hxxp://5[.]42[.]65[.]64

Resubmissions

17/06/2024, 23:28

240617-3gbe5syekf 8

13/06/2024, 21:40

240613-1jl9ba1dmh 10

13/06/2024, 21:29

240613-1bx1va1amd 8

10/06/2024, 22:28

240610-2d5ddatejn 10

Analysis

max time kernel
359s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://5.42.65.64

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

flow	pid	Process
75	3132	msiexec.exe
77	3132	msiexec.exe
83	3096	rundll32.exe
86	3096	rundll32.exe
87	3096	rundll32.exe
88	3096	rundll32.exe
89	3096	rundll32.exe
90	3096	rundll32.exe
91	3096	rundll32.exe
93	3096	rundll32.exe

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 6 IoCs

pid	Process
4136	2EU.exe
3360	setup.exe
2724	setup.exe
4172	installer.exe
1504	AdGuardVpnSvc.exe
2164	AdGuardVpn.exe

Loads dropped DLL 64 IoCs

pid	Process
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
4140	MsiExec.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4140	MsiExec.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
4140	MsiExec.exe
3160	rundll32.exe
3160	rundll32.exe
3160	rundll32.exe
3160	rundll32.exe
3160	rundll32.exe
3160	rundll32.exe
3160	rundll32.exe
4140	MsiExec.exe
4140	MsiExec.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4140	MsiExec.exe
4140	MsiExec.exe
4140	MsiExec.exe
3280	MsiExec.exe
3280	MsiExec.exe
4140	MsiExec.exe
4140	MsiExec.exe
3096	rundll32.exe
3096	rundll32.exe
3096	rundll32.exe

Registers COM server for autorun 1 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdGuardVpn = "\"C:\\Program Files (x86)\\AdGuardVpn\\AdGuardVpn.exe\" /nosplash"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d0b21da6-a4b1-449b-9408-4b3dfd73215c} = "\"C:\\ProgramData\\Package Cache\\{d0b21da6-a4b1-449b-9408-4b3dfd73215c}\\installer.exe\" /burn.runonce"	installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\x86\AdguardNetLib.dll	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.fr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.vi.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\x86\AGIpHelperClose.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.it.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\arm64\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.zh-TW.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.bg.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.Network.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\wintun.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\x86\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.pl.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.no.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.VpnApi.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\x64\adgvpnnetworktdidrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.da.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.fr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\drivers.bin	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.pt-BR.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.tr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.uk.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.exe.manifest	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\x64\AdguardNetReg.exe	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.ja.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.es.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.ru.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.uk.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\x64\AGIpHelperClose.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.sk.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.tr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.ja.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.pl.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe.config	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\default.adg	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\x86\sciter.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.hr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.ro.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.sr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.it.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.Commons.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Google.Protobuf.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\SQLite.Interop.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\default.adg	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuard.Utils.UI.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Adguard.Vpn.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.Tools.exe	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe.manifest	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.es.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.pt-PT.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.fa.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.pl.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\x86\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.da.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.id.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.hr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.nl.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworktdidrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x86\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.it.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.ar.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.cs.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI457E.tmp-\wintun.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\AdGuardVpn.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\AdGuardVpn.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI457E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\Google.Protobuf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F0E.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\AdGuardVpn.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\AdGuardVpn.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4103.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\AdGuardVpn.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4163.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b14fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F0E.tmp-\AdGuardVpn.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\AdGuard.Utils.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3E70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\AdGuardVpn.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F0E.tmp-\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI457E.tmp-\AdGuardVpn.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\Google.Protobuf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\Adguard.Vpn.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\AdGuard.Utils.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F0E.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File created	C:\Windows\Installer\e5b14ff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI455D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI44DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\Google.Protobuf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\AdGuardVpn.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\Google.Protobuf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3268.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F0E.tmp-\SharpRaven.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI457E.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI457E.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI457E.tmp-\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}\AdGuardVpnIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI457E.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp-\SharpRaven.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2588	sc.exe
1160	sc.exe
4988	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3324	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2484	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	AdGuardVpnSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AdGuardVpnSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdGuardVpnSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627877640430443"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AdGuardVpnSvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\ = "open"	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\print\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\mshtml.dll\",PrintHTML \"%1\""	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\ContextMenuHandlers\{FBF23B40-E3F0-101B-8488-00AA003E56F8}	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg\OpenWithProgIds\svgfile	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "htmlfile"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\EditFlags = "2"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\ = "Pinned Site Shortcut"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\ = "open"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA1DD2DF0890A34DA93C77C2E290535\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\xhtmlfile	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA1DD2DF0890A34DA93C77C2E290535\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}v2.3.1403.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\CommandId = "IE.File"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\ = "&Open"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\PropertyHandler	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}\Version = "2.3.1403.0"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.url\OpenWithProgIds	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\ContextMenuHandlers	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5731"	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\IE.AssocFile.HTM	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\IconHandler	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}\Dependents\{d0b21da6-a4b1-449b-9408-4b3dfd73215c}	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-32554"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{d0b21da6-a4b1-449b-9408-4b3dfd73215c}\ = "{d0b21da6-a4b1-449b-9408-4b3dfd73215c}"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,5"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.website	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\{00021500-0000-0000-C000-000000000046}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\EditFlags = "2"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,2"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\IconHandler	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iexplore.exe	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\URL Protocol	ie4uinit.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdGuardVpnSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	AdGuardVpnSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdGuardVpnSvc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe
3908	chrome.exe
3908	chrome.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4252	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeCreatePagefilePrivilege	2436	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
1212	7zG.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4252	OpenWith.exe
4136	2EU.exe
3360	setup.exe
2724	setup.exe
4172	installer.exe
2164	AdGuardVpn.exe
2164	AdGuardVpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2896	2436	chrome.exe	81
PID 2436 wrote to memory of 2896	2436	chrome.exe	81
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 60	2436	chrome.exe	83
PID 2436 wrote to memory of 4060	2436	chrome.exe	84
PID 2436 wrote to memory of 4060	2436	chrome.exe	84
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85
PID 2436 wrote to memory of 1880	2436	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://5.42.65.64
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae7feab58,0x7ffae7feab68,0x7ffae7feab78
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:2
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:8
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1992,i,4395694282552745967,12175225357685487029,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1640

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\2EU\" -spe -an -ai#7zMap32227:70:7zEvent4322
1⤵
- Suspicious use of FindShellTrayWindow
PID:1212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4252
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\2EU\.eh_fram
  2⤵
  PID:2796

C:\Users\Admin\Downloads\2EU.exe
"C:\Users\Admin\Downloads\2EU.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4136
- C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
  C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe AID=18675_pagevpn_en_windows_overview
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3360
- - C:\Windows\Temp\{9FB194AC-E087-4C71-B9F1-CA163CA5BB2B}\.cr\setup.exe
    "C:\Windows\Temp\{9FB194AC-E087-4C71-B9F1-CA163CA5BB2B}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=728 -burn.filehandle.self=724 AID=18675_pagevpn_en_windows_overview
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:2724
  - - C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.be\installer.exe
      "C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.be\installer.exe" -q -burn.elevated BurnPipe.{6F275022-9C35-4D15-91A4-BC71FD6590BF} {0D0F56F6-2BBE-4A7E-ADC9-4D732B69F242} 2724
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:4172
  - - C:\Windows\SysWOW64\sc.exe
      "sc" query adgvpnnetworktdidrv
      4⤵
      Launches sc.exe
      PID:2588

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 80B06EC141F699398A0E6BD09804D4D3
  2⤵
  - Loads dropped DLL
  PID:4140
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI18A5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240851578 2 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnFirstInstall
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4976
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3268.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240857921 16 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.PermanentActions
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1356
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3B33.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240860140 35 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnInstallInitialize
    3⤵
    - Manipulates Digital Signatures
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3160
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3F0E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240860968 44 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.CheckServiceStop
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:744
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI457E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240862609 92 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnInstallFinalize
    3⤵
    - Blocklisted process makes network request
    - Manipulates Digital Signatures
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies system certificate store
    PID:3096
  - - C:\Windows\system32\ie4uinit.exe
      "C:\Windows\system32\ie4uinit.exe" -show
      4⤵
      Modifies Installed Components in the registry
      Registers COM server for autorun
      Modifies Internet Explorer settings
      Modifies registry class
      PID:4952
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C "net start "AdGuard VPN Service""
      4⤵
      PID:4604
    - - C:\Windows\SysWOW64\net.exe
        
        net start "AdGuard VPN Service"
        5⤵
        
        PID:1000
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start "AdGuard VPN Service"
        6⤵
        
        PID:1712
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5BA7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240868265 141 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize
    3⤵
    - Drops file in Windows directory
    PID:4676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5CA884E41BDABC3E2B6B25F29C2F768 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:3280

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2348

C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe
"C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  /c "schtasks /create /xml "C:\ProgramData\AdguardVPN\config-7026ae5e5d354801888fa70fe7bf40ae.xml" /tn 7026ae5e5d354801888fa70fe7bf40ae /f"
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /xml "C:\ProgramData\AdguardVPN\config-7026ae5e5d354801888fa70fe7bf40ae.xml" /tn 7026ae5e5d354801888fa70fe7bf40ae /f
    3⤵
    - Creates scheduled task(s)
    PID:3324
- C:\Windows\SysWOW64\sc.exe
  "sc" sdshow "Adguard VPN Service"
  2⤵
  - Launches sc.exe
  PID:1160
- C:\Windows\SysWOW64\sc.exe
  "sc" sdset "Adguard VPN Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C "schtasks /run /tn 7026ae5e5d354801888fa70fe7bf40ae"
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /tn 7026ae5e5d354801888fa70fe7bf40ae
    3⤵
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C "schtasks /delete /tn 7026ae5e5d354801888fa70fe7bf40ae /f"
  2⤵
  PID:3972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn 7026ae5e5d354801888fa70fe7bf40ae /f
    3⤵
    PID:3032

C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.exe
"C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5b14fe.rbs

Filesize
358KB

MD5
c37a6890025de00ff4c916d82d2f3e3c

SHA1
93ff1b7ef1ba9dae11782fb19d9e6bdd2498c9db

SHA256
175db194f485a54afde0aa0ba9cbbc207316a489b3505a04c375aeb21949840b

SHA512
957ec0a3670c3d753138c8ba1a40393bd065c60b6d59454d8163947f543aab61f788d972285c8034eea8d781e3b2378b690d2e0c5e21053bc786592f791b16a9

Download Submit
C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.exe

Filesize
1.1MB

MD5
8da7e3981f9ac837796324f3c124c081

SHA1
0683751cbf0bf5128a89d640be51511e1640853e

SHA256
37fcc428c298411e1fa0e4cc78cad140741b694977a61818adf7565c095a6399

SHA512
909c784d7e785f0196f9d0f14c61d2d797c2e98192a5949a3e3647d3074dfe90830fee0fe7a36cec99c0b0e426085926d2e9c8b39b55f9bb2149b7f20edf8238

Download Submit
C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworktdidrv.sys

Filesize
68KB

MD5
089a31d0fac91a30141b8b49c059ccaf

SHA1
bbb49c503f3e32dc7bbcc33d8161e33eb5c5d475

SHA256
7d3e8e17df36be5f26374f962301637538c7e791a883093da5a7575841229516

SHA512
b8579d8a41ec330ab9a58d2f49a547a578eb91e60335894c12f97d26aebef82a315538a2d0f89891a85ebc181ced34b7152859a0f7c347d2261efd5745c26eaf

Download Submit
C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworkwfpdrv.sys

Filesize
86KB

MD5
e7e44dd63b09039ddf242e4d553c821a

SHA1
09b43337831f4f63352b6d525078c277babf3e41

SHA256
87aab71bbfd2ae1edcaf505dea463af63cd7a2c6ceb5eb5d55dc7d01b2b4af50

SHA512
0cd14a64d3dfd9d2da611b3a5d9c0ef5bf69594779c2d66c1f7fab599e521558b0fe969680cc64cb12e4f1176a028e26a3475724e07583efeb1e22e195d6d100

Download Submit
C:\Program Files (x86)\AdGuardVpn\System.Memory.dll

Filesize
140KB

MD5
2bc5de386a4297144781d15b8e812b63

SHA1
ae6b19d49b413f1549b3540a9fbba00c1e8b3d27

SHA256
9c266080fb5f31e02a5005b91657093bd8c1faed23102e021a8be283c1753461

SHA512
e4d43c871af5c03392d2fb139fdf10c2f2da2f1d6fe0edd089e3e30369d6d350727b483c98868626f81d680400b44ee4d328e475b0017bfdeb38cdb44a8b4d4b

Download Submit
C:\Program Files (x86)\AdGuardVpn\System.Runtime.CompilerServices.Unsafe.dll

Filesize
23KB

MD5
a5aa80f49ad64689085755ab1ebf086e

SHA1
27e88cf0d2b34ea91efaa5cef9a763ee2722c824

SHA256
a79e1c30e9308afe4d680f0bfb82de3e8c1fe94aeca453ec4092c3ed4789ae6b

SHA512
f3dbd77e3a2ec3915b34d1387388abad45c99459ce03c06dc9a83d04f751b837c7b56cf9b4b7630f7fcd897a1d8057fce4cf761b1dc140a3928431b22b9b5b82

Download Submit
C:\Program Files (x86)\AdGuardVpn\wintun.dll

Filesize
538KB

MD5
fa0391a861b949de22e0a59c6faeaed5

SHA1
d451ef2224b27938eeaa97ad26f75b686d86082e

SHA256
d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931

SHA512
e44889d0f3044f90962181d7d8787076f70b6e1d7974150f16f83d33a97f1fc4bdd0c7a38eee7a1ea8e8dc4f66ed37dab004f2855dd361de8fdd4ae6e08fa048

Download Submit
C:\ProgramData\AdguardVpn\Backups\user_S-1-5-21-2080292272-204036150-2159171770-1000.config

Filesize
818B

MD5
8c2d64d17da287fdb3f5b5b21913baff

SHA1
2e9e8b4712f8e78a47172df6a556d80846cabe9d

SHA256
ebdb936c5dbf742b2b7d7c25452e2e9fdb98a91a0286d2469ef1e4d7dd042ded

SHA512
590cdf4f541d7c5b53c4dc500e20be07c66c969a33d658a1876fe08c9222f22ae4bae580fe63e2dc51c0c983b3619b153149fd88245355ca5b4bde3c6f5c9112

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
448KB

MD5
99c6d36855e3392e5a3d7e9c21e30f82

SHA1
b2dbb5eab4fb5b6215e863a2c28dcc65a1512564

SHA256
dc9db91dc57a13f203e1013afb9c00556de85ef9a380a0b140fadfce738d727e

SHA512
bda77b386453abc91f62437c0ad8186a7a646b2e309364d1cf18e5eb444c572204c34795ebcf22662f9ef72c51e09cd1308db0bc45ac15b5919b6a5ec3b92997

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
4493e37f1115beff7e41803ec5c4998d

SHA1
fccfffa50425599d33ba2d2c51def4aa0af99c32

SHA256
45578a050b6af69e404b144eb12620f3c38c4ebd4f99ce5577dd27b7e6df4734

SHA512
68f987a157ed9f7e0024ac979c313e9bba9bdbe0045e86b301916ce0e24556d3a7c545b0c0b874dca9da1e157d1353fa9bbf215dbc0c1e4bf9ff8faccde8e8aa

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
b720c608767642301f348ed040816a3f

SHA1
b321b0bcd289d80f93a2b4e5cf0f848596c37af3

SHA256
eabd403bc5378cc80af7f52089a9cf4c8e502bd9d4e63013c4123f1ead864969

SHA512
a3b0963d974d17ed50db0e96c9805059d52267a7fb258a1810e98b7a1ff547e92f60f703eca7de896ef9f9ff49e8d18eb9d8f3d7b0d78c55d847d8b6ab25a26d

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
99189e3bb269fb0b7312851f9e1bc844

SHA1
f9979feb4b08d4435b73c0fa9b4b0e736ad18731

SHA256
26f698163b89cf5b46b4c9539f14d1bdaf7410987193bd515134c4907c44fdd2

SHA512
7ce38dc0564268a4434ebc340d377b7584fe8af6d58d466e7b02d9a631426e4ef36bf437428f2aa87c6d02a0148980b0aa26a9cd49ba8e4115ae14dd380924f0

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
fe3f41e6502fb84de15de2f0d2ad4008

SHA1
ece79e4244768ba07a6f15a898a959fa3a3b5b50

SHA256
4e6e91e77a0e85c33766232483bb63823b68092f45f975e458592ce60d19d86d

SHA512
0aac2998ff2cd1a8a59092ec224fa0f1b62699d529f99fe2684c670763d3274bc57ad81dca45180bb73238956ce41251530afa3b8f20291e3a2eef295dd99070

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
7d8de9c420f0cd258b759bddf3bc89cb

SHA1
f7d0abb5dc180d53bbacc436422996934134ec53

SHA256
d47e60e55605eb20c39865c630bbeb8a9262eea384d8dda7b61dc34e0227c4c5

SHA512
a8ce39f481f4628f2558c2d8e57888155867a9ff1461b180545c004bf6f938213c7999b4a92dde5146fcc85e57e08e0196bebb2758027562a6d3245db7f68d3b

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
b17f0847acdd4da1e6c012da4906a0f6

SHA1
0c50b1542f9b9c7eab92e62b02e5b124ab12fa4f

SHA256
e7ec8debee7b3768a681927bab39f5d7bb38fd54204aeee429faf6020b22dd9d

SHA512
db83cb7ea3c4705c6bb6695bf9f0119dfa13ea01758bfc880b3179110c76e5c2b48d59dabbdb527dd296a429dea4ae7f4eb07a12ea91b5fa6bd10dec5e99b3a3

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
4957273252ab5f8ea1b6f6f55b3183e2

SHA1
daa6755aeb0a1e2608af584f76c3faefd0db752c

SHA256
f46e90a6d76ffaec07aa318c0a673bf48d4504ea2d140d3d74d5df1855258ac8

SHA512
426f9c4766717cfc23b5944c9ff64a0aa4f9d528c0bb3e61037460264173e0e9f9b562bf5d95ba8c1ce13de88d9ae584bd176bffe69b38881a82e0d16e150f63

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
32bf1e0d4471aa73ea10a6234f0127aa

SHA1
8dca3230f514d4395c51e4edd0b50351947b11f1

SHA256
ec50201b5efece17459a094fa3c155e36f28e09b7fb181bde07f58a94570b05d

SHA512
7ab3d1a9899a831242fa05b35d0e6e7f1d91aa2758b846235b9c0e4fc82a8acfe5b9d309dbb52bfd00a248cd8f6211064cebcdb8dd8a4f4fad084235dcfecbb3

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
589a036c2edae172031e5c7ef19c54f1

SHA1
9b410783a0c1d5c103e90b2b99416ba220cf8d4a

SHA256
7aaaffe8d8cb241a2191dc60c787c0d986718051f091d5b3e8c1b40ac4072df2

SHA512
b66190008f3ada0cd3624d29bc4953f20a619ee6317d8e21d119c05100d4ff1c7a4321ba7971c2d160407ff7830f31630756cfd76406e21ca5a2ec4615401ebd

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
b4d946b0c23fb51cc7b7b0f80b3a6ca4

SHA1
276ca2c71506627dac6c2cbdb9ca8b81ec958986

SHA256
cd0c455570363f0108d1167e92888a963e76a6a377bcf2e2974a5d700696c8f6

SHA512
63c720dd0dc71a64c0fa03f123f905c9780af11d8212e935b75453ff401ff817bc6102fd1b6c4965480216e61ac570ed170febbffaa3c7f0626a5b81ddc865f1

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
50d353a0921b87ac2168b2e0103cbb35

SHA1
83c8e93e2ff82d8bb2ad2be661a398f5641897a7

SHA256
70c3ed322d5bbd216dba4b4043b8c7000868fdf24226aaf1891c7cc53dcde276

SHA512
6dc277518690909576e545c5545ab6f95c40e4e74e14c23de5d1a4305442e639838eae8311de88843965774b499a4ef33d7e0333560a635479523a41f5e36ded

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
87458a7f36ded6d7efe2e1a8176cd0e4

SHA1
7c44f25b4f4b6ee4d2f582c718f5928767aa2daf

SHA256
7646af492758e5a1601ec898aad9b20b19f2c454b4f932064c92d11646872539

SHA512
1aeb7c12b6d239c054659e9461f73ea891836a715a7f30bac29192cd32c129df00d39cd802a105fba720ff48f249b651e8a0aa954e263f68daf63cb9ee6ab7d6

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
98c18835346f613257a5137fffffa325

SHA1
d21671ba32aca9e20500d8315c56332a25fc398d

SHA256
15fd758f5767deda505a5859af1453c6e7fafca3d11bb7695d7d5d183be1f0cf

SHA512
db2d6a206e35dbb8a340ef900418a524167c58af80d529f8d7f3ad818671d7de8c36098a8a50d8e70363beb7fbaf4c7bf0526f19af73f36054534685e1e083d0

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
16KB

MD5
00363a7af099086cf9df7b097b5fea49

SHA1
d0dece125af0f8cec184a96e7dd3e2f752836386

SHA256
42dd02cc6b15eba1be142c3f4bbe4bb69f9019880f3f8dfac9503995f5bc5182

SHA512
490e349b0e2cc1afefd6aa8a9b72fe5b5217b70864ffba5d70833267a57ea9ee9aab0192187b229a279432f12c0cffb7f5e48baccd5a9d24af2880ffebe0e1b4

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
16KB

MD5
bc66d870a7ebbef54b54bb0440a467bf

SHA1
8545149336095ad55ea1232d3b06b0daabbb740f

SHA256
6c7b3609f297eb9c2aae84083bc665eb39ca0dab07a5fec9c655f9b422078ab6

SHA512
4543c4460f7e5b4fa40029b3fa164cdfeb66bb588a6628353a6ca2305499a09de4d05f987315249200792155a3d038a04be224632c1c8ac2f2a1249e8d65e680

Download Submit
C:\ProgramData\AdguardVpn\statistics.db

Filesize
8KB

MD5
8c2277d01067d3323b2e29289e076db2

SHA1
c2f13e3193aedbe6e8f6291ee60b5779b22a73a1

SHA256
c28f7bab84362237b15108d0bda41d701fa3b6a32a0c2d82b5c1a7c75f12dcd3

SHA512
039d8d052049d6209c2e99a538f1257aa946ec3a06d5867b5b33488486fa2fbfa3ff27557309cd05d5158717f7cc7372e722f876ae8c159459e1d776ae87f025

Download Submit
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\AdGuardVpn.exe_StrongName_dcjvqv4mwhaksv3lahul52a3q4k4nm25\2.3.1403.0\1acopozt.newcfg

Filesize
938B

MD5
08f9ec0cf3cbcc691ac3db64d5187687

SHA1
90c68d536271548f22254b3c3d1196d6512c4bbb

SHA256
a7a39d0c31850f1691ba406ebfaa34a07bfdd82a6fad03df1d05bb1f345661f4

SHA512
422caa21f1dddb77a278db16a33b2815b5c02913b8edd383278b1561a962d8e6b2dbef52cfbeeb33a8ac94b07610aac4060af3aed8a2c8250fe2fc2919cde1f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e7f741ce00a43f281f4b04e4a6e9c79c

SHA1
bc7e27a3a76f61fafdea68df97deda13d9566690

SHA256
054c1f629b1acb6a6ea984415ee57db2f99626e9febe0f4d6b2eeca6c9cb0b94

SHA512
3b28189dd28dea542dd9cec3aa20453154fa45ccb87dcba75ef7baad02cb7996ecc7586f8404478f43770074b93974381c2dd6d4050d9f2d7126ee10686ba199

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
71e4ad8d9b3f3147ed6296224f3e0b80

SHA1
edd461cdcd60b72ad007a27ba388a17607dc139a

SHA256
20c46e5dd0d12d3f0e0f9c71456860f001bc51558153a1014b88e1a10a3c7e86

SHA512
017d79c8c53c6e8f00601d87d555ccd2669e44d8966f5eae9e4bc39c4050c28abfe466b5217b21175bae4c2cad3e06cd4cc2ea49383fa09e460eaa9088fcecbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
edb1ca10ffad2ca242de78afc120d3e6

SHA1
867fe8151c5ca6eb90253bb11fb1234913a7b6aa

SHA256
cea43853535ec5f6ee9b6edf7197a57f0153e3fe2bf143282a6fb73a9236b98b

SHA512
e7ead5e8119b5adc3ca2f8883d6a0a0a9caa66b0aebc46e113126f82f6069f749bdc8bb389f1d27a0f3b0d0686c778d28c8e548c03414cc13844b3e2115e610b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
b34222fd2dcc38780dc11d2bbb24b9c6

SHA1
0678a2aee71df18d4b1879a0e3cfb9539053d780

SHA256
2a0dd9c0313655af437ceb8674728179deae9b292b9da647751a089ce28e7d1c

SHA512
b482c5d5746b6982708a428dfa048c6320645207ae9529b8957f3fde5f2b6a8efca0f8b88330aa1570f54b78542cf402aad6bdf899a1b6b2d01989d237a2f4b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
8f19293c6a3f731b5a93fd4fa29a2dc2

SHA1
898ff916a7b9a9f4714c3a09b2cde7769d643a13

SHA256
b3f0e4ceaa8bea1aad808c45d8b2f76c4bc41861e22d6c48a5f7d4289066c670

SHA512
0da1b84df087cb9426260d3bad9735aa78e04aa77950660d0ee934532c609911c9e82ae55849978e2731a5e904edaaaf8d319ec6ea5afb8e8d01c17ddb318611

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d8fb.TMP

Filesize
88KB

MD5
958146395a9bf8456bc3621a2edd9499

SHA1
9369804f005070607ed9d93d3384788a064174b1

SHA256
ddcb9315beb3cc620589641d63afa5cf2985c30e2c234af087d9e4ff61828731

SHA512
680d5c26c17fb15289ef7cb2544275e7f89139c9b5f5b08bdd4f061713304a02680bff67272b68594d1083cc9c94f178c6cfe123274cd7c93c5147469c3dee7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
847B

MD5
f8ec7f563d06ccddddf6c96b8957e5c8

SHA1
73bdc49dcead32f8c29168645a0f080084132252

SHA256
38ef57aec780edd2c8dab614a85ce87351188fce5896ffebc9f69328df2056ed

SHA512
8830821ac9edb4cdf4d8a3d7bc30433987ae4c158cf81b705654f54aaeba366c5fa3509981aceae21e193dd4483f03b9d449bc0a32545927d3ca94b0f9367684

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdguardVPN\AdguardVPN_20240613213325_000_Main.log

Filesize
1KB

MD5
9bbef48d122fdacea9400bad6eccc74f

SHA1
02ea6dca5bc3ac1ce81555760620706fce17576f

SHA256
b87c0fe02e309880c317cb6653b600345fcbbe6e0bf95ff1e09569881d8abd86

SHA512
a52e64b9d93575349e94ebba19b2aef4258a284c8d4772884e01dee4bf4be35d6cbce15b5d3773365d1a267a4445163f24822460e3673db538e66a535d953564

Download Submit
C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe

Filesize
31.8MB

MD5
b005e4007eb93f23bb0e7f03fb634d46

SHA1
2ddd20cc6b44752baa19a8c871233ade7f27bbfc

SHA256
0cb50652e644a2dba3b47bf2d55acdd27ce1007286b37e615c6c7c115ba0a4ea

SHA512
992dba117a2e7076be418537c09b4028089f4df3e2f2723c7ea91e96efaa3246a062c8a399e5209ba8b1497fe0b1b4b64308f9ec9bee924ec06949990882c366

Download Submit
C:\Users\Admin\Downloads\2EU.file.crdownload

Filesize
113KB

MD5
9e5ce67c3c16565bec9652528ce925fd

SHA1
9852d432799585ec9e512a3dd2bc0c5cc32723ef

SHA256
e557b63a8849f78c85b57f79611a6d3efec2d19ad90534cdbec3d161e18d3f0e

SHA512
a7042f8668fe1e90ba39432a10c303646268d65e4ede5d256495bf7594b29bf76441e9d103e3b3a1965587a86ee048e0f3938d1f108406e666a3b9e6ecb51f9c

Download Submit
C:\Users\Admin\Downloads\2EU\.eh_fram

Filesize
8KB

MD5
923ae17274e756093759304ab472082f

SHA1
2e5d358e4eb48a14ef1063de58ff404e1486e621

SHA256
40b281aa324723c145d266ded9e3e42dc35f0584e0512333482b8d25b4fe7cbb

SHA512
899bc76b1cb33d7f07f2f9847723305c82e37ee4eeffc75377b659ec655d2cb744defe7bcbe5bace5bc39864c312c91ca2866f919b0ca1ca9307c80ef0acc27b

Download Submit
C:\Windows\Installer\MSI18A5.tmp

Filesize
5.1MB

MD5
249cd4661f2f2ac3ceaa5e1ea521dc33

SHA1
7b509ef275668338bfc833d7b807d582d23e683e

SHA256
d292e2f69eec2bbc73d71e6b39350a634a5e8164a478bd7ed5605da0d1399c69

SHA512
591c932628f354309715e21325403351224a52d6ac7a1435a307d38a2a3623296dc3efeb6af872f1266255b122c0c1279555a8dadadbd1d02a285afba2de3776

Download Submit
C:\Windows\Installer\MSI18A5.tmp-\AdGuardVpn.CustomActions.dll

Filesize
359KB

MD5
166d76ae5b77fd387f04c13681bec6e9

SHA1
995e64c8e229f1e0ca67cd87156d0372e60dee95

SHA256
a745e44404ad39477124c2f31b0229d59404d0af450f870a456b9eed9c7afa82

SHA512
f899fd9523673f2f243f91201a6b8b0c8f7b7c2caf4927e1650e81a4161cac62f8ababccf5123392209430af445a8550d5a9e4959645055827f317d076b80bbc

Download Submit
C:\Windows\Installer\MSI18A5.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI3268.tmp-\CustomAction.config

Filesize
228B

MD5
d044d23e8084c869cbdae714ba47b866

SHA1
40d25b0fec3e43b7d966d02928d60904e32bd84a

SHA256
f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd

SHA512
62d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9

Download Submit
C:\Windows\Installer\MSI3F0E.tmp-\AdGuardVpn.dll

Filesize
6.1MB

MD5
d1a5895b27ab2b99d91faa998d23b58e

SHA1
407caed4fbd0d9ea1646ff0afedc11334f39b3ad

SHA256
364531a0a4c65b2132398b1a9085cf3ade18cf9315795f4792ffdc2ddbb4e4a8

SHA512
2557f86bf58bfbecaf583819740095e0b2a3bd7dad1e11f11d21c542c5547c7eba08d55ecc4580e11e65125b88212f504c3e8aa9bd44a32fa6160a12573f3190

Download Submit
C:\Windows\Installer\MSI3F0E.tmp-\Adguard.Vpn.Common.dll

Filesize
383KB

MD5
0fc409ae184fefb12dc266ed5f0a3862

SHA1
9eaa83402a9c2e7dece73114fa780bc8c65572a1

SHA256
43913461eceb87c5d7b45e3449851ee4f66af8cdafcc9db3c2874c2cb861ab65

SHA512
6dd3e463aaf27cd62f1fa066344ceac23d6af2b84cb0ffc3c23f44b752d126641c00354f20a66c76e81109ae39da817b82e408d203102d1b33b83fb4bb9014ca

Download Submit
C:\Windows\Installer\MSI3F0E.tmp-\Adguard.Vpn.dll

Filesize
1.5MB

MD5
e8b18df3ef0d16daab0b0c8a4d79e399

SHA1
8af84e066266bbf5226bc4be7e7933fd76da9c9f

SHA256
ea32a09c257867be8527e9f64dd2b19502992e913436d18c37376f92ac74333a

SHA512
6316fbaec1800304719bfb8fb3c87cd865e6024a40a783fe9396e4a10bcb5a634ebaf9225393b4f20b9d4e4cd224349659987844555046cd6413728e10d89823

Download Submit
C:\Windows\Installer\MSI3F0E.tmp-\Google.Protobuf.dll

Filesize
401KB

MD5
a93c82719e98c382d81bc0dcd99ad402

SHA1
8814b631fd15c35e737db42bc908791302496a83

SHA256
6e5db014ae75b455a97f7f161507ae1058f489333126f30607e6e534d3ddea82

SHA512
60d897ef434bda51921e111a39b50b4e2b832c8dc3a8444a4b36a2a9d898ea200d990ea2edfab02689b4c1a03d1cb9110428727dac13d70318b850d4289529f2

Download Submit
C:\Windows\Installer\MSI3F0E.tmp-\System.Data.SQLite.dll

Filesize
337KB

MD5
ae8e6840bcfce9ab0f6db77a5f60ca1a

SHA1
0981e864217c2ec5c67ced185458010e4bedac6f

SHA256
dafa4a7e1186e5fe8223317f654795b9142d72917006edad03ee3d1de5162bc6

SHA512
b3c3ea043cc8a286c9b7684fa7402534e2ab61d3ea9605cbf65ef88e1af13a2efa4e4911c2bfc1518b33a315d098e72cebc04f8b47967adf6cffa2ad7765f5a2

Download Submit
C:\Windows\Installer\MSI3F0E.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll

Filesize
32KB

MD5
82deb78891f430007e871a35ce28fac4

SHA1
4e490d7ec139a6cde53e3932d3122a48aa379904

SHA256
2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237

SHA512
e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a

Download Submit
C:\Windows\Installer\MSI43C5.tmp

Filesize
127KB

MD5
93394d2866590fb66759f5f0263453f2

SHA1
2f0903d4b21a0231add1b4cd02e25c7c4974da84

SHA256
5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

SHA512
f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

Download Submit
C:\Windows\Installer\MSI44DF.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI457E.tmp-\System.Buffers.dll

Filesize
27KB

MD5
8174d97f8ee460b4c965be8f9f01a83e

SHA1
e445779d1c5b9a1edb3fc732c7bd57c8f16db69f

SHA256
9d3af29e14d26fde4da4c1ddcbcaee2e6b120115e21f364907c6f69b8ed09a25

SHA512
346acc32c2fd860901d69b48dc809c5730375d7cdeb1978ca8cbe98fb6a4065c607c47563ff6564f6ffd9606b2d4240c1763746bdd90e6e8e934887933135889

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\AdGuard.CrashReporter.dll

Filesize
476KB

MD5
d8cdfe259c09b2de638ef4a5bf2d4dce

SHA1
c06074a1965c2c773e92f85418dceb2c5fdfeaf0

SHA256
5bc6335bc9649af916a82965e3b55c1b693c216b4fa4d76740f2db4616e82cd5

SHA512
752e99adf65bc926f2c1ae47ecadf271f788d46ceab47c525fd8ec97a9388fe8f38564c63896a8d61aaba5652f37703cd234f463bef58781466aaa2b0ac0b079

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\AdGuard.Utils.Base.dll

Filesize
886KB

MD5
7df624f2ab3dbe6c5fbca91f6ea59430

SHA1
702a5c61afb3d56c89513e08244359a1b7f4f6e7

SHA256
b43544bf5e511b4049289ce847f7710de6b5eefb2cf7956ce452ffe53ca0ba7f

SHA512
ee38023bdb887d8be5b18167280126809c3c9230d630c4cdae8e650aecf8fde2b6a1df234fcd5d6ce2eede09b504137669c8e0ea06c6aa454a10d6073a3a6558

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\AdGuard.Utils.Installer.dll

Filesize
55KB

MD5
abd2f4a5cfa8a9608fb14e3fbf44871f

SHA1
b5249f54a6a73c27bcbbdc07fb6c86d9745be35f

SHA256
06c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5

SHA512
7dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\AdGuard.Utils.UI.dll

Filesize
621KB

MD5
ec3d9350a9a400fb3271c7327f5bf5a8

SHA1
0eea26f71e7d03579303b9ffc34549fa7ac843e9

SHA256
aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4

SHA512
a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\AdGuard.Utils.dll

Filesize
1.8MB

MD5
5078eddd8dc8d0d328d7eeceb459929b

SHA1
60f4a74dbc5f4af10526198a5a43e09f84b54c98

SHA256
c63ce2079d0ee96ba13cbba30b6cf4c7ef42720815e82d8eac2526adbf881f40

SHA512
b09b7fbdcc899bfe27f76080d95b3882875a5f53faec52c97418554e38373327088b750581c85fb6d66d19d3c1cccff6f313fcf73519b48d6b32f260a7f3a84c

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\AdGuardVpn.Burn.dll

Filesize
255KB

MD5
dee30f3e6ba778c751f2f60fb4670478

SHA1
498124da412a7a4d8bb6b78228f800b583262100

SHA256
44c456f809e765a91c4527b55591301eaf74260d92fdd786f3e4053b700b2864

SHA512
f8f3928aace5e6fb593966ac6d2ed113598c37a0b767cbe4eda7d9f53e3e612bcf4642ffe3bf1432fd564716c1f4a02f72d8e6d0279d6262593b1f9fdca19a04

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\BootstrapperCore.config

Filesize
1KB

MD5
427918825375ce8aa01f208629c901fa

SHA1
bb983d3b30454deb48695e495b8483195d72c927

SHA256
eee85d8d43e427f87e043f9516bc2511c891980a134eba7e2d6097438ef860e4

SHA512
1368fb726b21d96278773e37ff36b20952578c814f7e4d3ef76cc81a5b2d608f04e65c1e6328f19aa59f40dd2701d6f5afa167cde14143d385cd075a8359b4cf

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\BootstrapperCore.dll

Filesize
87KB

MD5
b0d10a2a622a322788780e7a3cbb85f3

SHA1
04d90b16fa7b47a545c1133d5c0ca9e490f54633

SHA256
f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

SHA512
62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\Newtonsoft.Json.dll

Filesize
647KB

MD5
5afda7c7d4f7085e744c2e7599279db3

SHA1
3a833eb7c6be203f16799d7b7ccd8b8c9d439261

SHA256
f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

SHA512
7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\SharpRaven.dll

Filesize
114KB

MD5
89a2762f19597b82d5c501366e5b2f29

SHA1
f5df7962015164e4bfed0ae361f988c1e581677e

SHA256
a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167

SHA512
bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\.ba\mbahost.dll

Filesize
119KB

MD5
c59832217903ce88793a6c40888e3cae

SHA1
6d9facabf41dcf53281897764d467696780623b8

SHA256
9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

SHA512
1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

Download Submit
C:\Windows\Temp\{781A7E4E-04CF-4799-93B2-705361ED9C25}\Main

Filesize
26.0MB

MD5
2aa797ca84648d5d758a5ffd2abb85b6

SHA1
690b3e5313df89c6b455275efa1a2c02a2006b61

SHA256
6912c25dd7cdd7109996d75f789fee679e7cfa7f1065cbaaba28a76926a30d2a

SHA512
a43a81c4a2581671bcdcbb30171221cec596e82adf33c7218ca029c623b0747cf89d4c1e86b667c3eefb3885dea6038407d1e7aa5c30d6db16b2fb4fecd907ee

Download Submit
C:\Windows\Temp\{9FB194AC-E087-4C71-B9F1-CA163CA5BB2B}\.cr\setup.exe

Filesize
7.0MB

MD5
29467fd9be93c4ac0ba9d863ae30edf9

SHA1
f19cb3f6da9dd998e0bfb7183d13ca9b592c7899

SHA256
edb674894994d5cac133abec9e5e2ece8560dc8bcc70a3bf94d341c87a15e8e2

SHA512
164afba38bddd8411800886df66599db53ee979d4320bd9b986f716f7c287588ea63f8fd01027c838b50aca22fc10b60b42cbfc66dd53465f741a90ff162458c

Download Submit
memory/744-525-0x0000000004810000-0x0000000004832000-memory.dmp

Filesize
136KB

Download
memory/1504-862-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/1504-874-0x0000000006340000-0x000000000646A000-memory.dmp

Filesize
1.2MB

Download
memory/1504-1385-0x0000000009870000-0x0000000009882000-memory.dmp

Filesize
72KB

Download
memory/1504-1387-0x0000000009AB0000-0x0000000009BBA000-memory.dmp

Filesize
1.0MB

Download
memory/1504-953-0x000000006C960000-0x000000006C970000-memory.dmp

Filesize
64KB

Download
memory/1504-883-0x0000000006F80000-0x0000000006FBC000-memory.dmp

Filesize
240KB

Download
memory/1504-863-0x0000000004390000-0x00000000044FA000-memory.dmp

Filesize
1.4MB

Download
memory/1504-864-0x0000000004670000-0x000000000470C000-memory.dmp

Filesize
624KB

Download
memory/1504-865-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download
memory/1504-866-0x00000000048A0000-0x0000000004A26000-memory.dmp

Filesize
1.5MB

Download
memory/1504-867-0x0000000004050000-0x0000000004218000-memory.dmp

Filesize
1.8MB

Download
memory/1504-868-0x0000000004710000-0x00000000047C0000-memory.dmp

Filesize
704KB

Download
memory/1504-869-0x0000000005810000-0x0000000005DA6000-memory.dmp

Filesize
5.6MB

Download
memory/1504-870-0x0000000005650000-0x00000000056FA000-memory.dmp

Filesize
680KB

Download
memory/1504-871-0x0000000004390000-0x00000000044FA000-memory.dmp

Filesize
1.4MB

Download
memory/1504-872-0x0000000006130000-0x00000000061AC000-memory.dmp

Filesize
496KB

Download
memory/1504-873-0x00000000061B0000-0x000000000620E000-memory.dmp

Filesize
376KB

Download
memory/1504-1386-0x00000000098D0000-0x000000000990C000-memory.dmp

Filesize
240KB

Download
memory/1504-875-0x00000000065D0000-0x0000000006728000-memory.dmp

Filesize
1.3MB

Download
memory/1504-876-0x0000000006280000-0x00000000062FC000-memory.dmp

Filesize
496KB

Download
memory/1504-877-0x0000000006470000-0x00000000064EA000-memory.dmp

Filesize
488KB

Download
memory/1504-878-0x00000000067B0000-0x000000000680A000-memory.dmp

Filesize
360KB

Download
memory/1504-879-0x0000000006730000-0x000000000677C000-memory.dmp

Filesize
304KB

Download
memory/1504-880-0x0000000007320000-0x00000000076FA000-memory.dmp

Filesize
3.9MB

Download
memory/1504-881-0x0000000008AD0000-0x00000000090E8000-memory.dmp

Filesize
6.1MB

Download
memory/1504-882-0x0000000006FE0000-0x0000000007072000-memory.dmp

Filesize
584KB

Download
memory/1504-884-0x0000000006EB0000-0x0000000006ED1000-memory.dmp

Filesize
132KB

Download
memory/2164-1407-0x0000000008070000-0x0000000008078000-memory.dmp

Filesize
32KB

Download
memory/2164-1402-0x0000000006450000-0x00000000069E6000-memory.dmp

Filesize
5.6MB

Download
memory/2164-1546-0x0000000011170000-0x0000000011178000-memory.dmp

Filesize
32KB

Download
memory/2164-1545-0x0000000013990000-0x0000000013998000-memory.dmp

Filesize
32KB

Download
memory/2164-1398-0x00000000007A0000-0x00000000008B8000-memory.dmp

Filesize
1.1MB

Download
memory/2164-1408-0x00000000094D0000-0x00000000094DA000-memory.dmp

Filesize
40KB

Download
memory/2164-1404-0x0000000007E10000-0x0000000007E72000-memory.dmp

Filesize
392KB

Download
memory/2724-275-0x00000000078D0000-0x0000000007978000-memory.dmp

Filesize
672KB

Download
memory/2724-269-0x0000000006F50000-0x0000000006F6E000-memory.dmp

Filesize
120KB

Download
memory/2724-232-0x00000000063B0000-0x00000000063C8000-memory.dmp

Filesize
96KB

Download
memory/2724-239-0x00000000068E0000-0x0000000006926000-memory.dmp

Filesize
280KB

Download
memory/2724-243-0x00000000068B0000-0x00000000068C2000-memory.dmp

Filesize
72KB

Download
memory/2724-247-0x0000000006B60000-0x0000000006C42000-memory.dmp

Filesize
904KB

Download
memory/2724-253-0x00000000070B0000-0x0000000007278000-memory.dmp

Filesize
1.8MB

Download
memory/2724-258-0x0000000006E70000-0x0000000006F0E000-memory.dmp

Filesize
632KB

Download
memory/2724-263-0x0000000006FB0000-0x000000000702A000-memory.dmp

Filesize
488KB

Download
memory/2724-278-0x0000000007450000-0x0000000007472000-memory.dmp

Filesize
136KB

Download
memory/2724-279-0x0000000007980000-0x0000000007CD4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-283-0x000000000BB00000-0x000000000BB08000-memory.dmp

Filesize
32KB

Download
memory/2724-287-0x000000000BE80000-0x000000000BE8E000-memory.dmp

Filesize
56KB

Download
memory/2724-286-0x000000000BEB0000-0x000000000BEE8000-memory.dmp

Filesize
224KB

Download
memory/2724-285-0x000000000BF20000-0x000000000BF28000-memory.dmp

Filesize
32KB

Download
memory/2724-284-0x000000000C570000-0x000000000C5B0000-memory.dmp

Filesize
256KB

Download
memory/3096-841-0x0000000005010000-0x0000000005188000-memory.dmp

Filesize
1.5MB

Download
memory/3096-844-0x0000000004F00000-0x0000000004F64000-memory.dmp

Filesize
400KB

Download
memory/3096-857-0x00000000053D0000-0x00000000053DA000-memory.dmp

Filesize
40KB

Download
memory/3096-860-0x0000000005570000-0x0000000005578000-memory.dmp

Filesize
32KB

Download
memory/3096-856-0x00000000055C0000-0x00000000055E6000-memory.dmp

Filesize
152KB

Download
memory/3096-852-0x0000000005630000-0x0000000005698000-memory.dmp

Filesize
416KB

Download
memory/3096-859-0x00000000053F0000-0x00000000053F8000-memory.dmp

Filesize
32KB

Download
memory/4136-123-0x00000000002D0000-0x00000000002F0000-memory.dmp

Filesize
128KB

Download
memory/4676-1049-0x0000000005750000-0x000000000576E000-memory.dmp

Filesize
120KB

Download
memory/4676-1030-0x0000000005380000-0x00000000053F6000-memory.dmp

Filesize
472KB

Download
memory/4976-344-0x00000000051F0000-0x000000000521E000-memory.dmp

Filesize
184KB

Download
memory/4976-348-0x0000000005280000-0x00000000052E0000-memory.dmp

Filesize
384KB

Download