Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

adguardInstaller.exe

windows10-2004-x64

10

adguardInstaller.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    101s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/05/2024, 16:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    adguardInstaller.exe

  • Size

    142KB

  • MD5

    2778418f6e0d048617221386ed96109c

  • SHA1

    bdff4500e90506ec9944691e0f449dc2d7a9454b

  • SHA256

    93e92273784deb9659b37c211cef5366463753a90abbf1e9b9846d82ff7aaadb

  • SHA512

    c7547344992511b53241426b2bb8c2fa55bddf6358300a2bc60a73b42bf7a493822b57a285c718e4b3cc6ed0bbbc22069fb0d908ff8e77c4e92337fd0d7cb6f0

  • SSDEEP

    3072:r4qZHnMyBV3vChLFvGyfmKvK9MkBry8wpspx:r4qZHdV3vevK9MkhkpYx

Score
10/10
zgratdiscoverypersistencerat

Malware Config

Signatures

  • Detect ZGRat V1 8 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Drops file in Drivers directory 4 IoCs
  • Manipulates Digital Signatures 1 TTPs 12 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 10 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 54 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
      C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe AID=18673_page_es_welcome
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Windows\Temp\{1D948C66-8EFD-4CB2-AC7A-638E28AD5FA3}\.cr\setup.exe
        "C:\Windows\Temp\{1D948C66-8EFD-4CB2-AC7A-638E28AD5FA3}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=864 -burn.filehandle.self=860 AID=18673_page_es_welcome
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.be\adgSetup.exe
          "C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.be\adgSetup.exe" -q -burn.elevated BurnPipe.{EAEEE561-32E6-4CAA-A0FC-1C6995C4A489} {7130C8CB-BAF0-48DC-ABF6-A4F90EB3C197} 2704
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:5012
        • C:\Windows\SysWOW64\sc.exe
          "sc" query adgnetworktdidrv
          4⤵
          • Launches sc.exe
          PID:1704
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 47FB4E627400EC0C9BBEA5D397F2D8A8
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID561.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637406 2 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstall
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1724
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIECB3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240643265 14 Adguard.CustomActions!Adguard.CustomActions.CustomActions.PermanentActions
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2712
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIF58D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240645515 33 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallInitialize
        3⤵
        • Manipulates Digital Signatures
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:2316
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIF7D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646140 59 Adguard.CustomActions!Adguard.CustomActions.CustomActions.CheckServiceStop
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1048
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIFE61.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240647781 101 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallFinalize
        3⤵
        • Manipulates Digital Signatures
        • Adds Run key to start application
        • Drops file in Windows directory
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\system32\ie4uinit.exe
          "ie4uinit.exe" -show
          4⤵
          • Modifies Installed Components in the registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:1552
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /C "net start "Adguard Service""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3544
          • C:\Windows\system32\net.exe
            net start "Adguard Service"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4140
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start "Adguard Service"
              6⤵
                PID:3980
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI1601.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653828 141 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          PID:4212
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DD77BCDD29E21034DC2E024ECA034B78
        2⤵
        • Loads dropped DLL
        PID:4832
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 68D0BA84D908946F2E7B376BED749B20 E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:676
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:2056
      • C:\Program Files\AdGuard\AdguardSvc.exe
        "C:\Program Files\AdGuard\AdguardSvc.exe"
        1⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:4480
        • C:\Program Files\AdGuard\Adguard.BrowserExtensionHost.exe
          "Adguard.BrowserExtensionHost.exe" /register
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          PID:892
        • C:\Windows\SysWOW64\cmd.exe
          /c "schtasks /create /xml "C:\Program Files\AdGuard\config-ca649c8da0474877a205ac5908b3bc38.xml" /tn ca649c8da0474877a205ac5908b3bc38 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3116
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /xml "C:\Program Files\AdGuard\config-ca649c8da0474877a205ac5908b3bc38.xml" /tn ca649c8da0474877a205ac5908b3bc38 /f
            3⤵
            • Creates scheduled task(s)
            PID:2364
        • C:\Windows\SYSTEM32\sc.exe
          "sc" sdshow "Adguard Service"
          2⤵
          • Launches sc.exe
          PID:4692
        • C:\Windows\SYSTEM32\sc.exe
          "sc" sdset "Adguard Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
          2⤵
          • Launches sc.exe
          PID:2812
        • C:\Program Files\AdGuard\Adguard.Tools.exe
          "C:\Program Files\AdGuard\Adguard.Tools.exe" /clean_runouce
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          PID:4616
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C "schtasks /run /tn ca649c8da0474877a205ac5908b3bc38"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4756
          • C:\Windows\system32\schtasks.exe
            schtasks /run /tn ca649c8da0474877a205ac5908b3bc38
            3⤵
              PID:3824
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /C "schtasks /delete /tn ca649c8da0474877a205ac5908b3bc38 /f"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:124
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /tn ca649c8da0474877a205ac5908b3bc38 /f
              3⤵
                PID:4140
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C "ipconfig /flushdns"
              2⤵
                PID:5052
                • C:\Windows\system32\ipconfig.exe
                  ipconfig /flushdns
                  3⤵
                  • Gathers network information
                  PID:948
              • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
                2⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3732
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /C "ipconfig /flushdns"
                2⤵
                  PID:2128
                  • C:\Windows\system32\ipconfig.exe
                    ipconfig /flushdns
                    3⤵
                    • Gathers network information
                    PID:4372
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /C "ipconfig /flushdns"
                  2⤵
                    PID:3840
                    • C:\Windows\system32\ipconfig.exe
                      ipconfig /flushdns
                      3⤵
                      • Gathers network information
                      PID:3364
                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    "Drivers\x64\AdguardNetReg.exe" -u adgnetworkwfpdrv
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2832
                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
                    2⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1396
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /C "ipconfig /flushdns"
                    2⤵
                      PID:2464
                      • C:\Windows\system32\ipconfig.exe
                        ipconfig /flushdns
                        3⤵
                        • Gathers network information
                        PID:912
                  • C:\Program Files\AdGuard\Adguard.exe
                    "C:\Program Files\AdGuard\Adguard.exe" /nosplash
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:1812

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Config.Msi\e57cf97.rbs
                    Filesize

                    358KB

                    MD5

                    15b884c51d5a93280f294c886a42e75c

                    SHA1

                    a5c4739ddfe34090c0ce5386c67bb54266493f74

                    SHA256

                    7aa4ef7f92790e71d2dce06fc73464fa1bc7bac09ff2cdbe01b7e5c9d7d7f616

                    SHA512

                    189d5844cba0dee4b6e4e110e6f53ff221f8fd9ae6aca4370288e94430c69504337fea1c66fb163d8b127de86f4ff4d24c01ee973f54eb295257105c586331ed

                    Download Submit

                  • C:\Program Files\AdGuard\Adguard.exe
                    Filesize

                    6.8MB

                    MD5

                    269d75aecda348d7036692d27e09af3c

                    SHA1

                    46a11632f13c8be9bf978bc00493d09f105d216e

                    SHA256

                    aa15aaaaf06cf68387f07435d95a7e738aab868bfa28941703680d1ef6d2c8da

                    SHA512

                    db96e23a546dac5f65ff18c5b2e95b0a2ca93013a49e9281e39496b114748dde20fd79833063950891c75998878b1a80b1115d7e071b3799f2c5cfcfd4280f1d

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm64\AdguardNetLib.dll
                    Filesize

                    192KB

                    MD5

                    7257436b13445d12a54aaf9cbff8f029

                    SHA1

                    45c908ae57133fb87ea77d0aef20ad268b0c721b

                    SHA256

                    374512cb07d70a9ccf2b43affb96ab99fc02dcf07ef70b7b38f0c279b12991ca

                    SHA512

                    69c13443db0b7128099cfaa914018393c043ca96c25764b1be10035bba0db8efeabe2725473b95aef704e9de971462c3e615610188e5479a5067331d6096d764

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm64\AdguardNetReg.exe
                    Filesize

                    127KB

                    MD5

                    0c6bc1676b5e7a48a52a015405925f8f

                    SHA1

                    c8b85daec736ce4217ddcc3a41f9c261ff635053

                    SHA256

                    32826a974608c145b2a2ffc925d5698e179cf08e04bc957aea3293344d9616a3

                    SHA512

                    3f750d99e8b01545afd1261883d5fa6990fd8ecdfabe62564c3e7cc1f423f0e409b6305cba2582f89e439c6690aa6c4f8ba5a71a0d7d0494f29692304dc3b858

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\AdguardNetLib.dll
                    Filesize

                    153KB

                    MD5

                    520658c251bcde9fe6c71fb0f0d20986

                    SHA1

                    db75ddf587c128c315a3ba98e1c96749111a3374

                    SHA256

                    09d7da40bb51e62000ae46cc625490f559c035d6d059bd8657ef8b6d103cab20

                    SHA512

                    2785563612e0c4507256dc260c195919f0072aa730f2d5a842cd59823a5fc1db45303c9dbf6537bbe1e971a8a61cc436c4d6d2a4ad79bb727cc8c6f3835169dc

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe
                    Filesize

                    101KB

                    MD5

                    8e37e56d595056bf58e4840b2e0a6312

                    SHA1

                    5f82d763f0eb83ae16f0a51dd9b64c3f1db8a3f2

                    SHA256

                    3bcd226bf0a6de378ee6ff79e5a2c19260f15f28633174ce23472fbfc8aa331a

                    SHA512

                    f35b6da8d6454f52e8555c001fcf216b6c8d04486c2cd28a59028354be596cd6a4cecfe6f6537070f4ed21cf303849cbc4009ed72540efc84f6fdf5ee19c309a

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys
                    Filesize

                    60KB

                    MD5

                    fcb1f6082b2dd42faae9e2fd76de5920

                    SHA1

                    fd312dee422bdae43cfd9beec596e2e1a806efe4

                    SHA256

                    2b743aac00d054e7c041200c88950305035c70da3d415c05eeb7844b040d93ce

                    SHA512

                    52db56608282ff6d18c380710a1d495c45f1c4cd0ed224abbd58a77ded237f347fec96401036b6510fba0735d65721799c65d070436b919bf92b07dc2ff05dfe

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\arm64\adgnetworkwfpdrv.sys
                    Filesize

                    88KB

                    MD5

                    7d26090469f422f0dab254be116f1917

                    SHA1

                    55943137295bb8a9400ac73f5dadd648df6fe155

                    SHA256

                    4d3d8984523fafd3aa4ba35b9eeb348ea5a6b284b54e92a03e608dc17f71f44d

                    SHA512

                    8bd3b4a3ab71a2b22b7ce268605f739a76a12ae2976cce76a81279746890c39a281cf2aa98840178520056924c30d145374402b9a5f4a219eb978f9ccb0a9f1e

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys
                    Filesize

                    68KB

                    MD5

                    4a83e369a535895500cef8f099cc1818

                    SHA1

                    4d5697c783f877f823f03e6b77e1a07f79e17b9c

                    SHA256

                    2458d32c657b52a79703c26db4ee0503164ea4b764580c67492bfbbb9522596b

                    SHA512

                    956932d81026d1648d2adccb3a2ffbdd7a6ac14f1642e154dae98218c4fe500fd9d729fb5c0b96a51d49a711560ee7bfaabf610af562e7f2d4701c63935dc4e3

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworkwfpdrv.sys
                    Filesize

                    87KB

                    MD5

                    73210a1c72d9946fd168c961c2d0916e

                    SHA1

                    ab848f3bbac8334275c8093e30b561fd71c46ccc

                    SHA256

                    274b4429872e302bd0672a52b8b8d43b3cf497d288af57d851ef02c2defc9586

                    SHA512

                    a3acbd11d5c3d132bf968ce75842a456bde3bacdd39a2d60ccf0513d00ab5b8d62d86346b68dd89eb42b87240e18825fa74b68e1eb0d6dda35c09ed995cdcfb9

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworktdidrv.sys
                    Filesize

                    62KB

                    MD5

                    a216964ab28f54e9ec12f73207c1fe91

                    SHA1

                    a8b9a3049233c1603ca7b71ca1ac442de13e1436

                    SHA256

                    ec8d1f0035069d6552b3a12aee85c2307a10c94c4769d4ddd4868e9e10b33afc

                    SHA512

                    6c806ffc7ae23c1818539257576e711ef0296ca1d0a132da0fc77145dab43c33a41cf54bd58abf9fa1135335c00596e8cff4a0f31231986230a14d93029f26f8

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys
                    Filesize

                    75KB

                    MD5

                    2f5b7ce78c3a9d47f2f288051fc57e36

                    SHA1

                    b59bad8ac2762e1d473c5fc75a2bf6c6936c9c72

                    SHA256

                    2635b3ee42749a58138347ac577b59240047513166876c2b9ff5fac25f184652

                    SHA512

                    05b98b2d45d3654865aba3a99717dc8a3a35b1b7c510beaa085bb4a4eb39caa5dde973883bd0a3b92e61c86cc1d5a0a286375b73f8a6c70af9823160289424c6

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetLib.dll
                    Filesize

                    200KB

                    MD5

                    7ec3d16685f1a49e0ea7ffa4536d239d

                    SHA1

                    1603e6b9e9910accfc35dc711792581bf6468854

                    SHA256

                    a8acc0c9798946de909555f143f99c4a20bffdc1d0affa30addac4e902c72f74

                    SHA512

                    327ed37c214c1ff5afa8159e21f9aad83fcc3ff28c3246a0da16bc824c77002bccc7a6483a8e06fd1e8333514c71525ea84e94d56e9fdf0ee5b44d8e44d3d2e3

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
                    Filesize

                    134KB

                    MD5

                    ce1898aaefa0685319b0b1ce9edeb355

                    SHA1

                    280d1ab8788faf7bc1326567c95b84bb741d8395

                    SHA256

                    15d7010351178309baf929953b404c53284f7c3a5dd1b6e336db52a278c6d58f

                    SHA512

                    15d4d32e1043a6f1152d6a13cc37e11ceab98aaf362b47b68f35e0d3e8a90d295977fbf74524e89c3619e966b8b6be66b614c91b6ac94a83f7a978dd5786abf1

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\adgnetworktdidrv.sys
                    Filesize

                    68KB

                    MD5

                    a766442b6595bf4c242684d7a285ef84

                    SHA1

                    07e35acad189c43a9a3dedc66853e06541a9e73c

                    SHA256

                    6c0a27448725c857de552b84642670481d2fe5c3fd7cf5533cc67146d60f1669

                    SHA512

                    174613c8296f5aa5c01daf94f9b3346eb14d854630a0bd1c40ce9e86d2dfb90c8ad64cf340fff1e31c8df985837915dcdf28af312ea2a72b91881cb47d569c95

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x64\adgnetworkwfpdrv.sys
                    Filesize

                    112KB

                    MD5

                    0f54c2c61c86f31ff652c457886eaf39

                    SHA1

                    fdeeab13d5faaa008d11cba4b9114d2192363585

                    SHA256

                    fd7855f73f30f12042ea28e6502c723fc8c7e108844dcd48239f952eb59fdfb1

                    SHA512

                    f238e216c397e017605af51c6966aadd5843207924e4089d6280ea7491c388176fadce11db4987f47cc6e53329026bc58f10ddd3a6645fbd84860a559e9fcafe

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\AdguardNetLib.dll
                    Filesize

                    164KB

                    MD5

                    9ca27a976342edfd9ea1381a7802b8b6

                    SHA1

                    87a55f2524ccea1d7b6ab89236aa506d6a2a455e

                    SHA256

                    560cf2a72005278f373cf09196198c31967ab506b1f194414a7293a29bb1805e

                    SHA512

                    9d59b1842b5f522a68a5f4e6d8a9f81de49c631c6667f18a98774011dc1644038cfbeb78ef51a3f68e5bc67a66592c83f70aa17079812e375bf87aabe6416a9c

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\AdguardNetReg.exe
                    Filesize

                    114KB

                    MD5

                    cf841c8ac4724a43295b6d857639b4a7

                    SHA1

                    abd6b869e5074271eecd88e1cbbd8e852f91fadf

                    SHA256

                    800642e9cc36cfc4ccc8e985320b0730efea8d8a5c1489980eb4e07f7349af28

                    SHA512

                    a623b08c1ca9632963668bf3bbcedcfb4be9b8f4ad0c615260bc5a68f2b4db82c584bab381bd0bcfc30b43fc903f0cdd8c46030060276bc3adfaff97fde3b11b

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\adgnetworktdidrv.sys
                    Filesize

                    62KB

                    MD5

                    9c5bc33aaa22573400a055cedf321b5f

                    SHA1

                    45e242506c6990b1f51d8430833c29481ebac468

                    SHA256

                    ae056708a1c7d93c08c52bcd108f26e610373f882943a87be98aea96b3db4809

                    SHA512

                    940920b7d1cec62c827d821c91324fcf78ade1ad42db4c3c46773a22ed156d8191c42c4ca89621a14c14e3dd7e36a2be9871ad22ba178ef9c018f6d733e3b6e0

                    Download Submit

                  • C:\Program Files\AdGuard\Drivers\x86\adgnetworkwfpdrv.sys
                    Filesize

                    105KB

                    MD5

                    5e969448b7f189719cc1d37e85f0f6a3

                    SHA1

                    38efabdbe17c63ea0511b7fdc395eda531f15018

                    SHA256

                    ebc648139bcd1847befdd7f059c407a7d70b00d33def0218077ae660c9329f26

                    SHA512

                    c819ab1cf11f6c1ebc85546de5a013d2b0e9b6ee382b5afae8dd9d8b01be32ccbda8f5ef6afa37957cd5251a7182573cebfc30bf704b47388258b9881170160b

                    Download Submit

                  • C:\ProgramData\Adguard\Backups\user_S-1-5-21-1474490143-3221292397-4168103503-1000.config
                    Filesize

                    322B

                    MD5

                    b6ea95711f0e237d9de49dd1cc9aee82

                    SHA1

                    3f178836b34480aab8d0b70897f418b2b0d326ba

                    SHA256

                    df0cc242fa69d2e977dca8bafe5c4539171bbb7f5a146397683fdb7be6ebce04

                    SHA512

                    43459d257968d49fbc6060c6ccd63d67ede48515b4b6cdca30c46c67cb6bd75c211bebf44d71ee6eaf56a76d3b0a885271167c6dccaf333598da14a8612b9871

                    Download Submit

                  • C:\ProgramData\Adguard\Core\sfbr.db
                    Filesize

                    44KB

                    MD5

                    84b7679ab9ca3356d6e760deacb99360

                    SHA1

                    1fb57f42c2c4a669c808255460b6ece3a5a64ad5

                    SHA256

                    7f75536c9907bde92890ba00772756b632b1ed6f10088ce02eba0535671eaad4

                    SHA512

                    223c8d9070c9dc3c23493d928542b220d59ed22f9eb9be0cd6ca3e7fb833c27cd51aa5f582f4194bd21d34e97383751b5012c96a934e7c2bc916064658422d2c

                    Download Submit

                  • C:\ProgramData\Adguard\DnsFilters\358364b164304939b49a9add4f5c59bc\dns_filter_15.txt
                    Filesize

                    1.3MB

                    MD5

                    944e57aa00fdd46c02cc108ada88a667

                    SHA1

                    b3f61ac3314076e904d34005a677b0a9173a13d6

                    SHA256

                    fd2645cb2b1b9aeee70df96f4096942a39025fcfb04746fbec4242b29368f378

                    SHA512

                    9791671dd0071b8de744827eabfed19cf370e249fecd2e21479a14c2ecc1f1d6643a6d85c8b00b3a92fa1b34b8e20405b3f1ed30692a059200730a76bf15defd

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    e1b8fa6318583e31be55641ee87d73f0

                    SHA1

                    154a252367f628fabb8b887aa69a3f7c03133617

                    SHA256

                    58191e80906af068b8824b53716584235dfe674e147dba66af6808bda0488e09

                    SHA512

                    97f0a2107d548ed84c44e346044b40a36eff69d7dd8ffd88d7613df0339ba45735de03d079f15919da798edab2a20e228988d8b8a2b943b57c143e47e0dd4fde

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    b27f2cf5cbd3d065173082f3456cac87

                    SHA1

                    02f22c749c7da4c8abb1f21074424e788290f8d2

                    SHA256

                    f00c9cf054c6a3c6391e062715ac0d3d6325eae6741d6beca4f7cd867b8233f6

                    SHA512

                    b123b2573d2e74f97f79d622a04021f2cc4e1ee8ad0e465525b3d9d593605daf622c9326d44b7ddc9f7a35bb8123792ac9e496fdf60dd2c84524e1f34619c775

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    a8ec35ff1213b31de731d8d7799641e9

                    SHA1

                    2473d8b47aadad36ef5c43ad83f9dbb85823b259

                    SHA256

                    7bc7edf51f54babc8402730cb7c230362afff68d3a3a70167cee533a421d1c8c

                    SHA512

                    e1c5e0a02f416df5603b164f6a93a5db2963b2c962b291e184f0066fbc2f98e3d0defa8193a1e592ff6607cec8c2c16ab2a17848cba7590ae2a9386fffc14f82

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    69d0abead1ce0256d51fd3b5ca19d02f

                    SHA1

                    7ccac5fafdb207110c26586535aef62eba8b79ac

                    SHA256

                    068d50c0617682ce1e6443c087b127701a0e9ef7e573659016c4e04707bdcbf1

                    SHA512

                    0b3117c0ba418bca3868dbe9807ab1308fe939116f98343a0ec67986b4723777233c237ff533bc7c54bbda8d406cedcab1bddfc49494d1c4d8a819a1e8d856d0

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    4488d35b1c9f9673ba46aae5a4e27ccd

                    SHA1

                    c7a80163b55592a3a0d77d156002b57b59bea3ac

                    SHA256

                    a3d38894c6b1b67546d61bfe9703f31c17103cc54114735774cc089a291f766b

                    SHA512

                    c5f6184dee34f0ef12d1cb33848fde944c093d831e58d27eadc478a6a5eedb98576cabda85bc3b82842c439a34da29d721a6ba57555b085cc4c74dd1e06f1483

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    ef117d490470de5a827c8bd58c632b20

                    SHA1

                    175c38b9342f26156254907d448409211bc1dd4d

                    SHA256

                    89f37c412e7e79fd7e2e0550621305017ec48590dfb21d5e17e67084e61f392e

                    SHA512

                    8a54d16ac09921371c28de42a2a0868f9c4a030559b2cd91b3c522891a6f42d15b7a527c6622a0812dec1714907ff72de9d0a3db5d68d6c2a8c9fdc875c875e7

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    eca80d988cdb615ced4b9e161b2b0d39

                    SHA1

                    d02974cb9ecd95518de3f69dc2a9d6ba39c91cf6

                    SHA256

                    28fbc643fd3880ac9d2aa233e65e04dd1689d85e7e125f413263b02f6b52add3

                    SHA512

                    d658c82764422f4c3bc74dd0309b1db3a23fb290847df692b50d1146ca8dc29ae19090daa8305a10003aa2b2fd83ccf3d5ced3868726802f8a0f77acce0621d6

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    c8431f801dc0403317eb8451c6890d39

                    SHA1

                    6bace4a5878968746ca9885fecb3d28452cb5429

                    SHA256

                    f617f45b98cea696ab88fec4688118e468d0a232bc40986d04bbd6d302e71304

                    SHA512

                    1d45ff3f8dfa6ccd85acfb2c762e9ee851e0545f9044ab970a85e1f834f01c0de6c8f67a3b1561987694e210eb2a30b70ce623b61b7ad7961d8cace8bd8a7c57

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    bec360a621911045e56f0f8948757cf2

                    SHA1

                    410d3a25c3df8455fa3c0b0b57cfb74da843a095

                    SHA256

                    420eb86aec22aac3a6e3b0754f846490f37b74240b9cd78d7cfa32136439a744

                    SHA512

                    09c1cc8ca6824f1bafb523522b79de20f31d09d66f47955d249ee865ec2ec610e29c06e2985993dbb7e28fb1bc96220234487a3d0f69bc136dbda6288c78cf2a

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    4ac266626a2d215209454fbd1b8477ee

                    SHA1

                    f3398067586842dc8e77b7ced3bf41b5d03cee6b

                    SHA256

                    31b2f048fbfb2bfbe7ebf127fcd292275c79ef56a45b3875d8d31b6cb82fa9d9

                    SHA512

                    c899e2dbba87c0366d91b434adbd563cb8809d70476282a54264380d21167878211442ef52f8afab47fbed6daa8e947997841b26864f8ac4be70745956d2435d

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    6856942e5d77c0e439f8d028e0540599

                    SHA1

                    2d3c538f6dd258aebe2dd08b92f91e1c22dfecba

                    SHA256

                    9bd25323959cac237a3d5cc45c70dd52539fd768cc6d97f4a366039bcbb33a28

                    SHA512

                    e4e3bd03acc9641a4d1a7e47aa74192570906e5a8117d5d3d5c33b159f2d83163eae0d55f7ee23933c8a6b6db0e50314f82dd4a736f44f6c897ea767bb520e7f

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    fb6a895ceac9bda536c6b4485c141eb4

                    SHA1

                    f6363894313cf7a63473bb6972726386a7a0311a

                    SHA256

                    190bd4d4d8eafa07d74b58056c707ad3886d372f4561a322372d16f9cbbbbf25

                    SHA512

                    e74c0eb3625095f75e3721563474c5abd2dc530afc2877b3ef42cfd9b7d586c9784ff7fbdcb6ccbdcaceb948f16bd655017f29bced32d65dea59638f7c5267a2

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    220c0567879412748da67b133773086f

                    SHA1

                    68f5dd938f1f67018044275cd9d4adbfc537858d

                    SHA256

                    b91f66c5536569fc8b08ed275ca3ceb77ba2af066d2df5b45c6cd79c722901bd

                    SHA512

                    d45cfdefb0765b376d6e62db626ff268608c602730003108c5383fd2db18715c0fb8bc0cf4feda94e650100abd28d41632220d038713289259600b952b98da5f

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    f8d641d0deae60ad1256e5289cf9e07f

                    SHA1

                    eb712437b7da2b6a98ba1a1ba0d7c6068324cbc1

                    SHA256

                    d553eac1f0d203d0f22b7e342c159c8368fdedb6b4d1e9b3abb4a5e727db644e

                    SHA512

                    f31b536be7c5b4807f039fc7ea97d881ea93848b038ed189ea8a340cddf31e4db1e93be5fc6e8d2f28d424e4204c6d9f1925b6e8bb64bdbca8dbaec810c7aec0

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    6de3c2f6484302968e78789b3c4476b3

                    SHA1

                    2bce12b06b508f5915f3058af6928e6f81483e63

                    SHA256

                    e1ba7902d141718ee5e15aa6e064c8f4e9331c47b27f465b1e7061434bb5346d

                    SHA512

                    d2e489798e1ee511e9363f0bf449ba701e5e37e8fb920df66a123dcf80879958c26459ba88796e1efe18ddf7685558974331b058c9d2c554c27e119095589cb4

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    5a26ab3d0478e53e8a1cf4fc15e1f465

                    SHA1

                    c1c8be6353f11c948f73a2d6166ce9deb593aed0

                    SHA256

                    556deb3ae608dc33c460b942654e2a8983945c570cdfe114f03a4603433ad09d

                    SHA512

                    3b11f62325f54b15ae6f4e1b274421250b4a5f30e0b8786607e044468de0b2dac3b5c48c5dead2946ba5bb5375c117aaebab466b9da2f8e3209a1256c2399d28

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    8KB

                    MD5

                    fe08f91005abddd75cb2d3c35bb02918

                    SHA1

                    5e13771120fb9cfbcf7f04eda42a86705499782e

                    SHA256

                    30f794f55ac9374fbaddd4c98cba6987edc65493e93dd824e38211a36a1a23ee

                    SHA512

                    441d64e9a16d9177d1db7d0a89c41f0255c9ec2c4d40503f5e874ec2a5165578fa2a454e8e1585419c8d637a57f9f8513b34793ce0f33f13393d60b6b3d75ea0

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    16KB

                    MD5

                    5bd550f60d394babe481ad520973be5f

                    SHA1

                    09636251c32d55ef8e2536fcf65f4a309a48a52b

                    SHA256

                    c3cb870d5699a95e8e2a1d824c28a27af15a77af736379463e897b18b94184cb

                    SHA512

                    e1df471faae794520c8200ed7cec68527559a15ebeb71da20e0b95fe59065d6631dfb2f1c9e0a8b4edfaab7ed7f78fab4d58d4d64f4d8c961d1fb9150b72fd6d

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    16KB

                    MD5

                    c3fc8b0445af1425fe319fe241a3f6d5

                    SHA1

                    997617c45ffb21fccedec777abd40ab8736eb673

                    SHA256

                    f2805deb39d830d0d212d7f80cf3116b63d2a07ae63d93fe3425b1c0ff392072

                    SHA512

                    02e8270473d14429ce55cdf995580b87aaa8ac00425accc6641a7b2ec400a10da00496dbec3fc54ae512c2fd22b22c09bdce8f39d4eba160d41819e2286f12a4

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    b2dbaa0d2140fa92422e999f24bf688b

                    SHA1

                    897f24f3cf00753322ebd94f75bcac486afe75e6

                    SHA256

                    db0be436fcb497faa95a4f347d3a05541c2633e950ed720502592446163266f2

                    SHA512

                    4902c79b47c9f53a78349a361086cb588c091452a0f631f9e9e304c3fe7be2e0f242199afa3be1da6afe0346236dec9cb38259bf9fc9ee0e49a31cc9f1c4901d

                    Download Submit

                  • C:\ProgramData\Adguard\adguard.db
                    Filesize

                    21.8MB

                    MD5

                    83712a910e4f201714aca21064a85d24

                    SHA1

                    afe5e4f28f02658feaf58a6bb9ca49426fb9022f

                    SHA256

                    d3fc2cb0af35299962168ff2f50d61c7c77f8a87baae6b0df3ce9aa48c6e5073

                    SHA512

                    44f67f90b3844978a8639b912d53eab40bceef73e32d3d03cfd664ea30c3af214873340e521cb1d564d407e13cff38fc493bba273d9d616e2f7a12f4a550661b

                    Download Submit

                  • C:\ProgramData\Microsoft\Windows\Caches\{2843ADA2-0F67-4F78-92E2-B7A4AB26A670}.2.ver0x0000000000000002.db
                    Filesize

                    44KB

                    MD5

                    4bfb2d4de3c0941f600a4af30e48cd04

                    SHA1

                    fa411051d09a123f4f7e052de45cf7e25d4cd4ec

                    SHA256

                    132f1e531244397403dc08c1a44fde06b1b4feedca6875dafbfb0937d3866663

                    SHA512

                    725b07f02505d77c94f2a6fafdcb5c8a47fa90e20bc86b980e1d3a04802562913b0f3a8cf4d696960549e008ad9ee42d7f5f28cabd79e1a7ca533be882477ecc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config
                    Filesize

                    1KB

                    MD5

                    1543a151c570c3fd0b6fa8ad13ca53c5

                    SHA1

                    6f0a295ab64a7d46a4676b583ef5268480cafb7e

                    SHA256

                    fc8ad8662e39f99604a2cf9eec0e04520172a5b17207a212fbc280373eaa2b58

                    SHA512

                    3cc2f55ecc8b71d3a7acc1662de98e0c61824d563dbc051716914d07553cd1198ced7c6d3523f3b9b3146f11ff347caff56be8455ba5dd5b3fb4be10bd2a1487

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4709.0\user.config
                    Filesize

                    1KB

                    MD5

                    92ef2b438ca5bf0a36a11165102af092

                    SHA1

                    1b9409047b80ceba51b18ff1b08fed068e0a4c7c

                    SHA256

                    0854f1df92d97e676fe753e90c97513482ea9976a072bbcf73fb7e8c4a387784

                    SHA512

                    6de4749de0a34674fb6e10a5d5922073e05c52bf08ca9a358c48c3f9acb403029309be1dd8fb8029a762255dbb00ad2927667866855b39ff5b013c2c9126c9da

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
                    Filesize

                    651B

                    MD5

                    79dd9d574bf7da4d10dee390db653a12

                    SHA1

                    ddb3e64a2e79b01101cbd6d553eda0659451bc84

                    SHA256

                    4c0cac895c138615c44f674f0a92304ec664e87fbd3721eb9f403cc03f2fea34

                    SHA512

                    f08b39971a8cc77761dea295906bead275aac4011821a3ea1c0a78ae1162bbbb1cf51cc93fbbb7c72cc4ac1bd2cb7d69cdd27ef6ff93d31ef66be8f97615e4b7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Adguard\Adguard_20240506165419_000_Msi64BitPackage.log
                    Filesize

                    1KB

                    MD5

                    81e9c993b00228f60ba101ac8541e201

                    SHA1

                    daade96e906419c29753f9e297ed65ebdbfd46e0

                    SHA256

                    3753b30fc0d695dc7427070dbe67e64863c912da15bd1ecc88b00c7e63a97cc0

                    SHA512

                    5ab34bb398e31f732ca84cbb6e06787381251a0ef915c22839691364f200e60f1a7eb29b81c54061eaf241ebcdccf4b63ac53d0b2962ee3cd825f30d7f97d8c4

                    Download Submit

                  • C:\Windows\Installer\MSID561.tmp
                    Filesize

                    693KB

                    MD5

                    52159f784cc0f57bddf39a17857a8ac2

                    SHA1

                    0788b586b3210cf004c827d396d8ccd851472ee4

                    SHA256

                    4fb676db4f1de07697fe85568bcb6c1cd79c079a818add24cd15cc81ed29f20a

                    SHA512

                    208911765072ca824613e3b65658b23f553c82390b8296f8aff7e07f702cd431cb6fdee7067f13525b85bf582062dea077be2e4f27e12d00bae3b0b244471201

                    Download Submit

                  • C:\Windows\Installer\MSID561.tmp-\Adguard.CustomActions.dll
                    Filesize

                    475KB

                    MD5

                    b3259d1ef57ca51f12a28cd7cb5a03a3

                    SHA1

                    a127b32a20540678be8554ddc53017e7df25f314

                    SHA256

                    59e6e20cf85d317b5abd18078e5a551b21c56ca18e20fe1e45759bd3038482e7

                    SHA512

                    1d8bfd6ad0c90b7278803f51c9c1bbeb429fe448779ef9abffb7758a8fcd6db704ae71a1af65da64b6c712b32c8af54884c3a77ef13b337f499c91e097114834

                    Download Submit

                  • C:\Windows\Installer\MSIECB3.tmp-\CustomAction.config
                    Filesize

                    228B

                    MD5

                    d044d23e8084c869cbdae714ba47b866

                    SHA1

                    40d25b0fec3e43b7d966d02928d60904e32bd84a

                    SHA256

                    f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd

                    SHA512

                    62d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9

                    Download Submit

                  • C:\Windows\Installer\MSIECB3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                    Filesize

                    179KB

                    MD5

                    1a5caea6734fdd07caa514c3f3fb75da

                    SHA1

                    f070ac0d91bd337d7952abd1ddf19a737b94510c

                    SHA256

                    cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                    SHA512

                    a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                    Download Submit

                  • C:\Windows\Installer\MSIF688.tmp
                    Filesize

                    211KB

                    MD5

                    a3ae5d86ecf38db9427359ea37a5f646

                    SHA1

                    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                    SHA256

                    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                    SHA512

                    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                    Download Submit

                  • C:\Windows\Installer\MSIF7D2.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll
                    Filesize

                    32KB

                    MD5

                    82deb78891f430007e871a35ce28fac4

                    SHA1

                    4e490d7ec139a6cde53e3932d3122a48aa379904

                    SHA256

                    2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237

                    SHA512

                    e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a

                    Download Submit

                  • C:\Windows\Installer\MSIF89E.tmp
                    Filesize

                    127KB

                    MD5

                    93394d2866590fb66759f5f0263453f2

                    SHA1

                    2f0903d4b21a0231add1b4cd02e25c7c4974da84

                    SHA256

                    5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

                    SHA512

                    f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

                    Download Submit

                  • C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe
                    Filesize

                    384KB

                    MD5

                    e1769fd831d70274d0183e3e68994684

                    SHA1

                    5db7df3a9a0cf3489272ed99d8cdf6105dc9a620

                    SHA256

                    f6558d3f7c36fea39912c10e20d878244a079594a01173dd31918043b250f681

                    SHA512

                    504f28d6ff9e72a6662500b192b0263735662c65adae507c65881bef865092f29473af576ce286a30a061a08a2098c078726ce8f6f8c932331fcb52317d76649

                    Download Submit

                  • C:\Windows\System32\drivers\vwifikerneldrv.sys
                    Filesize

                    281B

                    MD5

                    30c49365cbcacb339b17c3ee5fbed9e5

                    SHA1

                    e5c4dee414e78c49e5a4466882f36b69ce70dde7

                    SHA256

                    48fc0de3c7ce03abf5254621e0e65c1e7d1cff3645ddbb93f0a5e351048ddfdb

                    SHA512

                    146ca5dd1f2139f54ccdc03f34fa42b2f84a66e8795941fa2c3a72c3ac62590b9abbfb500c083e925ada3435d2a4afb32950d3efe1eaa2eacf8836fabc0995bb

                    Download Submit

                  • C:\Windows\Temp\{1D948C66-8EFD-4CB2-AC7A-638E28AD5FA3}\.cr\setup.exe
                    Filesize

                    3.1MB

                    MD5

                    b25f06e4ed0166ac822e48068e334b00

                    SHA1

                    5f44162e567a979323a1b734e651b60affaad674

                    SHA256

                    a66066c6fbaabee2011956619a0bdf3606b40f4eddedecabb82bb321ceeb2f72

                    SHA512

                    03280db188f38387d7d11073f36caf9ed05fd266b3d155b4bf0ba4ac1bccce422d552ccc39465e2b5ff0996b0a24904304d6f5b269f3e38432cc73235fface50

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\AdGuard.Utils.Base.dll
                    Filesize

                    879KB

                    MD5

                    39b2236a3c083292a14f65585ad73e28

                    SHA1

                    012a24cc5993cbc33ebace8cace1c1dae1e899c3

                    SHA256

                    4b930935f4a6ecf9908c9c50f969c5daea41c3de2bd6540cd6f220fd83bffe8d

                    SHA512

                    d3b2f971fc856e3927603334ed428658000b4228776039c4c1c0c9811551209073873aea7130ae46dde2971f694d7fedd2a37dafd5ba325a7d0db24a8451f889

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\AdGuard.Utils.Installer.dll
                    Filesize

                    55KB

                    MD5

                    abd2f4a5cfa8a9608fb14e3fbf44871f

                    SHA1

                    b5249f54a6a73c27bcbbdc07fb6c86d9745be35f

                    SHA256

                    06c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5

                    SHA512

                    7dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\AdGuard.Utils.UI.dll
                    Filesize

                    621KB

                    MD5

                    ec3d9350a9a400fb3271c7327f5bf5a8

                    SHA1

                    0eea26f71e7d03579303b9ffc34549fa7ac843e9

                    SHA256

                    aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4

                    SHA512

                    a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\AdGuard.Utils.dll
                    Filesize

                    1.8MB

                    MD5

                    1f79f405d3659eb62779f948a397967d

                    SHA1

                    c01403d8ae03c41726f9f5d72f1b79dc3e96191b

                    SHA256

                    b262d6ab962e2dfd034e63df34ad8aed15f1caf1ac1b1259facba9535fca71e4

                    SHA512

                    b5a397b6f62ee5c7c2dae0cebcd509127200deb5f651eb5d850a2e9182a5eea67925e96df0e3b1ba9cb0f17a4ad78e29833ed3baf22e5e9ec07ff06d47d64ced

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\Adguard.Burn.dll
                    Filesize

                    279KB

                    MD5

                    96010203c9ad85132c021ce2d86536f9

                    SHA1

                    6db1c233ae2e5ab52798a027a597601c43a02715

                    SHA256

                    8215daa9d609cf32d2b2344eb33d7cb612fa91fc2e1210929fd64b5eca6b1b85

                    SHA512

                    ee4132abc306e60c1c29707bace7747128cc8f8f71bb3dc86407817dfa71e624e173b597a8da35a5f908095219e8d184cf040a62995aff988a12ecfa14d302cd

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\BootstrapperCore.config
                    Filesize

                    1KB

                    MD5

                    898c2a320bea0580f37beeccda8f2378

                    SHA1

                    eccab214a148e6a7a9535bf1c83b714c756dabf2

                    SHA256

                    4440270efc95c694150a665b62ca89b8b93b1271dfb2757e8dd1a68ef2705498

                    SHA512

                    e4608aab984c6e97b00e80d2635a283392f1eb24bdb65f5fce92851eb63ad474e5050ac46e5cafe2dbd438dd026269253bd4ec427f08b2a09788d6b1d49bcc84

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\BootstrapperCore.dll
                    Filesize

                    87KB

                    MD5

                    b0d10a2a622a322788780e7a3cbb85f3

                    SHA1

                    04d90b16fa7b47a545c1133d5c0ca9e490f54633

                    SHA256

                    f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

                    SHA512

                    62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\Newtonsoft.Json.dll
                    Filesize

                    647KB

                    MD5

                    5afda7c7d4f7085e744c2e7599279db3

                    SHA1

                    3a833eb7c6be203f16799d7b7ccd8b8c9d439261

                    SHA256

                    f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

                    SHA512

                    7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\SharpRaven.dll
                    Filesize

                    114KB

                    MD5

                    89a2762f19597b82d5c501366e5b2f29

                    SHA1

                    f5df7962015164e4bfed0ae361f988c1e581677e

                    SHA256

                    a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167

                    SHA512

                    bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\.ba\mbahost.dll
                    Filesize

                    119KB

                    MD5

                    c59832217903ce88793a6c40888e3cae

                    SHA1

                    6d9facabf41dcf53281897764d467696780623b8

                    SHA256

                    9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

                    SHA512

                    1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

                    Download Submit

                  • C:\Windows\Temp\{7CDBE248-905E-4AC9-8BEF-789698A32EC4}\Msi64BitPackage
                    Filesize

                    41.4MB

                    MD5

                    d7677284befc5f541d560e631a0861ad

                    SHA1

                    bbed67a5a597df83cf3d2a7ca7c26716571cb87f

                    SHA256

                    eaf4cc8809c1ad671e63b8c4bae50eda8924e23e507df272a0f0f6fad4d23cf8

                    SHA512

                    0fd95dcb5efffbc06c3b21e60ad9c4112cc59aa462e20067ab4f19843ee46f3ea6e7e9a5af3b8e49f9cf93df6b8e3819450c0b6724d049c04be7ee4189b76fd2

                    Download Submit

                  • memory/8-6-0x00000000003A0000-0x00000000003C7000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/8-13-0x00000000003A0000-0x00000000003C7000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/892-754-0x0000017FAC850000-0x0000017FAC936000-memory.dmp

                    Filesize

                    920KB

                    Download

                  • memory/1724-195-0x000001E61FA30000-0x000001E61FA5E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/1724-199-0x000001E61FC10000-0x000001E61FC8C000-memory.dmp

                    Filesize

                    496KB

                    Download

                  • memory/1812-1587-0x00000211B6540000-0x00000211B6C1C000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/1812-1689-0x00000211D2B30000-0x00000211D2BAA000-memory.dmp

                    Filesize

                    488KB

                    Download

                  • memory/1812-1693-0x00000211D27F0000-0x00000211D2852000-memory.dmp

                    Filesize

                    392KB

                    Download

                  • memory/1812-1694-0x00000211D21E0000-0x00000211D21EA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/1812-1695-0x00000211D21F0000-0x00000211D21F8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/1812-1696-0x00000211D2550000-0x00000211D2560000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2704-146-0x000000000BDA0000-0x000000000BDA8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2704-126-0x0000000006B30000-0x0000000006CF4000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/2704-101-0x0000000003AD0000-0x0000000003AE8000-memory.dmp

                    Filesize

                    96KB

                    Download

                  • memory/2704-112-0x0000000006050000-0x0000000006062000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/2704-108-0x0000000006080000-0x00000000060CC000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/2704-116-0x00000000062F0000-0x00000000063D0000-memory.dmp

                    Filesize

                    896KB

                    Download

                  • memory/2704-122-0x00000000066F0000-0x000000000678E000-memory.dmp

                    Filesize

                    632KB

                    Download

                  • memory/2704-149-0x000000000B6F0000-0x000000000B6FE000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/2704-132-0x00000000066A0000-0x00000000066BE000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2704-137-0x0000000006F30000-0x0000000006FD8000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/2704-148-0x000000000B720000-0x000000000B758000-memory.dmp

                    Filesize

                    224KB

                    Download

                  • memory/2704-147-0x000000000BDF0000-0x000000000BE30000-memory.dmp

                    Filesize

                    256KB

                    Download

                  • memory/2704-140-0x0000000006AB0000-0x0000000006AD2000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/2704-141-0x0000000006FE0000-0x0000000007337000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/4212-713-0x00000198FED30000-0x00000198FEDA6000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/4212-715-0x00000198FEC70000-0x00000198FEC8E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/4480-571-0x00000290C99B0000-0x00000290C9A58000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/4480-567-0x00000290AEF50000-0x00000290AEFDE000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/4480-574-0x00000290C8B40000-0x00000290C8B7A000-memory.dmp

                    Filesize

                    232KB

                    Download

                  • memory/4480-554-0x00000290C8490000-0x00000290C850A000-memory.dmp

                    Filesize

                    488KB

                    Download

                  • memory/4480-553-0x00000290C8660000-0x00000290C8824000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/4480-1572-0x00000290C9CA0000-0x00000290C9CB2000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/4480-1573-0x00000290C9D00000-0x00000290C9D3C000-memory.dmp

                    Filesize

                    240KB

                    Download

                  • memory/4480-552-0x00000290C8A00000-0x00000290C8AB6000-memory.dmp

                    Filesize

                    728KB

                    Download

                  • memory/4480-556-0x00000290C8AC0000-0x00000290C8B36000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/4480-573-0x00000290CA820000-0x00000290CABFA000-memory.dmp

                    Filesize

                    3.9MB

                    Download

                  • memory/4480-572-0x00000290C8510000-0x00000290C856A000-memory.dmp

                    Filesize

                    360KB

                    Download

                  • memory/4480-550-0x00000290C8930000-0x00000290C89F2000-memory.dmp

                    Filesize

                    776KB

                    Download

                  • memory/4480-570-0x00000290C9910000-0x00000290C99AE000-memory.dmp

                    Filesize

                    632KB

                    Download

                  • memory/4480-569-0x00000290C9860000-0x00000290C9908000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/4480-568-0x00000290C9770000-0x00000290C9856000-memory.dmp

                    Filesize

                    920KB

                    Download

                  • memory/4480-555-0x00000290C8A00000-0x00000290C8AB6000-memory.dmp

                    Filesize

                    728KB

                    Download

                  • memory/4480-551-0x00000290C8B90000-0x00000290C8D18000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/4480-712-0x00000290C9240000-0x00000290C925E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/4480-732-0x00007FFB50400000-0x00007FFB50410000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4480-575-0x00000290C8440000-0x00000290C8466000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/4480-545-0x00000290AE3D0000-0x00000290AE498000-memory.dmp

                    Filesize

                    800KB

                    Download

                  • memory/4480-566-0x00000290C91B0000-0x00000290C921C000-memory.dmp

                    Filesize

                    432KB

                    Download

                  • memory/4480-546-0x00000290AEF50000-0x00000290AEFDE000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/4480-565-0x00000290C9280000-0x00000290C9344000-memory.dmp

                    Filesize

                    784KB

                    Download

                  • memory/4480-547-0x00000290C8660000-0x00000290C8824000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/4480-562-0x00000290C9360000-0x00000290C9510000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/4480-548-0x00000290C8570000-0x00000290C8650000-memory.dmp

                    Filesize

                    896KB

                    Download

                  • memory/4480-564-0x00000290C9D60000-0x00000290CA43C000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/4480-733-0x00007FFB503F0000-0x00007FFB50400000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4480-549-0x00000290C83B0000-0x00000290C8432000-memory.dmp

                    Filesize

                    520KB

                    Download

                  • memory/4480-563-0x00000290C9510000-0x00000290C9672000-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/4480-561-0x00000290C9090000-0x00000290C90F6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/4480-558-0x00000290C9020000-0x00000290C9082000-memory.dmp

                    Filesize

                    392KB

                    Download

                  • memory/4480-738-0x00000290C9720000-0x00000290C9742000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/4480-560-0x00000290C9120000-0x00000290C91B0000-memory.dmp

                    Filesize

                    576KB

                    Download

                  • memory/4480-559-0x00000290C8930000-0x00000290C89F2000-memory.dmp

                    Filesize

                    776KB

                    Download

                  • memory/4480-557-0x00000290C83B0000-0x00000290C8432000-memory.dmp

                    Filesize

                    520KB

                    Download

                  • memory/4616-1582-0x0000016F3AC40000-0x0000016F3AD04000-memory.dmp

                    Filesize

                    784KB

                    Download