zgrat | 93e92273784deb9659b37c211cef5366463753a90abbf1e9b9846d82ff7aaadb

Analysis

max time kernel
116s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adguardInstaller.exe
Size

142KB
MD5

2778418f6e0d048617221386ed96109c
SHA1

bdff4500e90506ec9944691e0f449dc2d7a9454b
SHA256

93e92273784deb9659b37c211cef5366463753a90abbf1e9b9846d82ff7aaadb
SHA512

c7547344992511b53241426b2bb8c2fa55bddf6358300a2bc60a73b42bf7a493822b57a285c718e4b3cc6ed0bbbc22069fb0d908ff8e77c4e92337fd0d7cb6f0
SSDEEP

3072:r4qZHnMyBV3vChLFvGyfmKvK9MkBry8wpspx:r4qZHdV3vevK9MkhkpYx

Score

10^/10

zgrat discovery persistence rat

Malware Config

Signatures

Detect ZGRat V1 8 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b6d-111.dat	family_zgrat_v1
behavioral1/memory/4576-114-0x00000000071C0000-0x00000000072A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4576-124-0x00000000077C0000-0x0000000007984000-memory.dmp	family_zgrat_v1
behavioral1/files/0x00150000000239bc-122.dat	family_zgrat_v1
behavioral1/memory/3464-544-0x0000027AF4DB0000-0x0000027AF4F74000-memory.dmp	family_zgrat_v1
behavioral1/memory/3464-545-0x0000027AF4F80000-0x0000027AF5060000-memory.dmp	family_zgrat_v1
behavioral1/memory/3464-550-0x0000027AF4DB0000-0x0000027AF4F74000-memory.dmp	family_zgrat_v1
behavioral1/memory/3464-559-0x0000027AF5AF0000-0x0000027AF5CA0000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\vwifikerneldrv.sys	AdguardSvc.exe
File opened for modification	C:\Windows\system32\Drivers\vwifikerneldrv.sys	AdguardSvc.exe
File created	C:\Windows\system32\drivers\adgnetworkwfpdrv.sys	AdguardSvc.exe
File opened for modification	C:\Windows\system32\drivers\adgnetworkwfpdrv.sys	AdguardSvc.exe

Manipulates Digital Signatures 1 TTPs 12 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	AdguardSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	AdguardSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	AdguardSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	AdguardSvc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adguard = "\"C:\\Program Files\\AdGuard\\Adguard.exe\" /nosplash"	AdguardSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5} = "\"C:\\ProgramData\\Package Cache\\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\\adgSetup.exe\" /burn.runonce"	adgSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adguard = "\"C:\\Program Files\\AdGuard\\Adguard.exe\" /nosplash"	rundll32.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
51	2980	msiexec.exe
53	2980	msiexec.exe
55	2980	msiexec.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	setup.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\prfc0003.dat.tmp	AdguardSvc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Adguard.BrowserExtensionHost.exe.log	Adguard.BrowserExtensionHost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Adguard.Tools.exe.log	Adguard.Tools.exe
File created	C:\Windows\system32\d3dx9_11.dll.tmp	AdguardSvc.exe
File opened for modification	C:\Windows\system32\d3dx9_11.dll.tmp	AdguardSvc.exe
File created	C:\Windows\system32\prfc0003.dat.tmp	AdguardSvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.cs.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdguardSvc.exe	msiexec.exe
File created	C:\Program Files\AdGuard\nss\freebl3.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Drivers\win10\arm64\adgnetworkwfpdrv.sys	AdguardSvc.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworktdidrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\Drivers\x86\adgnetworktdidrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\AdGuard.CrashReporter.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.sv.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdGuard.Utils.UI.PlatformDependent.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\Drivers\x86\AdguardNetLib.dll	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.zh-TW.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\libnspr4.dll	msiexec.exe
File created	C:\Program Files\AdGuard\SharpRaven.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Adguard.CoreApi.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Adguard.Tools.exe.manifest	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.hu.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.it.dll	msiexec.exe
File created	C:\Program Files\AdGuard\x64\AdguardCoreTools.dll	msiexec.exe
File created	C:\Program Files\AdGuard\drivers.bin	msiexec.exe
File created	C:\Program Files\AdGuard\Drivers\x64\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.cs.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.pt-BR.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdguardSvc.exe.config	msiexec.exe
File created	C:\Program Files\AdGuard\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe	AdguardSvc.exe
File created	C:\Program Files\AdGuard\Drivers\x64\adgnetworktdidrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\Adguard.Dns.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.fa.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.fr.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.it.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.uk.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\libplc4.dll	msiexec.exe
File created	C:\Program Files\AdGuard\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.de.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.ko.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.ja.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.mk.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.sv.dll	msiexec.exe
File created	C:\Program Files\AdGuard\x86\AdguardCore.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\AdguardNetReg.log	AdguardNetReg.exe
File created	C:\Program Files\AdGuard\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.fr.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Adguard.exe.config	msiexec.exe
File created	C:\Program Files\AdGuard\Adguard.Ipc.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.zh.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.tr.dll	msiexec.exe
File created	C:\Program Files\AdGuard\x64\AdguardCore.dll	msiexec.exe
File created	C:\Program Files\AdGuard\ICSharpCode.AvalonEdit.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\libplds4.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.hr.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.zh-TW.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.id.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.pl.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdguardSvc.exe.manifest	msiexec.exe
File created	C:\Program Files\AdGuard\x86\AGIpHelperClose.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\AdguardNetReg.log	AdguardNetReg.exe
File created	C:\Program Files\AdGuard\Adguard.BrowserExtensionHost.exe	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.es.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.da.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.ja.dll	msiexec.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC4B5.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA379.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA379.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Uninstall.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA153.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA153.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8211.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8211.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAAD3.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC4B5.tmp-\warning.ico	rundll32.exe
File created	C:\Windows\WinSxS\poqexecv2sys.log	AdguardSvc.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA378.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAD3.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAAD3.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC4B5.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8211.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8211.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC4B5.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA153.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA445.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e577c54.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA153.tmp-\Adguard.CustomActions.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA379.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC4B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA153.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA153.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Uninstall.exe	msiexec.exe
File created	C:\Windows\Installer\e577c58.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAC2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA379.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC4B5.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA4C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAD3.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAA05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8211.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA379.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA91A.tmp	msiexec.exe
File created	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe	msiexec.exe
File created	C:\Windows\Installer\wix{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIA379.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAAD3.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAAD3.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e577c54.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8211.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA379.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC4B5.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8211.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA153.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA24E.tmp	msiexec.exe

Executes dropped EXE 10 IoCs

pid	Process
4608	setup.exe
4576	setup.exe
2276	adgSetup.exe
3464	AdguardSvc.exe
3660	Adguard.BrowserExtensionHost.exe
4072	Adguard.Tools.exe
1316	Adguard.exe
4416	AdguardNetReg.exe
5108	AdguardNetReg.exe
5380	AdguardNetReg.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5428	sc.exe
1032	sc.exe
3844	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
4576	setup.exe
5380	MsiExec.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
5380	MsiExec.exe
404	rundll32.exe
404	rundll32.exe
404	rundll32.exe
5380	MsiExec.exe
5172	rundll32.exe
5172	rundll32.exe
5172	rundll32.exe
1012	MsiExec.exe
5380	MsiExec.exe
4764	rundll32.exe
4764	rundll32.exe
4764	rundll32.exe
1012	MsiExec.exe
1012	MsiExec.exe
1012	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1012	MsiExec.exe
5380	MsiExec.exe
3832	rundll32.exe
3832	rundll32.exe
3832	rundll32.exe
3464	AdguardSvc.exe
3464	AdguardSvc.exe
3464	AdguardSvc.exe
3464	AdguardSvc.exe
3464	AdguardSvc.exe
3464	AdguardSvc.exe
3464	AdguardSvc.exe
5380	MsiExec.exe
2408	rundll32.exe
2408	rundll32.exe
2408	rundll32.exe
3660	Adguard.BrowserExtensionHost.exe
3660	Adguard.BrowserExtensionHost.exe
1316	Adguard.exe
1316	Adguard.exe
3464	AdguardSvc.exe
3464	AdguardSvc.exe
4416	AdguardNetReg.exe
5108	AdguardNetReg.exe
5380	AdguardNetReg.exe

Registers COM server for autorun 1 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1960	schtasks.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1364	ipconfig.exe
4308	ipconfig.exe
5664	ipconfig.exe
4904	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AdguardSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	AdguardSvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\EditFlags = "2"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\IE.AssocFile.HTM	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\ContextMenuHandlers	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Dependents\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}	adgSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\ = "URL:File Transfer Protocol"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\EditFlags = "131074"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.partial\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\xhtmlfile	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\CommandId = "IE.File"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\open	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdns\shell	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\EditFlags = "2"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\{000214F9-0000-0000-C000-000000000046}	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\{00021500-0000-0000-C000-000000000046}	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-32554"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg\Content Type = "image/svg+xml"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\ = "&Open"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdns\shell\open\command\ = "\"C:\\Program Files\\AdGuard\\Adguard.Tools.exe\" /customProtocol \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.url	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\CLSID	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\PackageName = "setup.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5731"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\ = "&Open"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\Version = "118559333"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht\ = "xhtmlfile"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht\Content Type = "application/xhtml+xml"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\CommandId = "IE.File"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ = "open"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\mshtml.dll\",PrintHTML \"%1\" \"%2\" \"%3\" \"%4\""	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\mshtml.dll\",PrintHTML \"%1\""	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}v7.17.4709.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdns\DefaultIcon	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdns\shell\open	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg\OpenWithProgIds\svgfile	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\ = "Open in S&ame Window"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3d8c7bf-71f5-4be7-96d5-f29d13e0adc5}\Dependents	adgSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,0"	ie4uinit.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	AdguardSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdguardSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdguardSvc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe
4556	rundll32.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	setup.exe
Token: SeShutdownPrivilege	2276	adgSetup.exe
Token: SeIncreaseQuotaPrivilege	2276	adgSetup.exe
Token: SeSecurityPrivilege	2980	msiexec.exe
Token: SeCreateTokenPrivilege	2276	adgSetup.exe
Token: SeAssignPrimaryTokenPrivilege	2276	adgSetup.exe
Token: SeLockMemoryPrivilege	2276	adgSetup.exe
Token: SeIncreaseQuotaPrivilege	2276	adgSetup.exe
Token: SeMachineAccountPrivilege	2276	adgSetup.exe
Token: SeTcbPrivilege	2276	adgSetup.exe
Token: SeSecurityPrivilege	2276	adgSetup.exe
Token: SeTakeOwnershipPrivilege	2276	adgSetup.exe
Token: SeLoadDriverPrivilege	2276	adgSetup.exe
Token: SeSystemProfilePrivilege	2276	adgSetup.exe
Token: SeSystemtimePrivilege	2276	adgSetup.exe
Token: SeProfSingleProcessPrivilege	2276	adgSetup.exe
Token: SeIncBasePriorityPrivilege	2276	adgSetup.exe
Token: SeCreatePagefilePrivilege	2276	adgSetup.exe
Token: SeCreatePermanentPrivilege	2276	adgSetup.exe
Token: SeBackupPrivilege	2276	adgSetup.exe
Token: SeRestorePrivilege	2276	adgSetup.exe
Token: SeShutdownPrivilege	2276	adgSetup.exe
Token: SeDebugPrivilege	2276	adgSetup.exe
Token: SeAuditPrivilege	2276	adgSetup.exe
Token: SeSystemEnvironmentPrivilege	2276	adgSetup.exe
Token: SeChangeNotifyPrivilege	2276	adgSetup.exe
Token: SeRemoteShutdownPrivilege	2276	adgSetup.exe
Token: SeUndockPrivilege	2276	adgSetup.exe
Token: SeSyncAgentPrivilege	2276	adgSetup.exe
Token: SeEnableDelegationPrivilege	2276	adgSetup.exe
Token: SeManageVolumePrivilege	2276	adgSetup.exe
Token: SeImpersonatePrivilege	2276	adgSetup.exe
Token: SeCreateGlobalPrivilege	2276	adgSetup.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeDebugPrivilege	4556	rundll32.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeDebugPrivilege	404	rundll32.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeDebugPrivilege	4764	rundll32.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeShutdownPrivilege	1876	MsiExec.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeRestorePrivilege	2980	msiexec.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe
1316	Adguard.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4608	1268	adguardInstaller.exe	92
PID 1268 wrote to memory of 4608	1268	adguardInstaller.exe	92
PID 1268 wrote to memory of 4608	1268	adguardInstaller.exe	92
PID 4608 wrote to memory of 4576	4608	setup.exe	93
PID 4608 wrote to memory of 4576	4608	setup.exe	93
PID 4608 wrote to memory of 4576	4608	setup.exe	93
PID 4576 wrote to memory of 2276	4576	setup.exe	101
PID 4576 wrote to memory of 2276	4576	setup.exe	101
PID 4576 wrote to memory of 2276	4576	setup.exe	101
PID 2980 wrote to memory of 5380	2980	msiexec.exe	104
PID 2980 wrote to memory of 5380	2980	msiexec.exe	104
PID 5380 wrote to memory of 4556	5380	MsiExec.exe	105
PID 5380 wrote to memory of 4556	5380	MsiExec.exe	105
PID 5380 wrote to memory of 404	5380	MsiExec.exe	109
PID 5380 wrote to memory of 404	5380	MsiExec.exe	109
PID 5380 wrote to memory of 5172	5380	MsiExec.exe	110
PID 5380 wrote to memory of 5172	5380	MsiExec.exe	110
PID 2980 wrote to memory of 1012	2980	msiexec.exe	111
PID 2980 wrote to memory of 1012	2980	msiexec.exe	111
PID 2980 wrote to memory of 1012	2980	msiexec.exe	111
PID 5380 wrote to memory of 4764	5380	MsiExec.exe	112
PID 5380 wrote to memory of 4764	5380	MsiExec.exe	112
PID 2980 wrote to memory of 1876	2980	msiexec.exe	114
PID 2980 wrote to memory of 1876	2980	msiexec.exe	114
PID 2980 wrote to memory of 1876	2980	msiexec.exe	114
PID 5380 wrote to memory of 3832	5380	MsiExec.exe	115
PID 5380 wrote to memory of 3832	5380	MsiExec.exe	115
PID 3832 wrote to memory of 2092	3832	rundll32.exe	117
PID 3832 wrote to memory of 2092	3832	rundll32.exe	117
PID 3832 wrote to memory of 4416	3832	rundll32.exe	118
PID 3832 wrote to memory of 4416	3832	rundll32.exe	118
PID 4416 wrote to memory of 3824	4416	cmd.exe	120
PID 4416 wrote to memory of 3824	4416	cmd.exe	120
PID 3824 wrote to memory of 5764	3824	net.exe	121
PID 3824 wrote to memory of 5764	3824	net.exe	121
PID 5380 wrote to memory of 2408	5380	MsiExec.exe	123
PID 5380 wrote to memory of 2408	5380	MsiExec.exe	123
PID 4576 wrote to memory of 5428	4576	setup.exe	124
PID 4576 wrote to memory of 5428	4576	setup.exe	124
PID 4576 wrote to memory of 5428	4576	setup.exe	124
PID 3464 wrote to memory of 3660	3464	AdguardSvc.exe	127
PID 3464 wrote to memory of 3660	3464	AdguardSvc.exe	127
PID 3464 wrote to memory of 1360	3464	AdguardSvc.exe	129
PID 3464 wrote to memory of 1360	3464	AdguardSvc.exe	129
PID 3464 wrote to memory of 1360	3464	AdguardSvc.exe	129
PID 3464 wrote to memory of 1032	3464	AdguardSvc.exe	130
PID 3464 wrote to memory of 1032	3464	AdguardSvc.exe	130
PID 3464 wrote to memory of 4980	3464	AdguardSvc.exe	134
PID 3464 wrote to memory of 4980	3464	AdguardSvc.exe	134
PID 1360 wrote to memory of 1960	1360	cmd.exe	133
PID 1360 wrote to memory of 1960	1360	cmd.exe	133
PID 1360 wrote to memory of 1960	1360	cmd.exe	133
PID 3464 wrote to memory of 3844	3464	AdguardSvc.exe	136
PID 3464 wrote to memory of 3844	3464	AdguardSvc.exe	136
PID 4980 wrote to memory of 6092	4980	cmd.exe	138
PID 4980 wrote to memory of 6092	4980	cmd.exe	138
PID 3464 wrote to memory of 4072	3464	AdguardSvc.exe	140
PID 3464 wrote to memory of 4072	3464	AdguardSvc.exe	140
PID 3464 wrote to memory of 764	3464	AdguardSvc.exe	141
PID 3464 wrote to memory of 764	3464	AdguardSvc.exe	141
PID 764 wrote to memory of 6068	764	cmd.exe	143
PID 764 wrote to memory of 6068	764	cmd.exe	143
PID 3464 wrote to memory of 3212	3464	AdguardSvc.exe	144
PID 3464 wrote to memory of 3212	3464	AdguardSvc.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
  C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe AID=18673_page_es_welcome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\Temp\{0A0BF5D6-2FFD-4832-9DBC-6FE7527C6431}\.cr\setup.exe
    "C:\Windows\Temp\{0A0BF5D6-2FFD-4832-9DBC-6FE7527C6431}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=724 -burn.filehandle.self=720 AID=18673_page_es_welcome
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.be\adgSetup.exe
      "C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.be\adgSetup.exe" -q -burn.elevated BurnPipe.{2623E746-9304-4B3B-99F8-8D02DCEB933D} {E0EDEC97-D15B-4D1F-9581-C1655BAD4803} 4576
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2276
  - - C:\Windows\SysWOW64\sc.exe
      "sc" query adgnetworktdidrv
      4⤵
      Launches sc.exe
      PID:5428

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 17B38CD37B9716E5BEE60B7CE66B38B0
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8211.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240616078 2 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstall
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI981A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240621640 14 Adguard.CustomActions!Adguard.CustomActions.CustomActions.PermanentActions
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA153.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240624031 33 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallInitialize
    3⤵
    - Manipulates Digital Signatures
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:5172
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA379.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240624531 59 Adguard.CustomActions!Adguard.CustomActions.CustomActions.CheckServiceStop
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIAAD3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240626375 101 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallFinalize
    3⤵
    - Manipulates Digital Signatures
    - Adds Run key to start application
    - Drops file in Windows directory
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\system32\ie4uinit.exe
      "ie4uinit.exe" -show
      4⤵
      Modifies Installed Components in the registry
      Registers COM server for autorun
      Modifies Internet Explorer settings
      Modifies registry class
      PID:2092
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /C "net start "Adguard Service""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Windows\system32\net.exe
        
        net start "Adguard Service"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3824
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start "Adguard Service"
        6⤵
        
        PID:5764
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC4B5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240633000 141 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:2408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B4526DE801A81B8BF33E437EB8BABC8D
  2⤵
  - Loads dropped DLL
  PID:1012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1616364C242B623AB322585A396FD3C E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1876

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5516

C:\Program Files\AdGuard\AdguardSvc.exe
"C:\Program Files\AdGuard\AdguardSvc.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files\AdGuard\Adguard.BrowserExtensionHost.exe
  "Adguard.BrowserExtensionHost.exe" /register
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3660
- C:\Windows\SysWOW64\cmd.exe
  /c "schtasks /create /xml "C:\Program Files\AdGuard\config-9fb1980798fe4d179188c96f8f441649.xml" /tn 9fb1980798fe4d179188c96f8f441649 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /xml "C:\Program Files\AdGuard\config-9fb1980798fe4d179188c96f8f441649.xml" /tn 9fb1980798fe4d179188c96f8f441649 /f
    3⤵
    - Creates scheduled task(s)
    PID:1960
- C:\Windows\SYSTEM32\sc.exe
  "sc" sdshow "Adguard Service"
  2⤵
  - Launches sc.exe
  PID:1032
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "schtasks /run /tn 9fb1980798fe4d179188c96f8f441649"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn 9fb1980798fe4d179188c96f8f441649
    3⤵
    PID:6092
- C:\Windows\SYSTEM32\sc.exe
  "sc" sdset "Adguard Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  PID:3844
- C:\Program Files\AdGuard\Adguard.Tools.exe
  "C:\Program Files\AdGuard\Adguard.Tools.exe" /clean_runouce
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "schtasks /delete /tn 9fb1980798fe4d179188c96f8f441649 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn 9fb1980798fe4d179188c96f8f441649 /f
    3⤵
    PID:6068
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:3212
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:1364
- C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
  "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4416
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:3104
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:3164
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5664
- C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
  "Drivers\x64\AdguardNetReg.exe" -u adgnetworkwfpdrv
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5108
- C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
  "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5380
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:4216
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4904

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe" /nosplash
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e577c57.rbs

Filesize
358KB

MD5
cb755d74d516b62e697cf4bd72c4eba5

SHA1
db64f10f2bfc3c9713699295cb1a573126ec8e92

SHA256
652e4027befaeda7f0c9d9343a58d9dda12c9b92bc89f73863c370ef19faf049

SHA512
cfbaec7a40126bbed18f92c657aeff2f04033b9fba2f72c9445c1ef7bed3e9373156eae6b98a346815fb49475ed64c733376f0ddc66f9eb8bbf56b82398b5993

Download Submit
C:\Program Files\AdGuard\Adguard.exe

Filesize
6.8MB

MD5
269d75aecda348d7036692d27e09af3c

SHA1
46a11632f13c8be9bf978bc00493d09f105d216e

SHA256
aa15aaaaf06cf68387f07435d95a7e738aab868bfa28941703680d1ef6d2c8da

SHA512
db96e23a546dac5f65ff18c5b2e95b0a2ca93013a49e9281e39496b114748dde20fd79833063950891c75998878b1a80b1115d7e071b3799f2c5cfcfd4280f1d

Download Submit
C:\Program Files\AdGuard\Drivers\arm64\AdguardNetLib.dll

Filesize
192KB

MD5
7257436b13445d12a54aaf9cbff8f029

SHA1
45c908ae57133fb87ea77d0aef20ad268b0c721b

SHA256
374512cb07d70a9ccf2b43affb96ab99fc02dcf07ef70b7b38f0c279b12991ca

SHA512
69c13443db0b7128099cfaa914018393c043ca96c25764b1be10035bba0db8efeabe2725473b95aef704e9de971462c3e615610188e5479a5067331d6096d764

Download Submit
C:\Program Files\AdGuard\Drivers\arm64\AdguardNetReg.exe

Filesize
127KB

MD5
0c6bc1676b5e7a48a52a015405925f8f

SHA1
c8b85daec736ce4217ddcc3a41f9c261ff635053

SHA256
32826a974608c145b2a2ffc925d5698e179cf08e04bc957aea3293344d9616a3

SHA512
3f750d99e8b01545afd1261883d5fa6990fd8ecdfabe62564c3e7cc1f423f0e409b6305cba2582f89e439c6690aa6c4f8ba5a71a0d7d0494f29692304dc3b858

Download Submit
C:\Program Files\AdGuard\Drivers\arm\AdguardNetLib.dll

Filesize
153KB

MD5
520658c251bcde9fe6c71fb0f0d20986

SHA1
db75ddf587c128c315a3ba98e1c96749111a3374

SHA256
09d7da40bb51e62000ae46cc625490f559c035d6d059bd8657ef8b6d103cab20

SHA512
2785563612e0c4507256dc260c195919f0072aa730f2d5a842cd59823a5fc1db45303c9dbf6537bbe1e971a8a61cc436c4d6d2a4ad79bb727cc8c6f3835169dc

Download Submit
C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe

Filesize
101KB

MD5
8e37e56d595056bf58e4840b2e0a6312

SHA1
5f82d763f0eb83ae16f0a51dd9b64c3f1db8a3f2

SHA256
3bcd226bf0a6de378ee6ff79e5a2c19260f15f28633174ce23472fbfc8aa331a

SHA512
f35b6da8d6454f52e8555c001fcf216b6c8d04486c2cd28a59028354be596cd6a4cecfe6f6537070f4ed21cf303849cbc4009ed72540efc84f6fdf5ee19c309a

Download Submit
C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys

Filesize
60KB

MD5
fcb1f6082b2dd42faae9e2fd76de5920

SHA1
fd312dee422bdae43cfd9beec596e2e1a806efe4

SHA256
2b743aac00d054e7c041200c88950305035c70da3d415c05eeb7844b040d93ce

SHA512
52db56608282ff6d18c380710a1d495c45f1c4cd0ed224abbd58a77ded237f347fec96401036b6510fba0735d65721799c65d070436b919bf92b07dc2ff05dfe

Download Submit
C:\Program Files\AdGuard\Drivers\win10\arm64\adgnetworkwfpdrv.sys

Filesize
88KB

MD5
7d26090469f422f0dab254be116f1917

SHA1
55943137295bb8a9400ac73f5dadd648df6fe155

SHA256
4d3d8984523fafd3aa4ba35b9eeb348ea5a6b284b54e92a03e608dc17f71f44d

SHA512
8bd3b4a3ab71a2b22b7ce268605f739a76a12ae2976cce76a81279746890c39a281cf2aa98840178520056924c30d145374402b9a5f4a219eb978f9ccb0a9f1e

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys

Filesize
68KB

MD5
4a83e369a535895500cef8f099cc1818

SHA1
4d5697c783f877f823f03e6b77e1a07f79e17b9c

SHA256
2458d32c657b52a79703c26db4ee0503164ea4b764580c67492bfbbb9522596b

SHA512
956932d81026d1648d2adccb3a2ffbdd7a6ac14f1642e154dae98218c4fe500fd9d729fb5c0b96a51d49a711560ee7bfaabf610af562e7f2d4701c63935dc4e3

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworkwfpdrv.sys

Filesize
87KB

MD5
73210a1c72d9946fd168c961c2d0916e

SHA1
ab848f3bbac8334275c8093e30b561fd71c46ccc

SHA256
274b4429872e302bd0672a52b8b8d43b3cf497d288af57d851ef02c2defc9586

SHA512
a3acbd11d5c3d132bf968ce75842a456bde3bacdd39a2d60ccf0513d00ab5b8d62d86346b68dd89eb42b87240e18825fa74b68e1eb0d6dda35c09ed995cdcfb9

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworktdidrv.sys

Filesize
62KB

MD5
a216964ab28f54e9ec12f73207c1fe91

SHA1
a8b9a3049233c1603ca7b71ca1ac442de13e1436

SHA256
ec8d1f0035069d6552b3a12aee85c2307a10c94c4769d4ddd4868e9e10b33afc

SHA512
6c806ffc7ae23c1818539257576e711ef0296ca1d0a132da0fc77145dab43c33a41cf54bd58abf9fa1135335c00596e8cff4a0f31231986230a14d93029f26f8

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys

Filesize
75KB

MD5
2f5b7ce78c3a9d47f2f288051fc57e36

SHA1
b59bad8ac2762e1d473c5fc75a2bf6c6936c9c72

SHA256
2635b3ee42749a58138347ac577b59240047513166876c2b9ff5fac25f184652

SHA512
05b98b2d45d3654865aba3a99717dc8a3a35b1b7c510beaa085bb4a4eb39caa5dde973883bd0a3b92e61c86cc1d5a0a286375b73f8a6c70af9823160289424c6

Download Submit
C:\Program Files\AdGuard\Drivers\x64\AdguardNetLib.dll

Filesize
200KB

MD5
7ec3d16685f1a49e0ea7ffa4536d239d

SHA1
1603e6b9e9910accfc35dc711792581bf6468854

SHA256
a8acc0c9798946de909555f143f99c4a20bffdc1d0affa30addac4e902c72f74

SHA512
327ed37c214c1ff5afa8159e21f9aad83fcc3ff28c3246a0da16bc824c77002bccc7a6483a8e06fd1e8333514c71525ea84e94d56e9fdf0ee5b44d8e44d3d2e3

Download Submit
C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe

Filesize
134KB

MD5
ce1898aaefa0685319b0b1ce9edeb355

SHA1
280d1ab8788faf7bc1326567c95b84bb741d8395

SHA256
15d7010351178309baf929953b404c53284f7c3a5dd1b6e336db52a278c6d58f

SHA512
15d4d32e1043a6f1152d6a13cc37e11ceab98aaf362b47b68f35e0d3e8a90d295977fbf74524e89c3619e966b8b6be66b614c91b6ac94a83f7a978dd5786abf1

Download Submit
C:\Program Files\AdGuard\Drivers\x64\adgnetworktdidrv.sys

Filesize
68KB

MD5
a766442b6595bf4c242684d7a285ef84

SHA1
07e35acad189c43a9a3dedc66853e06541a9e73c

SHA256
6c0a27448725c857de552b84642670481d2fe5c3fd7cf5533cc67146d60f1669

SHA512
174613c8296f5aa5c01daf94f9b3346eb14d854630a0bd1c40ce9e86d2dfb90c8ad64cf340fff1e31c8df985837915dcdf28af312ea2a72b91881cb47d569c95

Download Submit
C:\Program Files\AdGuard\Drivers\x64\adgnetworkwfpdrv.sys

Filesize
112KB

MD5
0f54c2c61c86f31ff652c457886eaf39

SHA1
fdeeab13d5faaa008d11cba4b9114d2192363585

SHA256
fd7855f73f30f12042ea28e6502c723fc8c7e108844dcd48239f952eb59fdfb1

SHA512
f238e216c397e017605af51c6966aadd5843207924e4089d6280ea7491c388176fadce11db4987f47cc6e53329026bc58f10ddd3a6645fbd84860a559e9fcafe

Download Submit
C:\Program Files\AdGuard\Drivers\x86\AdguardNetLib.dll

Filesize
164KB

MD5
9ca27a976342edfd9ea1381a7802b8b6

SHA1
87a55f2524ccea1d7b6ab89236aa506d6a2a455e

SHA256
560cf2a72005278f373cf09196198c31967ab506b1f194414a7293a29bb1805e

SHA512
9d59b1842b5f522a68a5f4e6d8a9f81de49c631c6667f18a98774011dc1644038cfbeb78ef51a3f68e5bc67a66592c83f70aa17079812e375bf87aabe6416a9c

Download Submit
C:\Program Files\AdGuard\Drivers\x86\AdguardNetReg.exe

Filesize
114KB

MD5
cf841c8ac4724a43295b6d857639b4a7

SHA1
abd6b869e5074271eecd88e1cbbd8e852f91fadf

SHA256
800642e9cc36cfc4ccc8e985320b0730efea8d8a5c1489980eb4e07f7349af28

SHA512
a623b08c1ca9632963668bf3bbcedcfb4be9b8f4ad0c615260bc5a68f2b4db82c584bab381bd0bcfc30b43fc903f0cdd8c46030060276bc3adfaff97fde3b11b

Download Submit
C:\Program Files\AdGuard\Drivers\x86\adgnetworktdidrv.sys

Filesize
62KB

MD5
9c5bc33aaa22573400a055cedf321b5f

SHA1
45e242506c6990b1f51d8430833c29481ebac468

SHA256
ae056708a1c7d93c08c52bcd108f26e610373f882943a87be98aea96b3db4809

SHA512
940920b7d1cec62c827d821c91324fcf78ade1ad42db4c3c46773a22ed156d8191c42c4ca89621a14c14e3dd7e36a2be9871ad22ba178ef9c018f6d733e3b6e0

Download Submit
C:\Program Files\AdGuard\Drivers\x86\adgnetworkwfpdrv.sys

Filesize
105KB

MD5
5e969448b7f189719cc1d37e85f0f6a3

SHA1
38efabdbe17c63ea0511b7fdc395eda531f15018

SHA256
ebc648139bcd1847befdd7f059c407a7d70b00d33def0218077ae660c9329f26

SHA512
c819ab1cf11f6c1ebc85546de5a013d2b0e9b6ee382b5afae8dd9d8b01be32ccbda8f5ef6afa37957cd5251a7182573cebfc30bf704b47388258b9881170160b

Download Submit
C:\ProgramData\Adguard\Backups\user_S-1-5-21-3411335054-1982420046-2118495756-1000.config

Filesize
322B

MD5
b6ea95711f0e237d9de49dd1cc9aee82

SHA1
3f178836b34480aab8d0b70897f418b2b0d326ba

SHA256
df0cc242fa69d2e977dca8bafe5c4539171bbb7f5a146397683fdb7be6ebce04

SHA512
43459d257968d49fbc6060c6ccd63d67ede48515b4b6cdca30c46c67cb6bd75c211bebf44d71ee6eaf56a76d3b0a885271167c6dccaf333598da14a8612b9871

Download Submit
C:\ProgramData\Adguard\Core\sfbr.db

Filesize
44KB

MD5
84b7679ab9ca3356d6e760deacb99360

SHA1
1fb57f42c2c4a669c808255460b6ece3a5a64ad5

SHA256
7f75536c9907bde92890ba00772756b632b1ed6f10088ce02eba0535671eaad4

SHA512
223c8d9070c9dc3c23493d928542b220d59ed22f9eb9be0cd6ca3e7fb833c27cd51aa5f582f4194bd21d34e97383751b5012c96a934e7c2bc916064658422d2c

Download Submit
C:\ProgramData\Adguard\DnsFilters\ec6fbff8ccbf4b11bc0f3ea86347e36d\dns_filter_15.txt

Filesize
1.3MB

MD5
944e57aa00fdd46c02cc108ada88a667

SHA1
b3f61ac3314076e904d34005a677b0a9173a13d6

SHA256
fd2645cb2b1b9aeee70df96f4096942a39025fcfb04746fbec4242b29368f378

SHA512
9791671dd0071b8de744827eabfed19cf370e249fecd2e21479a14c2ecc1f1d6643a6d85c8b00b3a92fa1b34b8e20405b3f1ed30692a059200730a76bf15defd

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
681e13f9eabf56311771489b01f7bf8e

SHA1
5e3f72b4fc0b0ba4057bdfb221d32a9e1c33521b

SHA256
a3872b22f05eb11751ca18c3ab27117a96e73677ae5ce6ee88dc882e284d225d

SHA512
c9008f42c73d83bcbcf3771dbebae77ab2975245f248db0ebee79693bb1bcc24631d3e41a812d1ed9d6dbd1cbb73aa59c9acccf771c4f084bc3b141ca86d0bd0

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
3d4484554252d2fec8bddf0a1b985ce7

SHA1
fabaceaeeecc347da756b0c8dcfca0b3902f1210

SHA256
c63e7c7eafefb68878ca2d78efb2913389e71d8905387056ebbd4d45f3219c3d

SHA512
ef4b44c509122127c6049d7321b5381cabe1c2b55723933d39a21d782a33ab94bf46cf9dff7a92b4dda43e8b0e0575ff8faa191352fb93e24920665695062fc3

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
9e54a7eb6087133cf0c24bd2a8579732

SHA1
0643f769faba1f8edf6107d9a8fa9aa757abbf0e

SHA256
f078d81dc2db3353cb060801f98f669ffd6f13f7d7eab11fa809c91a5eb34b7c

SHA512
3f7f093b3d968fd6d9b8c880bd99c387058b3fc13091e4add63f305730c559c3b3e12308054cde3ed8540b1195cf16d410d39ff99933e38851926e94af424353

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
557b374d67705eb54888db8a425c16c8

SHA1
d1766506af6d7bb45de3848d046c8e22ab7572b7

SHA256
accf4f4e74026fdf3e47567a96599219f761b9df0bd402ad2752234f6b1267d4

SHA512
1ce7df3b2cfed51da0160972558fe3b78822715984b893917a6c36044078fe5e58b9d28d3f13eb8a13c1728f3f2d8f1c7f516c3bbfa7ade28821d7038bfa951c

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
8216909c8b667285fd0bd474c1175105

SHA1
b2100429c18cb902ef38ffb438578c684d80b283

SHA256
e5bed414d182a88f3fc7ba5ae0fed0412b712f29d0508838767b1c16bfb499b7

SHA512
a9c38d673583de1e3a056af8b59cc6e99312df3f23331a84b03dbe648c7e0dfe8c0f4f9398113ee7a59048f786207c74a9ae53d0ce09dcdb410dc7d7243753a1

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
23610a0cce5ac02fda7f23704b3b2cf5

SHA1
b9450a3680e4021d1bf329f7fdd9f8eb990a108b

SHA256
68d77d77883effddb32d8d0551a5ab3e2eea55a3790295ec77c19e0231bdebd8

SHA512
8354a30a811cc680e46440b2b3295c24eaa7ca063c8ea75e844dc577a5cedbc5a1c159665dedc8cec7c4e7d64eb714c8f481442810361a0ed2be59a2006b0776

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
213ddcbed2b12f695b341b60426120fd

SHA1
93c05c6d8d9c2ee190f28ba482fd1962f5507565

SHA256
6413a9cfc1442875569d6c504a7a7d002a7a5124106d0092c1ed54b8a95fe335

SHA512
f6cf1b9ec53b3b338952efefeeb0065dfd12beaf9dcccd3bf9f1b00bf98f134fcf7a45c90c05f1c19bc0f3cd62ec6ca50d24a82c1a250b09e665c3bbce13233a

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
4ccaba4a65b9945869f66de2b6c7eb9c

SHA1
d18b806ccd612b2db276a7d2d958feacd26397ec

SHA256
7f9763d3c86739d6cabaedf38380833be291cd8e0ca2251dfe2544285d2dc4e1

SHA512
f6dd8b7978c2871da3ff50fd3d2c24461773873eee35656f16dce63c113a5e0713274f1b54b561c711a4ae81a149153279a3f60c66b7fda2901a2ad45a5d0f6c

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
09ef8a53fbd02ac336a24bda45bd378a

SHA1
22e549cc4df5f157cacaa58437c5cd737cd3423c

SHA256
39a9e9f1809ef3b1db0dcd1eeb0f481fa676fa6615578c26ac486572f70e0e08

SHA512
80d5a1567391952eac3ab01c42816fb006ee4189b0e2e8e648f068bcb60bc692b9ff2ab75ec9aea94e757dc17df31aaf29224f6d4e9831e32b4d37bf2cc8f77d

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
895cc479d3a0a602080a69b54e8cc225

SHA1
2100e2b51118d3b4d2dd84d636d3a398006e4257

SHA256
93ee47709aa59ec031b0af956da66d57dbe9f08af7c97c2d50d7936b2bcf6bed

SHA512
765695dc31d16b596ee65711472c89de6b60419b04bf487c65c1deeaebb526a56c598a1bca25821822d470bc029772ff2c2ad961f1fec3dace188c9ea29797d8

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
c7286c377d7abedab913e67ce5cbf0eb

SHA1
71fc37d343b1e22bf1796958f76f26fef61a55ad

SHA256
79792e599c10df01e88497c6caa1ef9586e045bf600258064a63f7e23c597f20

SHA512
1caf8963c99f3a9e986bf8ff3c85f8bf2d3e3413327fd8b819be10cf6ff091ca1e9d0947d1b331f7b5a133e2a6d7a0ffb8fa20a44c7e719bc0914020c9be410c

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
8dd1dd69296333bc2192294bb5ca208a

SHA1
fd31d9734d69b18a70b0abdd8c23057f14c8d3a7

SHA256
5c1253b014963548c0b9960e9c15ac7eb2c4e538a924fcd7f22460e38bf09d73

SHA512
647eaad7a2824c7da93de86f2b677d286b559ef2f0b6d704c87b3fa189ef46d0a71afef4fa9792f75ad2a706547eeb434705f041e8c3e08b3fc2daae7ed7169b

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
27.3MB

MD5
6993d5ba84fb6ee960add1a064e82578

SHA1
324359874753bee34060abeaf3e9c2840981b5dc

SHA256
7287c12ecbaf94fb636500c8d81f6e3b52b8ab9b9143665858509a201ddcf357

SHA512
c5243a43666b1b2819fedab028d393a982810f999db75153f561f257536bf08efe1ada476d2560c77b5b2040045afbe1cc3ce34ad57b7213c215f16528c9e400

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
8KB

MD5
fe08f91005abddd75cb2d3c35bb02918

SHA1
5e13771120fb9cfbcf7f04eda42a86705499782e

SHA256
30f794f55ac9374fbaddd4c98cba6987edc65493e93dd824e38211a36a1a23ee

SHA512
441d64e9a16d9177d1db7d0a89c41f0255c9ec2c4d40503f5e874ec2a5165578fa2a454e8e1585419c8d637a57f9f8513b34793ce0f33f13393d60b6b3d75ea0

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
16KB

MD5
5bd550f60d394babe481ad520973be5f

SHA1
09636251c32d55ef8e2536fcf65f4a309a48a52b

SHA256
c3cb870d5699a95e8e2a1d824c28a27af15a77af736379463e897b18b94184cb

SHA512
e1df471faae794520c8200ed7cec68527559a15ebeb71da20e0b95fe59065d6631dfb2f1c9e0a8b4edfaab7ed7f78fab4d58d4d64f4d8c961d1fb9150b72fd6d

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
16KB

MD5
c3fc8b0445af1425fe319fe241a3f6d5

SHA1
997617c45ffb21fccedec777abd40ab8736eb673

SHA256
f2805deb39d830d0d212d7f80cf3116b63d2a07ae63d93fe3425b1c0ff392072

SHA512
02e8270473d14429ce55cdf995580b87aaa8ac00425accc6641a7b2ec400a10da00496dbec3fc54ae512c2fd22b22c09bdce8f39d4eba160d41819e2286f12a4

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
fa89d74f4ab25014cd9bb5f9065e0717

SHA1
9659a0f26d3fca133477742ece3f4f33d7c2dff0

SHA256
ca3902cc877a905d6d88e6b42b78a0b3566ffc2908181ccbae02aaa82ed14fdd

SHA512
80980eb93655c0235adfd5ac20b17894c6020ae68cff8538e73e23862715b67cc96c6656abb6ea3f6cf7d45af214283de3236d180c5a7ec02296a7483a04289f

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
a71f5f1320bab6b06c71afae50a17175

SHA1
5a60989f5b4acfb61556f030ed57dcf59771323b

SHA256
088f47d3e3c1221647db8d47b6f66116f8825833038fe11877d3a87cb0519b5a

SHA512
8b0bb8743226d61edbccd360bf2a8eabed802058710c0a255f1a7369f56748c3d017515ffa86962bfe7b53ac5446dfabc407883429364ce9cb9988c54fccd264

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
1658eb4b10e621ae62b6cefa6f53bea0

SHA1
5f113cfee26f21480634461d66c8115954041785

SHA256
9a6f6dc3425bf3b19722fd8a756194afb22d799946d0f2d39da1eaaaf4c02bc9

SHA512
c8708813472354c63b1796e87f159a3d4538424dd4d4241ca9e56b3f0029d80aef29774bcc89eeb2d085764a63f058ec9c6658e78db9c5b9daae60692aa6af9b

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
20f017f919977b479db79b36d0789375

SHA1
14e9e6e8af57d3ce5412762cb74cc0dc64e38ce6

SHA256
76760b714787bdd14e969e276868cf504ec3cc18c582bcc1271b20144077134e

SHA512
d549bed6499e96a15fa744514a9df41ec3bde900018b05babd9cc880b26d94471ccfb236b83960961ed6f85fd192872074d934e4b72747554acff9e99f3d341c

Download Submit
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config

Filesize
1KB

MD5
92ef2b438ca5bf0a36a11165102af092

SHA1
1b9409047b80ceba51b18ff1b08fed068e0a4c7c

SHA256
0854f1df92d97e676fe753e90c97513482ea9976a072bbcf73fb7e8c4a387784

SHA512
6de4749de0a34674fb6e10a5d5922073e05c52bf08ca9a358c48c3f9acb403029309be1dd8fb8029a762255dbb00ad2927667866855b39ff5b013c2c9126c9da

Download Submit
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config

Filesize
1KB

MD5
1543a151c570c3fd0b6fa8ad13ca53c5

SHA1
6f0a295ab64a7d46a4676b583ef5268480cafb7e

SHA256
fc8ad8662e39f99604a2cf9eec0e04520172a5b17207a212fbc280373eaa2b58

SHA512
3cc2f55ecc8b71d3a7acc1662de98e0c61824d563dbc051716914d07553cd1198ced7c6d3523f3b9b3146f11ff347caff56be8455ba5dd5b3fb4be10bd2a1487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
00bfeb783aeff425ce898d55718d506d

SHA1
aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f

SHA256
d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580

SHA512
2209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Adguard\Adguard_20240506165400_000_Msi64BitPackage.log

Filesize
1KB

MD5
81aa2faa602d148be14f4f799b867566

SHA1
cab42c3dc28c6182ddd54e232f3cf96450f27cd5

SHA256
6a24257b729d2068bc9518ecc9be2bebdb8b356611f002791fec6bb2974e882c

SHA512
b2081d9d3eebabece74ce8ceb28d9b5e73eb9bdcec11b8cbb906937eaac0294b9d72b363e7d3040cde3c96129a6634c2d0e2b7d2fdd22f7a09cab7f223183ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\adguard\Adguard_20240506165400.log

Filesize
30KB

MD5
24665af43b6442ca429074b374cfb730

SHA1
aa5d7a34b421107c4408bee377463c9baa6ea6fe

SHA256
f264bf9256da1458aad0d92f38caf8d922d9c093a60576df6b2ed97d0adb1ace

SHA512
536615c371d0a4c863d0f2e847883aa07f79c22da7411fa0aaf3c78b5e85c123394b7de07efbb7296cb64c522ddce01f0ecf1df3abb8d7fc3a68dad054589b49

Download Submit
C:\Windows\Installer\MSI8211.tmp

Filesize
693KB

MD5
52159f784cc0f57bddf39a17857a8ac2

SHA1
0788b586b3210cf004c827d396d8ccd851472ee4

SHA256
4fb676db4f1de07697fe85568bcb6c1cd79c079a818add24cd15cc81ed29f20a

SHA512
208911765072ca824613e3b65658b23f553c82390b8296f8aff7e07f702cd431cb6fdee7067f13525b85bf582062dea077be2e4f27e12d00bae3b0b244471201

Download Submit
C:\Windows\Installer\MSI8211.tmp-\Adguard.CustomActions.dll

Filesize
475KB

MD5
b3259d1ef57ca51f12a28cd7cb5a03a3

SHA1
a127b32a20540678be8554ddc53017e7df25f314

SHA256
59e6e20cf85d317b5abd18078e5a551b21c56ca18e20fe1e45759bd3038482e7

SHA512
1d8bfd6ad0c90b7278803f51c9c1bbeb429fe448779ef9abffb7758a8fcd6db704ae71a1af65da64b6c712b32c8af54884c3a77ef13b337f499c91e097114834

Download Submit
C:\Windows\Installer\MSI981A.tmp-\CustomAction.config

Filesize
228B

MD5
d044d23e8084c869cbdae714ba47b866

SHA1
40d25b0fec3e43b7d966d02928d60904e32bd84a

SHA256
f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd

SHA512
62d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9

Download Submit
C:\Windows\Installer\MSI981A.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIA24E.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIA379.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll

Filesize
32KB

MD5
82deb78891f430007e871a35ce28fac4

SHA1
4e490d7ec139a6cde53e3932d3122a48aa379904

SHA256
2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237

SHA512
e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a

Download Submit
C:\Windows\Installer\MSIA445.tmp

Filesize
127KB

MD5
93394d2866590fb66759f5f0263453f2

SHA1
2f0903d4b21a0231add1b4cd02e25c7c4974da84

SHA256
5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

SHA512
f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

Download Submit
C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe

Filesize
384KB

MD5
e1769fd831d70274d0183e3e68994684

SHA1
5db7df3a9a0cf3489272ed99d8cdf6105dc9a620

SHA256
f6558d3f7c36fea39912c10e20d878244a079594a01173dd31918043b250f681

SHA512
504f28d6ff9e72a6662500b192b0263735662c65adae507c65881bef865092f29473af576ce286a30a061a08a2098c078726ce8f6f8c932331fcb52317d76649

Download Submit
C:\Windows\System32\d3dx9_11.dll.tmp

Filesize
273B

MD5
0bb8a256411cef82564953a480bf92b8

SHA1
7ff3b86cfdd8b2d8dbbdf68986e7a0751132209f

SHA256
598767dee63eca29d4d38b2c993846ec37298068816e7f31554d159c8f721101

SHA512
5fecb84822d54c385e1b42a05d1b688456f68c96614c27abeff4ee0c9a1976343b135577b86b10ca84c791fd58260fa794c163346cfbda9cc9518de6753c5209

Download Submit
C:\Windows\System32\prfc0003.dat.tmp

Filesize
32KB

MD5
f9931002bf39a1a2614b42f3d1b3be0c

SHA1
b46560474cc7100c0b8c194037a2ad0bd8e46224

SHA256
4459f8ef71143851e15161238c09815ccff11c5b171b0a8cb4e46b716d9bcdc6

SHA512
56b68894211fe65c18433b43773ce0e69ad9253b8abaa9ed159a338ecb1bf1d2d192d31b8490feeb4a563f80720e83a814138562e912374c738e490df0173a2a

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\AdGuard.Utils.Base.dll

Filesize
879KB

MD5
39b2236a3c083292a14f65585ad73e28

SHA1
012a24cc5993cbc33ebace8cace1c1dae1e899c3

SHA256
4b930935f4a6ecf9908c9c50f969c5daea41c3de2bd6540cd6f220fd83bffe8d

SHA512
d3b2f971fc856e3927603334ed428658000b4228776039c4c1c0c9811551209073873aea7130ae46dde2971f694d7fedd2a37dafd5ba325a7d0db24a8451f889

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\AdGuard.Utils.Installer.dll

Filesize
55KB

MD5
abd2f4a5cfa8a9608fb14e3fbf44871f

SHA1
b5249f54a6a73c27bcbbdc07fb6c86d9745be35f

SHA256
06c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5

SHA512
7dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\AdGuard.Utils.UI.dll

Filesize
621KB

MD5
ec3d9350a9a400fb3271c7327f5bf5a8

SHA1
0eea26f71e7d03579303b9ffc34549fa7ac843e9

SHA256
aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4

SHA512
a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\AdGuard.Utils.dll

Filesize
1.8MB

MD5
1f79f405d3659eb62779f948a397967d

SHA1
c01403d8ae03c41726f9f5d72f1b79dc3e96191b

SHA256
b262d6ab962e2dfd034e63df34ad8aed15f1caf1ac1b1259facba9535fca71e4

SHA512
b5a397b6f62ee5c7c2dae0cebcd509127200deb5f651eb5d850a2e9182a5eea67925e96df0e3b1ba9cb0f17a4ad78e29833ed3baf22e5e9ec07ff06d47d64ced

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\Adguard.Burn.dll

Filesize
279KB

MD5
96010203c9ad85132c021ce2d86536f9

SHA1
6db1c233ae2e5ab52798a027a597601c43a02715

SHA256
8215daa9d609cf32d2b2344eb33d7cb612fa91fc2e1210929fd64b5eca6b1b85

SHA512
ee4132abc306e60c1c29707bace7747128cc8f8f71bb3dc86407817dfa71e624e173b597a8da35a5f908095219e8d184cf040a62995aff988a12ecfa14d302cd

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\BootstrapperCore.config

Filesize
1KB

MD5
898c2a320bea0580f37beeccda8f2378

SHA1
eccab214a148e6a7a9535bf1c83b714c756dabf2

SHA256
4440270efc95c694150a665b62ca89b8b93b1271dfb2757e8dd1a68ef2705498

SHA512
e4608aab984c6e97b00e80d2635a283392f1eb24bdb65f5fce92851eb63ad474e5050ac46e5cafe2dbd438dd026269253bd4ec427f08b2a09788d6b1d49bcc84

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\BootstrapperCore.dll

Filesize
87KB

MD5
b0d10a2a622a322788780e7a3cbb85f3

SHA1
04d90b16fa7b47a545c1133d5c0ca9e490f54633

SHA256
f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

SHA512
62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\Newtonsoft.Json.dll

Filesize
647KB

MD5
5afda7c7d4f7085e744c2e7599279db3

SHA1
3a833eb7c6be203f16799d7b7ccd8b8c9d439261

SHA256
f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

SHA512
7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\SharpRaven.dll

Filesize
114KB

MD5
89a2762f19597b82d5c501366e5b2f29

SHA1
f5df7962015164e4bfed0ae361f988c1e581677e

SHA256
a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167

SHA512
bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\.ba\mbahost.dll

Filesize
119KB

MD5
c59832217903ce88793a6c40888e3cae

SHA1
6d9facabf41dcf53281897764d467696780623b8

SHA256
9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

SHA512
1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

Download Submit
C:\Windows\Temp\{05A778AD-14FB-431F-A4CA-F37F55E71C26}\Msi64BitPackage

Filesize
41.4MB

MD5
d7677284befc5f541d560e631a0861ad

SHA1
bbed67a5a597df83cf3d2a7ca7c26716571cb87f

SHA256
eaf4cc8809c1ad671e63b8c4bae50eda8924e23e507df272a0f0f6fad4d23cf8

SHA512
0fd95dcb5efffbc06c3b21e60ad9c4112cc59aa462e20067ab4f19843ee46f3ea6e7e9a5af3b8e49f9cf93df6b8e3819450c0b6724d049c04be7ee4189b76fd2

Download Submit
C:\Windows\Temp\{0A0BF5D6-2FFD-4832-9DBC-6FE7527C6431}\.cr\setup.exe

Filesize
3.1MB

MD5
b25f06e4ed0166ac822e48068e334b00

SHA1
5f44162e567a979323a1b734e651b60affaad674

SHA256
a66066c6fbaabee2011956619a0bdf3606b40f4eddedecabb82bb321ceeb2f72

SHA512
03280db188f38387d7d11073f36caf9ed05fd266b3d155b4bf0ba4ac1bccce422d552ccc39465e2b5ff0996b0a24904304d6f5b269f3e38432cc73235fface50

Download Submit
memory/1268-11-0x0000000000510000-0x0000000000537000-memory.dmp

Filesize
156KB

Download
memory/1316-1602-0x000001FCDE060000-0x000001FCDE070000-memory.dmp

Filesize
64KB

Download
memory/1316-1595-0x000001FCDD6F0000-0x000001FCDD6F8000-memory.dmp

Filesize
32KB

Download
memory/1316-1594-0x000001FCDD390000-0x000001FCDD39A000-memory.dmp

Filesize
40KB

Download
memory/1316-1593-0x000001FCDD990000-0x000001FCDD9F2000-memory.dmp

Filesize
392KB

Download
memory/1316-1589-0x000001FCDDEB0000-0x000001FCDDF2A000-memory.dmp

Filesize
488KB

Download
memory/1316-1576-0x000001FCC23E0000-0x000001FCC2ABC000-memory.dmp

Filesize
6.9MB

Download
memory/2408-709-0x000001D37F640000-0x000001D37F6B6000-memory.dmp

Filesize
472KB

Download
memory/2408-711-0x000001D37F050000-0x000001D37F06E000-memory.dmp

Filesize
120KB

Download
memory/3464-556-0x0000027AF5060000-0x0000027AF5122000-memory.dmp

Filesize
776KB

Download
memory/3464-712-0x0000027AF5EE0000-0x0000027AF5EFE000-memory.dmp

Filesize
120KB

Download
memory/3464-554-0x0000027AF4AF0000-0x0000027AF4B72000-memory.dmp

Filesize
520KB

Download
memory/3464-735-0x0000027AF64C0000-0x0000027AF64E2000-memory.dmp

Filesize
136KB

Download
memory/3464-552-0x0000027AF5130000-0x0000027AF51E6000-memory.dmp

Filesize
728KB

Download
memory/3464-558-0x0000027AF58D0000-0x0000027AF5936000-memory.dmp

Filesize
408KB

Download
memory/3464-553-0x0000027AF5450000-0x0000027AF54C6000-memory.dmp

Filesize
472KB

Download
memory/3464-551-0x0000027AF51F0000-0x0000027AF526A000-memory.dmp

Filesize
488KB

Download
memory/3464-550-0x0000027AF4DB0000-0x0000027AF4F74000-memory.dmp

Filesize
1.8MB

Download
memory/3464-549-0x0000027AF5130000-0x0000027AF51E6000-memory.dmp

Filesize
728KB

Download
memory/3464-548-0x0000027AF52C0000-0x0000027AF5446000-memory.dmp

Filesize
1.5MB

Download
memory/3464-547-0x0000027AF5060000-0x0000027AF5122000-memory.dmp

Filesize
776KB

Download
memory/3464-545-0x0000027AF4F80000-0x0000027AF5060000-memory.dmp

Filesize
896KB

Download
memory/3464-546-0x0000027AF4AF0000-0x0000027AF4B72000-memory.dmp

Filesize
520KB

Download
memory/3464-544-0x0000027AF4DB0000-0x0000027AF4F74000-memory.dmp

Filesize
1.8MB

Download
memory/3464-543-0x0000027AF4A60000-0x0000027AF4AEE000-memory.dmp

Filesize
568KB

Download
memory/3464-542-0x0000027AF3830000-0x0000027AF38F8000-memory.dmp

Filesize
800KB

Download
memory/3464-560-0x0000027AF5CA0000-0x0000027AF5E02000-memory.dmp

Filesize
1.4MB

Download
memory/3464-730-0x00007FFDB1190000-0x00007FFDB11A0000-memory.dmp

Filesize
64KB

Download
memory/3464-729-0x00007FFDB11A0000-0x00007FFDB11B0000-memory.dmp

Filesize
64KB

Download
memory/3464-555-0x0000027AF57D0000-0x0000027AF5832000-memory.dmp

Filesize
392KB

Download
memory/3464-1568-0x0000027AF6F30000-0x0000027AF6F6C000-memory.dmp

Filesize
240KB

Download
memory/3464-1563-0x0000027AF6ED0000-0x0000027AF6EE2000-memory.dmp

Filesize
72KB

Download
memory/3464-561-0x0000027AF64F0000-0x0000027AF6BCC000-memory.dmp

Filesize
6.9MB

Download
memory/3464-557-0x0000027AF5840000-0x0000027AF58D0000-memory.dmp

Filesize
576KB

Download
memory/3464-559-0x0000027AF5AF0000-0x0000027AF5CA0000-memory.dmp

Filesize
1.7MB

Download
memory/3464-572-0x0000027AF4CE0000-0x0000027AF4D06000-memory.dmp

Filesize
152KB

Download
memory/3464-571-0x0000027AF5270000-0x0000027AF52AA000-memory.dmp

Filesize
232KB

Download
memory/3464-570-0x0000027AF7060000-0x0000027AF743A000-memory.dmp

Filesize
3.9MB

Download
memory/3464-569-0x0000027AF4D40000-0x0000027AF4D9A000-memory.dmp

Filesize
360KB

Download
memory/3464-568-0x0000027AF6BD0000-0x0000027AF6C78000-memory.dmp

Filesize
672KB

Download
memory/3464-567-0x0000027AF63F0000-0x0000027AF648E000-memory.dmp

Filesize
632KB

Download
memory/3464-566-0x0000027AF5E10000-0x0000027AF5EB8000-memory.dmp

Filesize
672KB

Download
memory/3464-562-0x0000027AF5940000-0x0000027AF5A04000-memory.dmp

Filesize
784KB

Download
memory/3464-563-0x0000027AF5A10000-0x0000027AF5A7C000-memory.dmp

Filesize
432KB

Download
memory/3464-565-0x0000027AF5F00000-0x0000027AF5FE6000-memory.dmp

Filesize
920KB

Download
memory/3464-564-0x0000027AF4A60000-0x0000027AF4AEE000-memory.dmp

Filesize
568KB

Download
memory/3660-761-0x00000231E8690000-0x00000231E8776000-memory.dmp

Filesize
920KB

Download
memory/4072-1575-0x000001FA4FA70000-0x000001FA4FB34000-memory.dmp

Filesize
784KB

Download
memory/4556-197-0x000002B674690000-0x000002B67470C000-memory.dmp

Filesize
496KB

Download
memory/4556-193-0x000002B65C120000-0x000002B65C14E000-memory.dmp

Filesize
184KB

Download
memory/4576-110-0x0000000003880000-0x0000000003892000-memory.dmp

Filesize
72KB

Download
memory/4576-106-0x0000000006F90000-0x0000000006FDC000-memory.dmp

Filesize
304KB

Download
memory/4576-135-0x0000000007D90000-0x0000000007E38000-memory.dmp

Filesize
672KB

Download
memory/4576-114-0x00000000071C0000-0x00000000072A0000-memory.dmp

Filesize
896KB

Download
memory/4576-138-0x0000000007AC0000-0x0000000007AE2000-memory.dmp

Filesize
136KB

Download
memory/4576-130-0x0000000007500000-0x000000000751E000-memory.dmp

Filesize
120KB

Download
memory/4576-139-0x0000000007E40000-0x0000000008194000-memory.dmp

Filesize
3.3MB

Download
memory/4576-120-0x0000000007540000-0x00000000075DE000-memory.dmp

Filesize
632KB

Download
memory/4576-144-0x000000000C580000-0x000000000C588000-memory.dmp

Filesize
32KB

Download
memory/4576-145-0x000000000CBD0000-0x000000000CC10000-memory.dmp

Filesize
256KB

Download
memory/4576-99-0x00000000035D0000-0x00000000035E8000-memory.dmp

Filesize
96KB

Download
memory/4576-146-0x000000000C510000-0x000000000C548000-memory.dmp

Filesize
224KB

Download
memory/4576-147-0x000000000C4E0000-0x000000000C4EE000-memory.dmp

Filesize
56KB

Download
memory/4576-124-0x00000000077C0000-0x0000000007984000-memory.dmp

Filesize
1.8MB

Download