rundll32.exe 2896 rundll32.exe 2896 rundll32.exe 2984 MsiExec.exe 2984 MsiExec.exe 2984 MsiExec.exe 4548 MsiExec.exe 4548 MsiExec.exe 2984 MsiExec.exe 1424 MsiExec.exe 4940 rundll32.exe 4940 rundll32.exe 4940 rundll32.exe 2880 AdguardSvc.exe 2880 AdguardSvc.exe 2880 AdguardSvc.exe 2880 AdguardSvc.exe 2880 AdguardSvc.exe 2880 AdguardSvc.exe 2880 AdguardSvc.exe 1424 MsiExec.exe 1312 rundll32.exe 1312 rundll32.exe 1312 rundll32.exe 2336 Adguard.BrowserExtensionHost.exe 2336 Adguard.BrowserExtensionHost.exe 3588 Adguard.exe 3588 Adguard.exe 2880 AdguardSvc.exe 2880 AdguardSvc.exe 1748 AdguardNetReg.exe 3808 AdguardNetReg.exe 4960 AdguardNetReg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4920 schtasks.exe -
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
pid Process 2648 ipconfig.exe 2648 ipconfig.exe 4904 ipconfig.exe 1152 ipconfig.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0" ie4uinit.exe -
Modifies data under HKEY_USERS 59 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs AdguardSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates AdguardSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AdguardSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections AdguardSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AdguardSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AdguardSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" AdguardSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs AdguardSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" AdguardSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs AdguardSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AdguardSvc.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E AdguardSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates AdguardSvc.exe -
Modifies registry class 54 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adguard rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\DefaultIcon rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}v7.17.4709.0\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\ = "URL:Adguard custom Protocol" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\URL Protocol rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\DisplayName = "AdGuard" adgSetup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5} adgSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Version = "7.17.4709.0" adgSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\ProductIcon = "C:\\Windows\\Installer\\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\\AdguardIcon.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\DefaultIcon\ = "C:\\Program Files\\AdGuard\\Adguard.Tools.exe" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdns rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\shell rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\shell rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Dependents\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5} adgSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\10DCDC8AF56B96143A9A1FE3BE3AE13D\Complete msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\shell\open rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\shell\open\command\ = "\"C:\\Program Files\\AdGuard\\Adguard.Tools.exe\" /customProtocol \"%1\"" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\ = "URL:Adguard SDNS Protocol " rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\ = "{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}" adgSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\ProductName = "AdGuard" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0E5674DA1C957254AA41A33512538F4C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\DefaultIcon\ = "C:\\Program Files\\AdGuard\\Adguard.Tools.exe" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\DefaultIcon rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\shell\open\command\ = "\"C:\\Program Files\\AdGuard\\Adguard.Tools.exe\" /customProtocol \"%1\"" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0E5674DA1C957254AA41A33512538F4C\10DCDC8AF56B96143A9A1FE3BE3AE13D msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\URL Protocol rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394\DisplayName = "windows_ie_ac_001" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}v7.17.4709.0\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adguard\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\DisplayName = "AdGuard" adgSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\Dependents adgSetup.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3} adgSetup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\Version = "118559333" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\10DCDC8AF56B96143A9A1FE3BE3AE13D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\PackageName = "setup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdns\shell\open rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\Version = "7.17.4709.0" adgSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\Dependents\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5} adgSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\ = "{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}" adgSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\PackageCode = "352F416060093DE4F99BC67878179D8E" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Dependents adgSetup.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 AdguardSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AdguardSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AdguardSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 AdguardSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 AdguardSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 AdguardSvc.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 472 setup.exe Token: SeShutdownPrivilege 5012 adgSetup.exe Token: SeIncreaseQuotaPrivilege 5012 adgSetup.exe Token: SeSecurityPrivilege 1544 msiexec.exe Token: SeCreateTokenPrivilege 5012 adgSetup.exe Token: SeAssignPrimaryTokenPrivilege 5012 adgSetup.exe Token: SeLockMemoryPrivilege 5012 adgSetup.exe Token: SeIncreaseQuotaPrivilege 5012 adgSetup.exe Token: SeMachineAccountPrivilege 5012 adgSetup.exe Token: SeTcbPrivilege 5012 adgSetup.exe Token: SeSecurityPrivilege 5012 adgSetup.exe Token: SeTakeOwnershipPrivilege 5012 adgSetup.exe Token: SeLoadDriverPrivilege 5012 adgSetup.exe Token: SeSystemProfilePrivilege 5012 adgSetup.exe Token: SeSystemtimePrivilege 5012 adgSetup.exe Token: SeProfSingleProcessPrivilege 5012 adgSetup.exe Token: SeIncBasePriorityPrivilege 5012 adgSetup.exe Token: SeCreatePagefilePrivilege 5012 adgSetup.exe Token: SeCreatePermanentPrivilege 5012 adgSetup.exe Token: SeBackupPrivilege 5012 adgSetup.exe Token: SeRestorePrivilege 5012 adgSetup.exe Token: SeShutdownPrivilege 5012 adgSetup.exe Token: SeDebugPrivilege 5012 adgSetup.exe Token: SeAuditPrivilege 5012 adgSetup.exe Token: SeSystemEnvironmentPrivilege 5012 adgSetup.exe Token: SeChangeNotifyPrivilege 5012 adgSetup.exe Token: SeRemoteShutdownPrivilege 5012 adgSetup.exe Token: SeUndockPrivilege 5012 adgSetup.exe Token: SeSyncAgentPrivilege 5012 adgSetup.exe Token: SeEnableDelegationPrivilege 5012 adgSetup.exe Token: SeManageVolumePrivilege 5012 adgSetup.exe Token: SeImpersonatePrivilege 5012 adgSetup.exe Token: SeCreateGlobalPrivilege 5012 adgSetup.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeDebugPrivilege 2660 rundll32.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeDebugPrivilege 3568 rundll32.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeDebugPrivilege 2896 rundll32.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeShutdownPrivilege 4548 MsiExec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe -
Suspicious use of FindShellTrayWindow 22 IoCs
pid Process 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe 3588 Adguard.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 952 wrote to memory of 4000 952 adguardinstaller.exe 81 PID 952 wrote to memory of 4000 952 adguardinstaller.exe 81 PID 952 wrote to memory of 4000 952 adguardinstaller.exe 81 PID 4000 wrote to memory of 472 4000 setup.exe 82 PID 4000 wrote to memory of 472 4000 setup.exe 82 PID 4000 wrote to memory of 472 4000 setup.exe 82 PID 472 wrote to memory of 5012 472 setup.exe 83 PID 472 wrote to memory of 5012 472 setup.exe 83 PID 472 wrote to memory of 5012 472 setup.exe 83 PID 1544 wrote to memory of 1424 1544 msiexec.exe 87 PID 1544 wrote to memory of 1424 1544 msiexec.exe 87 PID 1424 wrote to memory of 2660 1424 MsiExec.exe 88 PID 1424 wrote to memory of 2660 1424 MsiExec.exe 88 PID 1424 wrote to memory of 3568 1424 MsiExec.exe 94 PID 1424 wrote to memory of 3568 1424 MsiExec.exe 94 PID 1424 wrote to memory of 4900 1424 MsiExec.exe 95 PID 1424 wrote to memory of 4900 1424 MsiExec.exe 95 PID 1544 wrote to memory of 2984 1544 msiexec.exe 96 PID 1544 wrote to memory of 2984 1544 msiexec.exe 96 PID 1544 wrote to memory of 2984 1544 msiexec.exe 96 PID 1424 wrote to memory of 2896 1424 MsiExec.exe 97 PID 1424 wrote to memory of 2896 1424 MsiExec.exe 97 PID 1544 wrote to memory of 4548 1544 msiexec.exe 98 PID 1544 wrote to memory of 4548 1544 msiexec.exe 98 PID 1544 wrote to memory of 4548 1544 msiexec.exe 98 PID 1424 wrote to memory of 4940 1424 MsiExec.exe 99 PID 1424 wrote to memory of 4940 1424 MsiExec.exe 99 PID 4940 wrote to memory of 2296 4940 rundll32.exe 101 PID 4940 wrote to memory of 2296 4940 rundll32.exe 101 PID 4940 wrote to memory of 2928 4940 rundll32.exe 102 PID 4940 wrote to memory of 2928 4940 rundll32.exe 102 PID 2928 wrote to memory of 3464 2928 cmd.exe 104 PID 2928 wrote to memory of 3464 2928 cmd.exe 104 PID 3464 wrote to memory of 2740 3464 net.exe 105 PID 3464 wrote to memory of 2740 3464 net.exe 105 PID 1424 wrote to memory of 1312 1424 MsiExec.exe 107 PID 1424 wrote to memory of 1312 1424 MsiExec.exe 107 PID 472 wrote to memory of 1960 472 setup.exe 108 PID 472 wrote to memory of 1960 472 setup.exe 108 PID 472 wrote to memory of 1960 472 setup.exe 108 PID 2880 wrote to memory of 2336 2880 AdguardSvc.exe 110 PID 2880 wrote to memory of 2336 2880 AdguardSvc.exe 110 PID 2880 wrote to memory of 1776 2880 AdguardSvc.exe 112 PID 2880 wrote to memory of 1776 2880 AdguardSvc.exe 112 PID 2880 wrote to memory of 1776 2880 AdguardSvc.exe 112 PID 1776 wrote to memory of 4920 1776 cmd.exe 114 PID 1776 wrote to memory of 4920 1776 cmd.exe 114 PID 1776 wrote to memory of 4920 1776 cmd.exe 114 PID 2880 wrote to memory of 3044 2880 AdguardSvc.exe 115 PID 2880 wrote to memory of 3044 2880 AdguardSvc.exe 115 PID 2880 wrote to memory of 3748 2880 AdguardSvc.exe 117 PID 2880 wrote to memory of 3748 2880 AdguardSvc.exe 117 PID 2880 wrote to memory of 1136 2880 AdguardSvc.exe 119 PID 2880 wrote to memory of 1136 2880 AdguardSvc.exe 119 PID 2880 wrote to memory of 1936 2880 AdguardSvc.exe 120 PID 2880 wrote to memory of 1936 2880 AdguardSvc.exe 120 PID 1936 wrote to memory of 5000 1936 cmd.exe 122 PID 1936 wrote to memory of 5000 1936 cmd.exe 122 PID 2880 wrote to memory of 4228 2880 AdguardSvc.exe 124 PID 2880 wrote to memory of 4228 2880 AdguardSvc.exe 124 PID 4228 wrote to memory of 3568 4228 cmd.exe 126 PID 4228 wrote to memory of 3568 4228 cmd.exe 126 PID 2880 wrote to memory of 1212 2880 AdguardSvc.exe 127 PID 2880 wrote to memory of 1212 2880 AdguardSvc.exe 127 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\utorrent(1)\adguardinstaller.exe"C:\Users\Admin\AppData\Local\Temp\utorrent(1)\adguardinstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\adguard\setup.exeC:\Users\Admin\AppData\Local\Temp\adguard\setup.exe "AID=25774"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\Temp\{EF0741D0-5A4C-46E0-BC5F-DC184F6E4D12}\.cr\setup.exe"C:\Windows\Temp\{EF0741D0-5A4C-46E0-BC5F-DC184F6E4D12}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=732 -burn.filehandle.self=728 "AID=25774"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.be\adgSetup.exe"C:\Windows\Temp\{E4ADEC2F-F617-40B3-8DBE-4691604873FD}\.be\adgSetup.exe" -q -burn.elevated BurnPipe.{0E8A59AB-BF74-4CE8-A347-3A37032540D2} {EC143B94-3011-4EE5-BC14-4F2615F4A9D0} 4724⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\SysWOW64\sc.exe"sc" query adgnetworktdidrv4⤵
- Launches sc.exe
PID:1960
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 57FBBAEF9D0FE842E2524F6D42EC9F7D2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIAF8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240651093 2 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstall3⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2259.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240657015 14 Adguard.CustomActions!Adguard.CustomActions.CustomActions.PermanentActions3⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2B34.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240659265 33 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallInitialize3⤵
- Manipulates Digital Signatures
- Drops file in Windows directory
- Loads dropped DLL
PID:4900
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2D69.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240659828 59 Adguard.CustomActions!Adguard.CustomActions.CustomActions.CheckServiceStop3⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3408.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240661593 101 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallFinalize3⤵
- Manipulates Digital Signatures
- Adds Run key to start application
- Drops file in Windows directory
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\system32\ie4uinit.exe"ie4uinit.exe" -show4⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:2296
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /C "net start "Adguard Service""4⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\net.exenet start "Adguard Service"5⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start "Adguard Service"6⤵PID:2740
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4B69.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240667500 141 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize3⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:1312
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7C40D5371D75660C9FC58F304C9434CD2⤵
- Loads dropped DLL
PID:2984
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C343B27376E8EA3134A7154557A35EF4 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:232
-
C:\Program Files\AdGuard\AdguardSvc.exe"C:\Program Files\AdGuard\AdguardSvc.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Program Files\AdGuard\Adguard.BrowserExtensionHost.exe"Adguard.BrowserExtensionHost.exe" /register2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
PID:2336
-
-
C:\Windows\SysWOW64\cmd.exe/c "schtasks /create /xml "C:\Program Files\AdGuard\config-69cd1a658bc742bbb9da0bbea48a7d97.xml" /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f"2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /xml "C:\Program Files\AdGuard\config-69cd1a658bc742bbb9da0bbea48a7d97.xml" /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f3⤵
- Creates scheduled task(s)
PID:4920
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow "Adguard Service"2⤵
- Launches sc.exe
PID:3044
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset "Adguard Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)2⤵
- Launches sc.exe
PID:3748
-
-
C:\Program Files\AdGuard\Adguard.Tools.exe"C:\Program Files\AdGuard\Adguard.Tools.exe" /clean_runouce2⤵
- Drops file in System32 directory
- Executes dropped EXE
PID:1136
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "schtasks /run /tn 69cd1a658bc742bbb9da0bbea48a7d97"2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\schtasks.exeschtasks /run /tn 69cd1a658bc742bbb9da0bbea48a7d973⤵PID:5000
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "schtasks /delete /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f"2⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\system32\schtasks.exeschtasks /delete /tn 69cd1a658bc742bbb9da0bbea48a7d97 /f3⤵PID:3568
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "ipconfig /flushdns"2⤵PID:1212
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
PID:2648
-
-
-
C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe"Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "ipconfig /flushdns"2⤵PID:632
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
PID:4904
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "ipconfig /flushdns"2⤵PID:1556
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
PID:1152
-
-
-
C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe"Drivers\x64\AdguardNetReg.exe" -u adgnetworkwfpdrv2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
PID:3808
-
-
C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe"Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
PID:4960
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "ipconfig /flushdns"2⤵PID:1296
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
PID:2648
-
-
-
C:\Program Files\AdGuard\Adguard.exe"C:\Program Files\AdGuard\Adguard.exe" /nosplash1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3588
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Defense Evasion
Modify Registry
4Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
358KB
MD520fb669cd9cb7aeec13816d5bcc6d10a
SHA12ebd4368f0ad9d0780ebb52aa5f99312731a9e88
SHA2569c4615fc5931d412bed59182f9a165f116b69b441577e732ac1cbf2357d6b1ad
SHA512cd33f6399844b5c096f5a89e1bf15a7a8fd8d49fc4179d555161e7f0d3a911109c9e838711fa118e551ca09c4ef4eb8bca45d60ac44bb15a24beb277d33d3272
-
Filesize
6.8MB
MD5269d75aecda348d7036692d27e09af3c
SHA146a11632f13c8be9bf978bc00493d09f105d216e
SHA256aa15aaaaf06cf68387f07435d95a7e738aab868bfa28941703680d1ef6d2c8da
SHA512db96e23a546dac5f65ff18c5b2e95b0a2ca93013a49e9281e39496b114748dde20fd79833063950891c75998878b1a80b1115d7e071b3799f2c5cfcfd4280f1d
-
Filesize
192KB
MD57257436b13445d12a54aaf9cbff8f029
SHA145c908ae57133fb87ea77d0aef20ad268b0c721b
SHA256374512cb07d70a9ccf2b43affb96ab99fc02dcf07ef70b7b38f0c279b12991ca
SHA51269c13443db0b7128099cfaa914018393c043ca96c25764b1be10035bba0db8efeabe2725473b95aef704e9de971462c3e615610188e5479a5067331d6096d764
-
Filesize
127KB
MD50c6bc1676b5e7a48a52a015405925f8f
SHA1c8b85daec736ce4217ddcc3a41f9c261ff635053
SHA25632826a974608c145b2a2ffc925d5698e179cf08e04bc957aea3293344d9616a3
SHA5123f750d99e8b01545afd1261883d5fa6990fd8ecdfabe62564c3e7cc1f423f0e409b6305cba2582f89e439c6690aa6c4f8ba5a71a0d7d0494f29692304dc3b858
-
Filesize
153KB
MD5520658c251bcde9fe6c71fb0f0d20986
SHA1db75ddf587c128c315a3ba98e1c96749111a3374
SHA25609d7da40bb51e62000ae46cc625490f559c035d6d059bd8657ef8b6d103cab20
SHA5122785563612e0c4507256dc260c195919f0072aa730f2d5a842cd59823a5fc1db45303c9dbf6537bbe1e971a8a61cc436c4d6d2a4ad79bb727cc8c6f3835169dc
-
Filesize
101KB
MD58e37e56d595056bf58e4840b2e0a6312
SHA15f82d763f0eb83ae16f0a51dd9b64c3f1db8a3f2
SHA2563bcd226bf0a6de378ee6ff79e5a2c19260f15f28633174ce23472fbfc8aa331a
SHA512f35b6da8d6454f52e8555c001fcf216b6c8d04486c2cd28a59028354be596cd6a4cecfe6f6537070f4ed21cf303849cbc4009ed72540efc84f6fdf5ee19c309a
-
Filesize
60KB
MD5fcb1f6082b2dd42faae9e2fd76de5920
SHA1fd312dee422bdae43cfd9beec596e2e1a806efe4
SHA2562b743aac00d054e7c041200c88950305035c70da3d415c05eeb7844b040d93ce
SHA51252db56608282ff6d18c380710a1d495c45f1c4cd0ed224abbd58a77ded237f347fec96401036b6510fba0735d65721799c65d070436b919bf92b07dc2ff05dfe
-
Filesize
88KB
MD57d26090469f422f0dab254be116f1917
SHA155943137295bb8a9400ac73f5dadd648df6fe155
SHA2564d3d8984523fafd3aa4ba35b9eeb348ea5a6b284b54e92a03e608dc17f71f44d
SHA5128bd3b4a3ab71a2b22b7ce268605f739a76a12ae2976cce76a81279746890c39a281cf2aa98840178520056924c30d145374402b9a5f4a219eb978f9ccb0a9f1e
-
Filesize
68KB
MD54a83e369a535895500cef8f099cc1818
SHA14d5697c783f877f823f03e6b77e1a07f79e17b9c
SHA2562458d32c657b52a79703c26db4ee0503164ea4b764580c67492bfbbb9522596b
SHA512956932d81026d1648d2adccb3a2ffbdd7a6ac14f1642e154dae98218c4fe500fd9d729fb5c0b96a51d49a711560ee7bfaabf610af562e7f2d4701c63935dc4e3
-
Filesize
87KB
MD573210a1c72d9946fd168c961c2d0916e
SHA1ab848f3bbac8334275c8093e30b561fd71c46ccc
SHA256274b4429872e302bd0672a52b8b8d43b3cf497d288af57d851ef02c2defc9586
SHA512a3acbd11d5c3d132bf968ce75842a456bde3bacdd39a2d60ccf0513d00ab5b8d62d86346b68dd89eb42b87240e18825fa74b68e1eb0d6dda35c09ed995cdcfb9
-
Filesize
62KB
MD5a216964ab28f54e9ec12f73207c1fe91
SHA1a8b9a3049233c1603ca7b71ca1ac442de13e1436
SHA256ec8d1f0035069d6552b3a12aee85c2307a10c94c4769d4ddd4868e9e10b33afc
SHA5126c806ffc7ae23c1818539257576e711ef0296ca1d0a132da0fc77145dab43c33a41cf54bd58abf9fa1135335c00596e8cff4a0f31231986230a14d93029f26f8
-
Filesize
75KB
MD52f5b7ce78c3a9d47f2f288051fc57e36
SHA1b59bad8ac2762e1d473c5fc75a2bf6c6936c9c72
SHA2562635b3ee42749a58138347ac577b59240047513166876c2b9ff5fac25f184652
SHA51205b98b2d45d3654865aba3a99717dc8a3a35b1b7c510beaa085bb4a4eb39caa5dde973883bd0a3b92e61c86cc1d5a0a286375b73f8a6c70af9823160289424c6
-
Filesize
200KB
MD57ec3d16685f1a49e0ea7ffa4536d239d
SHA11603e6b9e9910accfc35dc711792581bf6468854
SHA256a8acc0c9798946de909555f143f99c4a20bffdc1d0affa30addac4e902c72f74
SHA512327ed37c214c1ff5afa8159e21f9aad83fcc3ff28c3246a0da16bc824c77002bccc7a6483a8e06fd1e8333514c71525ea84e94d56e9fdf0ee5b44d8e44d3d2e3
-
Filesize
134KB
MD5ce1898aaefa0685319b0b1ce9edeb355
SHA1280d1ab8788faf7bc1326567c95b84bb741d8395
SHA25615d7010351178309baf929953b404c53284f7c3a5dd1b6e336db52a278c6d58f
SHA51215d4d32e1043a6f1152d6a13cc37e11ceab98aaf362b47b68f35e0d3e8a90d295977fbf74524e89c3619e966b8b6be66b614c91b6ac94a83f7a978dd5786abf1
-
Filesize
68KB
MD5a766442b6595bf4c242684d7a285ef84
SHA107e35acad189c43a9a3dedc66853e06541a9e73c
SHA2566c0a27448725c857de552b84642670481d2fe5c3fd7cf5533cc67146d60f1669
SHA512174613c8296f5aa5c01daf94f9b3346eb14d854630a0bd1c40ce9e86d2dfb90c8ad64cf340fff1e31c8df985837915dcdf28af312ea2a72b91881cb47d569c95
-
Filesize
112KB
MD50f54c2c61c86f31ff652c457886eaf39
SHA1fdeeab13d5faaa008d11cba4b9114d2192363585
SHA256fd7855f73f30f12042ea28e6502c723fc8c7e108844dcd48239f952eb59fdfb1
SHA512f238e216c397e017605af51c6966aadd5843207924e4089d6280ea7491c388176fadce11db4987f47cc6e53329026bc58f10ddd3a6645fbd84860a559e9fcafe
-
Filesize
164KB
MD59ca27a976342edfd9ea1381a7802b8b6
SHA187a55f2524ccea1d7b6ab89236aa506d6a2a455e
SHA256560cf2a72005278f373cf09196198c31967ab506b1f194414a7293a29bb1805e
SHA5129d59b1842b5f522a68a5f4e6d8a9f81de49c631c6667f18a98774011dc1644038cfbeb78ef51a3f68e5bc67a66592c83f70aa17079812e375bf87aabe6416a9c
-
Filesize
114KB
MD5cf841c8ac4724a43295b6d857639b4a7
SHA1abd6b869e5074271eecd88e1cbbd8e852f91fadf
SHA256800642e9cc36cfc4ccc8e985320b0730efea8d8a5c1489980eb4e07f7349af28
SHA512a623b08c1ca9632963668bf3bbcedcfb4be9b8f4ad0c615260bc5a68f2b4db82c584bab381bd0bcfc30b43fc903f0cdd8c46030060276bc3adfaff97fde3b11b
-
Filesize
62KB
MD59c5bc33aaa22573400a055cedf321b5f
SHA145e242506c6990b1f51d8430833c29481ebac468
SHA256ae056708a1c7d93c08c52bcd108f26e610373f882943a87be98aea96b3db4809
SHA512940920b7d1cec62c827d821c91324fcf78ade1ad42db4c3c46773a22ed156d8191c42c4ca89621a14c14e3dd7e36a2be9871ad22ba178ef9c018f6d733e3b6e0
-
Filesize
105KB
MD55e969448b7f189719cc1d37e85f0f6a3
SHA138efabdbe17c63ea0511b7fdc395eda531f15018
SHA256ebc648139bcd1847befdd7f059c407a7d70b00d33def0218077ae660c9329f26
SHA512c819ab1cf11f6c1ebc85546de5a013d2b0e9b6ee382b5afae8dd9d8b01be32ccbda8f5ef6afa37957cd5251a7182573cebfc30bf704b47388258b9881170160b
-
Filesize
322B
MD5b6ea95711f0e237d9de49dd1cc9aee82
SHA13f178836b34480aab8d0b70897f418b2b0d326ba
SHA256df0cc242fa69d2e977dca8bafe5c4539171bbb7f5a146397683fdb7be6ebce04
SHA51243459d257968d49fbc6060c6ccd63d67ede48515b4b6cdca30c46c67cb6bd75c211bebf44d71ee6eaf56a76d3b0a885271167c6dccaf333598da14a8612b9871
-
Filesize
44KB
MD584b7679ab9ca3356d6e760deacb99360
SHA11fb57f42c2c4a669c808255460b6ece3a5a64ad5
SHA2567f75536c9907bde92890ba00772756b632b1ed6f10088ce02eba0535671eaad4
SHA512223c8d9070c9dc3c23493d928542b220d59ed22f9eb9be0cd6ca3e7fb833c27cd51aa5f582f4194bd21d34e97383751b5012c96a934e7c2bc916064658422d2c
-
Filesize
1.3MB
MD5944e57aa00fdd46c02cc108ada88a667
SHA1b3f61ac3314076e904d34005a677b0a9173a13d6
SHA256fd2645cb2b1b9aeee70df96f4096942a39025fcfb04746fbec4242b29368f378
SHA5129791671dd0071b8de744827eabfed19cf370e249fecd2e21479a14c2ecc1f1d6643a6d85c8b00b3a92fa1b34b8e20405b3f1ed30692a059200730a76bf15defd
-
Filesize
21.8MB
MD5dbb8697f6a680af899ac2819893d4dce
SHA1a2d3e20202d678cfbb41fed5ca4f12dd46f76251
SHA2567b1e2e65dc1530cde96c249c30b5b62c70a5283a7e80933127036548fbdc5d0c
SHA512997e326f93b4a9575c7c1d7eb6f2cb1c591370f11d5e9dd8b3837bb0659e1ddb5dd3511f04a697acc61246709e78507f4ccc4e33d4c5a8d1ca7a7661f0fbd98f
-
Filesize
21.8MB
MD5f3911cff451f387ac688217091091f05
SHA14f853f369cf35f4d1b6efe8208933176964490d6
SHA2565f47d370b1b93fb3a05e838ea820d2a76901d46c357baccd0ba2d88b1b113b9e
SHA5120b103f0e15b1c8e671a8ee2eb80538e648ba10e382e8200180278c4c05e11d892438d6bc77807dc83dd1d2ae07720e08dde6633d6627203ab68f80fbf875d3c4
-
Filesize
21.8MB
MD5a2e93e814107576f2821f51166900bfc
SHA1687cc9ed2e3c5176d8f8996d6b00f952a39a746c
SHA2564133fba8ad95da03cb2ecd8602a91ff7f3828134621d8c0805163ab6902ca410
SHA512708151f529b8eb0ded89da0b03bb9547e458bd366db5b4235150e078253294cf9b2f365248066bb5aae621842ffaa1cbc319dc22d353f131939c62c7a9bc57a2
-
Filesize
21.8MB
MD5d3575ee4ec23e7fe7b2f708a0ad2c2ff
SHA18d3d4f1c648563b649a3e9ef9e15d4fad1f9e377
SHA2569897599db710206fff7d4a8830b03f5506d21bc3fcee85e10348065a87c52b6d
SHA51293cf33de8675619c6a3f3499a90f6d026f890f5ede37bd0d2cd2e5f59ef28085f8ee85a2b09224d2caf292908051a780d05ae651c7b51cbee19a9c99cf2cfd59
-
Filesize
21.8MB
MD5a49a457343dd6c959f498bb1f8d17add
SHA16b4f35a83e644a81e85e5d17a9ee23768b1912e9
SHA25628b8fce653a731555d6c832fb8a31fb700a77c7639b6fcde079df7e46a453e72
SHA512fef4f3ec7f03386c20966fa7db35aee2d7fa53f19b13df2861f3313f7e183b563a8530112a33d9accbdb8938051b486571ee1ee04648ed50157ef70e088de6ed
-
Filesize
21.8MB
MD5aa9010e1442fe7c2046d976928223ce9
SHA15e8521c98c95df893991f5989372ee763c19ad06
SHA256219b337b3065b2a525cbd1225e2126e8cc58afd3b7e14cc73e0f717a36bfa341
SHA5122cfef9afb1101bbda8670dc030476a9b4c9c9f3ee118a9fa834da9dcfe094822ca4d2fb43626d5ed4ad2d2d265a78754582854ad24b5c02767742db1919cca93
-
Filesize
27.3MB
MD53c8a8849d24e184712efeab67b9f47ea
SHA17fa7bdb396352233cdba739cf24e15652bd63327
SHA2564cd0325da9804ce27dcd9e4715a7d77d3441d4d3f16a5d293e8c28c29852d552
SHA51253382fe879c95461ae686ae3137173dac20f8c3af63a6c08df4faf3088322a030c653d33738b68fa37051b8dbc30e287794e833f3a5fdb583ff99af75ec3b915
-
Filesize
8KB
MD5fe08f91005abddd75cb2d3c35bb02918
SHA15e13771120fb9cfbcf7f04eda42a86705499782e
SHA25630f794f55ac9374fbaddd4c98cba6987edc65493e93dd824e38211a36a1a23ee
SHA512441d64e9a16d9177d1db7d0a89c41f0255c9ec2c4d40503f5e874ec2a5165578fa2a454e8e1585419c8d637a57f9f8513b34793ce0f33f13393d60b6b3d75ea0
-
Filesize
16KB
MD55bd550f60d394babe481ad520973be5f
SHA109636251c32d55ef8e2536fcf65f4a309a48a52b
SHA256c3cb870d5699a95e8e2a1d824c28a27af15a77af736379463e897b18b94184cb
SHA512e1df471faae794520c8200ed7cec68527559a15ebeb71da20e0b95fe59065d6631dfb2f1c9e0a8b4edfaab7ed7f78fab4d58d4d64f4d8c961d1fb9150b72fd6d
-
Filesize
16KB
MD5c3fc8b0445af1425fe319fe241a3f6d5
SHA1997617c45ffb21fccedec777abd40ab8736eb673
SHA256f2805deb39d830d0d212d7f80cf3116b63d2a07ae63d93fe3425b1c0ff392072
SHA51202e8270473d14429ce55cdf995580b87aaa8ac00425accc6641a7b2ec400a10da00496dbec3fc54ae512c2fd22b22c09bdce8f39d4eba160d41819e2286f12a4
-
Filesize
21.8MB
MD530d39be0d98134dcefe8149ba8dbc729
SHA14ad8507a77d5bc445fe85329290dcc0e57a81483
SHA256853d9941f85e7c3c2a5b757c785ecb8f1f1a0243b3127e915ecfce4ba641a8fe
SHA51215f8cbb94f8cede9331a0fbbe7b4b672b9822a56cd85beb476724f42281e9e9ce53948166288bdfab010f560c23fcab4ad1429ab4fe90c4a0883d8fb519fa0f0
-
Filesize
21.4MB
MD54e5e69fa3a300abc35b48734f5a1f2ed
SHA13349efaf93e03c7466edc7882fc83b29926ebe65
SHA2562145d9d698ee4b71ba8ef55f69a68336275bc58324fc1f139175875cc9f2fb9c
SHA51259a743fec2dc8913c57f460d7e92dde131547cb72ce8f026513fe622e85e54a4bef02c5786d4bb55587b5434a29c0d7e5357dc83c1ff4dd6b7eb65eacf67ee78
-
C:\ProgramData\Microsoft\Windows\Caches\{2843ADA2-0F67-4F78-92E2-B7A4AB26A670}.2.ver0x0000000000000002.db
Filesize44KB
MD545681a07a4652f2d638c77d506fbb1ee
SHA1a517d4eed3ceaf819cc253fccd6894196a18dbf8
SHA2563adfbcb59c44c3d773dd7e3ff823d0f5c99fafa8d7d60477a0b11f50bb2f9d45
SHA512d76f777718ecce896c3ee1e85fa4367cba844f43168c38ab787eb412e7e22bcab3ab4db8fc0648f2a542c231266061a5c314468846a7c2acdab5e0e1bbce7d89
-
Filesize
259B
MD5849985cca0747e719c2ece94788a251d
SHA13b6c50851ef51a485a61a5f5b3ec8255a9788312
SHA25628e4ac47a045f921afba8882b8a734d4eda80d7274105377d8d2670525ed2e63
SHA51205db7ea038dca03b0f73c1bf25ba774365df18a074b0245262a9fda537e105581fa1f88abf47a62b76328a57d1baf162424f9a781b0d7d11f4448435d68d365e
-
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\muqgv5xw.newcfg
Filesize1KB
MD592ef2b438ca5bf0a36a11165102af092
SHA11b9409047b80ceba51b18ff1b08fed068e0a4c7c
SHA2560854f1df92d97e676fe753e90c97513482ea9976a072bbcf73fb7e8c4a387784
SHA5126de4749de0a34674fb6e10a5d5922073e05c52bf08ca9a358c48c3f9acb403029309be1dd8fb8029a762255dbb00ad2927667866855b39ff5b013c2c9126c9da
-
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config
Filesize1KB
MD51543a151c570c3fd0b6fa8ad13ca53c5
SHA16f0a295ab64a7d46a4676b583ef5268480cafb7e
SHA256fc8ad8662e39f99604a2cf9eec0e04520172a5b17207a212fbc280373eaa2b58
SHA5123cc2f55ecc8b71d3a7acc1662de98e0c61824d563dbc051716914d07553cd1198ced7c6d3523f3b9b3146f11ff347caff56be8455ba5dd5b3fb4be10bd2a1487
-
Filesize
651B
MD579dd9d574bf7da4d10dee390db653a12
SHA1ddb3e64a2e79b01101cbd6d553eda0659451bc84
SHA2564c0cac895c138615c44f674f0a92304ec664e87fbd3721eb9f403cc03f2fea34
SHA512f08b39971a8cc77761dea295906bead275aac4011821a3ea1c0a78ae1162bbbb1cf51cc93fbbb7c72cc4ac1bd2cb7d69cdd27ef6ff93d31ef66be8f97615e4b7
-
Filesize
1KB
MD59097962cf60dc2e7a007e604591b92c1
SHA1effa2d4ad344e162d25a566509e81116cf7a9301
SHA2561ab9a19d4c0b6961cf1b8354a4daf004f74748916a1d5023493623fd7b4ff14b
SHA5124627522d791875e757f1bd19ae135e496900f855149fcf6791de51ec6ba4e826b4443ceccd627333de63b3e7e6f165e47cca2d273412e4428da07c9fe02b92d7
-
Filesize
228B
MD5d044d23e8084c869cbdae714ba47b866
SHA140d25b0fec3e43b7d966d02928d60904e32bd84a
SHA256f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd
SHA51262d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
32KB
MD582deb78891f430007e871a35ce28fac4
SHA14e490d7ec139a6cde53e3932d3122a48aa379904
SHA2562f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237
SHA512e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a
-
Filesize
127KB
MD593394d2866590fb66759f5f0263453f2
SHA12f0903d4b21a0231add1b4cd02e25c7c4974da84
SHA2565c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b
SHA512f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622
-
Filesize
693KB
MD552159f784cc0f57bddf39a17857a8ac2
SHA10788b586b3210cf004c827d396d8ccd851472ee4
SHA2564fb676db4f1de07697fe85568bcb6c1cd79c079a818add24cd15cc81ed29f20a
SHA512208911765072ca824613e3b65658b23f553c82390b8296f8aff7e07f702cd431cb6fdee7067f13525b85bf582062dea077be2e4f27e12d00bae3b0b244471201
-
Filesize
475KB
MD5b3259d1ef57ca51f12a28cd7cb5a03a3
SHA1a127b32a20540678be8554ddc53017e7df25f314
SHA25659e6e20cf85d317b5abd18078e5a551b21c56ca18e20fe1e45759bd3038482e7
SHA5121d8bfd6ad0c90b7278803f51c9c1bbeb429fe448779ef9abffb7758a8fcd6db704ae71a1af65da64b6c712b32c8af54884c3a77ef13b337f499c91e097114834
-
Filesize
384KB
MD5e1769fd831d70274d0183e3e68994684
SHA15db7df3a9a0cf3489272ed99d8cdf6105dc9a620
SHA256f6558d3f7c36fea39912c10e20d878244a079594a01173dd31918043b250f681
SHA512504f28d6ff9e72a6662500b192b0263735662c65adae507c65881bef865092f29473af576ce286a30a061a08a2098c078726ce8f6f8c932331fcb52317d76649
-
Filesize
879KB
MD539b2236a3c083292a14f65585ad73e28
SHA1012a24cc5993cbc33ebace8cace1c1dae1e899c3
SHA2564b930935f4a6ecf9908c9c50f969c5daea41c3de2bd6540cd6f220fd83bffe8d
SHA512d3b2f971fc856e3927603334ed428658000b4228776039c4c1c0c9811551209073873aea7130ae46dde2971f694d7fedd2a37dafd5ba325a7d0db24a8451f889
-
Filesize
55KB
MD5abd2f4a5cfa8a9608fb14e3fbf44871f
SHA1b5249f54a6a73c27bcbbdc07fb6c86d9745be35f
SHA25606c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5
SHA5127dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5
-
Filesize
621KB
MD5ec3d9350a9a400fb3271c7327f5bf5a8
SHA10eea26f71e7d03579303b9ffc34549fa7ac843e9
SHA256aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4
SHA512a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e
-
Filesize
1.8MB
MD51f79f405d3659eb62779f948a397967d
SHA1c01403d8ae03c41726f9f5d72f1b79dc3e96191b
SHA256b262d6ab962e2dfd034e63df34ad8aed15f1caf1ac1b1259facba9535fca71e4
SHA512b5a397b6f62ee5c7c2dae0cebcd509127200deb5f651eb5d850a2e9182a5eea67925e96df0e3b1ba9cb0f17a4ad78e29833ed3baf22e5e9ec07ff06d47d64ced
-
Filesize
279KB
MD596010203c9ad85132c021ce2d86536f9
SHA16db1c233ae2e5ab52798a027a597601c43a02715
SHA2568215daa9d609cf32d2b2344eb33d7cb612fa91fc2e1210929fd64b5eca6b1b85
SHA512ee4132abc306e60c1c29707bace7747128cc8f8f71bb3dc86407817dfa71e624e173b597a8da35a5f908095219e8d184cf040a62995aff988a12ecfa14d302cd
-
Filesize
1KB
MD5898c2a320bea0580f37beeccda8f2378
SHA1eccab214a148e6a7a9535bf1c83b714c756dabf2
SHA2564440270efc95c694150a665b62ca89b8b93b1271dfb2757e8dd1a68ef2705498
SHA512e4608aab984c6e97b00e80d2635a283392f1eb24bdb65f5fce92851eb63ad474e5050ac46e5cafe2dbd438dd026269253bd4ec427f08b2a09788d6b1d49bcc84
-
Filesize
87KB
MD5b0d10a2a622a322788780e7a3cbb85f3
SHA104d90b16fa7b47a545c1133d5c0ca9e490f54633
SHA256f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
SHA51262b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f
-
Filesize
647KB
MD55afda7c7d4f7085e744c2e7599279db3
SHA13a833eb7c6be203f16799d7b7ccd8b8c9d439261
SHA256f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4
SHA5127cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944
-
Filesize
114KB
MD589a2762f19597b82d5c501366e5b2f29
SHA1f5df7962015164e4bfed0ae361f988c1e581677e
SHA256a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167
SHA512bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13
-
Filesize
119KB
MD5c59832217903ce88793a6c40888e3cae
SHA16d9facabf41dcf53281897764d467696780623b8
SHA2569dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
SHA5121b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9
-
Filesize
41.4MB
MD5d7677284befc5f541d560e631a0861ad
SHA1bbed67a5a597df83cf3d2a7ca7c26716571cb87f
SHA256eaf4cc8809c1ad671e63b8c4bae50eda8924e23e507df272a0f0f6fad4d23cf8
SHA5120fd95dcb5efffbc06c3b21e60ad9c4112cc59aa462e20067ab4f19843ee46f3ea6e7e9a5af3b8e49f9cf93df6b8e3819450c0b6724d049c04be7ee4189b76fd2
-
Filesize
3.1MB
MD5b25f06e4ed0166ac822e48068e334b00
SHA15f44162e567a979323a1b734e651b60affaad674
SHA256a66066c6fbaabee2011956619a0bdf3606b40f4eddedecabb82bb321ceeb2f72
SHA51203280db188f38387d7d11073f36caf9ed05fd266b3d155b4bf0ba4ac1bccce422d552ccc39465e2b5ff0996b0a24904304d6f5b269f3e38432cc73235fface50