hxxp://5[.]42[.]65[.]64

Resubmissions

17/06/2024, 23:28

240617-3gbe5syekf 8

13/06/2024, 21:40

240613-1jl9ba1dmh 10

13/06/2024, 21:29

240613-1bx1va1amd 8

10/06/2024, 22:28

240610-2d5ddatejn 10

Analysis

max time kernel
269s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://5.42.65.64

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

flow	pid	Process
52	3272	msiexec.exe
54	3272	msiexec.exe
65	2416	rundll32.exe
68	2416	rundll32.exe
69	2416	rundll32.exe
70	2416	rundll32.exe
71	2416	rundll32.exe
72	2416	rundll32.exe
73	2416	rundll32.exe
75	2416	rundll32.exe

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 10 IoCs

pid	Process
2624	2ONE.exe
3280	setup.exe
2072	setup.exe
3916	installer.exe
3344	2EU.exe
4720	AdGuardVpnSvc.exe
3136	2EU.exe
3204	AdGuardVpn.exe
3384	setup.exe
1072	setup.exe

Loads dropped DLL 64 IoCs

pid	Process
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
2072	setup.exe
944	MsiExec.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
944	MsiExec.exe
4384	rundll32.exe
4384	rundll32.exe
4384	rundll32.exe
4384	rundll32.exe
4384	rundll32.exe
4384	rundll32.exe
4384	rundll32.exe
4384	rundll32.exe
4384	rundll32.exe
944	MsiExec.exe
4576	rundll32.exe
4576	rundll32.exe
4576	rundll32.exe
4576	rundll32.exe
4576	rundll32.exe
4576	rundll32.exe
4576	rundll32.exe
944	MsiExec.exe
944	MsiExec.exe
512	rundll32.exe
512	rundll32.exe
512	rundll32.exe
512	rundll32.exe
512	rundll32.exe
512	rundll32.exe
512	rundll32.exe
944	MsiExec.exe
944	MsiExec.exe
944	MsiExec.exe
1968	MsiExec.exe
1968	MsiExec.exe
944	MsiExec.exe
944	MsiExec.exe
2416	rundll32.exe
2416	rundll32.exe
2416	rundll32.exe

Registers COM server for autorun 1 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d0b21da6-a4b1-449b-9408-4b3dfd73215c} = "\"C:\\ProgramData\\Package Cache\\{d0b21da6-a4b1-449b-9408-4b3dfd73215c}\\installer.exe\" /burn.runonce"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdGuardVpn = "\"C:\\Program Files (x86)\\AdGuardVpn\\AdGuardVpn.exe\" /nosplash"	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.de.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.it.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.ru.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuard.Updater.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.nl.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\x64\adgvpnnetworktdidrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.pt-BR.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.zh.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.it.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.pl.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.zh.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.Service.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe.config	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\x64\adgvpnnetworktdidrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.zh-TW.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.UI.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.VpnApi.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.Commons.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\x86\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\default.adg	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuard.Sciter.BaseApi.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.de.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.ro.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.pt-PT.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\x86\AdguardNetReg.exe	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.uk.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\sciter_vpn_metadata.json	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\arm64\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\x64\AdguardNetLib.dll	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.sl.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\x64\AdguardNetReg.exe	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.fr.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.pl.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\SQLite.Interop.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworktdidrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.sk.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.pt-BR.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\wintun.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.pt-PT.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.be.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuard.Utils.UI.PlatformDependent.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.Tools.exe.manifest	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Adguard.Vpn.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.hu.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworktdidrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.ru.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.zh-TW.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.cs.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuardVpn.UI.resources.de.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.CrashReporter.resources.ja.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.cs.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.da.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\langs\AdGuard.Updater.resources.ko.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\default.adg	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\System.Memory.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworkwfpdrv.sys	AdGuardVpnSvc.exe
File created	C:\Program Files (x86)\AdGuardVpn\AdGuard.Sciter.Vpn.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Adguard.Vpn.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\x64\AGIpHelperClose.dll	msiexec.exe
File created	C:\Program Files (x86)\AdGuardVpn\Google.Protobuf.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\wintun.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\AdGuardVpn.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File created	C:\Windows\Installer\e581ebe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43DC.tmp-\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\wintun.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\Google.Protobuf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4C40.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43DC.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI49CE.tmp	msiexec.exe
File created	C:\Windows\Installer\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}\AdGuardVpnIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\SharpRaven.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File created	C:\Windows\Installer\wix{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp-\Google.Protobuf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\AdGuardVpn.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI495E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp-\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\SharpRaven.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43DC.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43DC.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43DC.tmp-\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\System.Data.SQLite.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI21EB.tmp-\System.Buffers.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI473A.tmp-\AdGuard.Utils.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp-\wintun.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}\AdGuardVpnIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\SharpRaven.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI651B.tmp-\Adguard.Vpn.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp-\AdGuard.Utils.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43DC.tmp-\AdGuard.Utils.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp-\Adguard.Vpn.dll	rundll32.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4716	sc.exe
2788	sc.exe
3776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4340	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5076	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AdGuardVpnSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	AdGuardVpnSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133631405340116295"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AdGuardVpnSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AdGuardVpnSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AdGuardVpnSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	AdGuardVpnSvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht\Content Type = "application/xhtml+xml"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\ = "Open in S&ame Window"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5731"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA1DD2DF0890A34DA93C77C2E290535\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adguardvpn\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\URL Protocol	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "htmlfile"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithProgIds\mhtmlfile	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA1DD2DF0890A34DA93C77C2E290535\ProductIcon = "C:\\Windows\\Installer\\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}\\AdguardIcon.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.url\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-914"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\ = "opennew"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\telnet	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-910"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA1DD2DF0890A34DA93C77C2E290535\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA1DD2DF0890A34DA93C77C2E290535\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\EditFlags = "2"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\Content Type = "message/rfc822"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rlogin\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-908"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\{000214F9-0000-0000-C000-000000000046}	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{D2DD1AD4-980F-43A0-AD39-7CC7E2925053}\Version = "2.3.1403.0"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adguardvpn\shell	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\ = "&Open"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA1DD2DF0890A34DA93C77C2E290535\PackageCode = "75566213B094E6B45A12A3B1F6884F11"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67D6B8CE15E8BEB4692017B87EE80B85\4DA1DD2DF0890A34DA93C77C2E290535	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-913"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\ = "opennew"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\ = "mhtmlfile"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open\command	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\CommandId = "IE.File"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\EditFlags = "2"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394\DisplayName = "windows_ie_ac_001"	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\DefaultIcon	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\shell\open\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\url.dll\",MailToProtocolHandler %l"	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\https\DefaultIcon	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.url	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-903"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.partial\ = "IE.AssocFile.PARTIAL"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4DA1DD2DF0890A34DA93C77C2E290535	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\CommandId = "IE.File"	ie4uinit.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	AdGuardVpnSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdGuardVpnSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdGuardVpnSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2624	2ONE.exe
3280	setup.exe
2072	setup.exe
3916	installer.exe
3344	2EU.exe
3136	2EU.exe
3384	setup.exe
1072	setup.exe
3204	AdGuardVpn.exe
3204	AdGuardVpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2628	2412	chrome.exe	81
PID 2412 wrote to memory of 2628	2412	chrome.exe	81
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 4740	2412	chrome.exe	84
PID 2412 wrote to memory of 32	2412	chrome.exe	85
PID 2412 wrote to memory of 32	2412	chrome.exe	85
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86
PID 2412 wrote to memory of 4888	2412	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://5.42.65.64
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd66c1ab58,0x7ffd66c1ab68,0x7ffd66c1ab78
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:8
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=980 --field-trial-handle=1960,i,6686625972946529706,14142701436982669682,131072 /prefetch:2
  2⤵
  PID:512

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4204

C:\Users\Admin\Downloads\2ONE.exe
"C:\Users\Admin\Downloads\2ONE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2624
- C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
  C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe AID=18675_pagevpn_en_windows_overview
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3280
- - C:\Windows\Temp\{1980D465-880A-40E2-BE74-FE877F328F68}\.cr\setup.exe
    "C:\Windows\Temp\{1980D465-880A-40E2-BE74-FE877F328F68}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=720 -burn.filehandle.self=732 AID=18675_pagevpn_en_windows_overview
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:2072
  - - C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.be\installer.exe
      "C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.be\installer.exe" -q -burn.elevated BurnPipe.{18E8E641-E768-43F1-B2D1-FD3ECC5EE9A1} {46B3529C-0F9A-4D6F-B909-F12B27020BCE} 2072
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:3916
  - - C:\Windows\SysWOW64\sc.exe
      "sc" query adgvpnnetworktdidrv
      4⤵
      Launches sc.exe
      PID:4716

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3272
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 55836282F52FBD9BB23FB551BC97F964
  2⤵
  - Loads dropped DLL
  PID:944
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI21EB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240657046 2 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnFirstInstall
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3B01.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240663312 16 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.PermanentActions
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4384
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI43DC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240665609 35 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnInstallInitialize
    3⤵
    - Manipulates Digital Signatures
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4576
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI473A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240666437 44 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.CheckServiceStop
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:512
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4EB4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240668359 92 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnInstallFinalize
    3⤵
    - Blocklisted process makes network request
    - Manipulates Digital Signatures
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies registry class
    - Modifies system certificate store
    PID:2416
  - - C:\Windows\system32\ie4uinit.exe
      "C:\Windows\system32\ie4uinit.exe" -show
      4⤵
      Modifies Installed Components in the registry
      Registers COM server for autorun
      Modifies Internet Explorer settings
      Modifies registry class
      PID:1716
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C "net start "AdGuard VPN Service""
      4⤵
      PID:856
    - - C:\Windows\SysWOW64\net.exe
        
        net start "AdGuard VPN Service"
        5⤵
        
        PID:2424
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start "AdGuard VPN Service"
        6⤵
        
        PID:2180
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI651B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240674062 141 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize
    3⤵
    - Drops file in Windows directory
    PID:1052
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C2BB6CC3C0E3E4080E23AD30F9799CA7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1968

C:\Users\Admin\Downloads\2EU.exe
"C:\Users\Admin\Downloads\2EU.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3344

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4404

C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe
"C:\Program Files (x86)\AdGuardVpn\AdGuardVpnSvc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:4720
- C:\Windows\SysWOW64\cmd.exe
  /c "schtasks /create /xml "C:\ProgramData\AdguardVPN\config-054c897b30ce47c3aa7e2ae64347343a.xml" /tn 054c897b30ce47c3aa7e2ae64347343a /f"
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /xml "C:\ProgramData\AdguardVPN\config-054c897b30ce47c3aa7e2ae64347343a.xml" /tn 054c897b30ce47c3aa7e2ae64347343a /f
    3⤵
    - Creates scheduled task(s)
    PID:4340
- C:\Windows\SysWOW64\sc.exe
  "sc" sdshow "Adguard VPN Service"
  2⤵
  - Launches sc.exe
  PID:2788
- C:\Windows\SysWOW64\sc.exe
  "sc" sdset "Adguard VPN Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C "schtasks /run /tn 054c897b30ce47c3aa7e2ae64347343a"
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /tn 054c897b30ce47c3aa7e2ae64347343a
    3⤵
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C "schtasks /delete /tn 054c897b30ce47c3aa7e2ae64347343a /f"
  2⤵
  PID:3660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn 054c897b30ce47c3aa7e2ae64347343a /f
    3⤵
    PID:3600

C:\Users\Admin\Downloads\2EU.exe
"C:\Users\Admin\Downloads\2EU.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3136
- C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
  C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe AID=18675_pagevpn_en_windows_overview
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3384
- - C:\Windows\Temp\{05D3694E-E0D3-4ED1-AB65-D476D509C334}\.cr\setup.exe
    "C:\Windows\Temp\{05D3694E-E0D3-4ED1-AB65-D476D509C334}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=848 -burn.filehandle.self=728 AID=18675_pagevpn_en_windows_overview
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1072

C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.exe
"C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e581ec1.rbs

Filesize
358KB

MD5
645f65ad4e4d0b8ce1714d395ef28440

SHA1
b4bf0b4fea2ad0592e4330b6a95286d5b742c0f2

SHA256
c928e6caa4547365a39c76677fbcb82e4d4ff82d304258f956f0c6d555e09200

SHA512
ab90c136d36623c3ff693c7b5140b8271393979572b31178e07313c19caab50062e6e778ad890c205db0ba9172a92bdaa0514cf48df8012394ca9d2203dad528

Download Submit
C:\Program Files (x86)\AdGuardVpn\AdGuardVpn.exe

Filesize
1.1MB

MD5
8da7e3981f9ac837796324f3c124c081

SHA1
0683751cbf0bf5128a89d640be51511e1640853e

SHA256
37fcc428c298411e1fa0e4cc78cad140741b694977a61818adf7565c095a6399

SHA512
909c784d7e785f0196f9d0f14c61d2d797c2e98192a5949a3e3647d3074dfe90830fee0fe7a36cec99c0b0e426085926d2e9c8b39b55f9bb2149b7f20edf8238

Download Submit
C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworktdidrv.sys

Filesize
68KB

MD5
089a31d0fac91a30141b8b49c059ccaf

SHA1
bbb49c503f3e32dc7bbcc33d8161e33eb5c5d475

SHA256
7d3e8e17df36be5f26374f962301637538c7e791a883093da5a7575841229516

SHA512
b8579d8a41ec330ab9a58d2f49a547a578eb91e60335894c12f97d26aebef82a315538a2d0f89891a85ebc181ced34b7152859a0f7c347d2261efd5745c26eaf

Download Submit
C:\Program Files (x86)\AdGuardVpn\Drivers\win10\x64\adgvpnnetworkwfpdrv.sys

Filesize
86KB

MD5
e7e44dd63b09039ddf242e4d553c821a

SHA1
09b43337831f4f63352b6d525078c277babf3e41

SHA256
87aab71bbfd2ae1edcaf505dea463af63cd7a2c6ceb5eb5d55dc7d01b2b4af50

SHA512
0cd14a64d3dfd9d2da611b3a5d9c0ef5bf69594779c2d66c1f7fab599e521558b0fe969680cc64cb12e4f1176a028e26a3475724e07583efeb1e22e195d6d100

Download Submit
C:\Program Files (x86)\AdGuardVpn\System.Memory.dll

Filesize
140KB

MD5
2bc5de386a4297144781d15b8e812b63

SHA1
ae6b19d49b413f1549b3540a9fbba00c1e8b3d27

SHA256
9c266080fb5f31e02a5005b91657093bd8c1faed23102e021a8be283c1753461

SHA512
e4d43c871af5c03392d2fb139fdf10c2f2da2f1d6fe0edd089e3e30369d6d350727b483c98868626f81d680400b44ee4d328e475b0017bfdeb38cdb44a8b4d4b

Download Submit
C:\Program Files (x86)\AdGuardVpn\System.Runtime.CompilerServices.Unsafe.dll

Filesize
23KB

MD5
a5aa80f49ad64689085755ab1ebf086e

SHA1
27e88cf0d2b34ea91efaa5cef9a763ee2722c824

SHA256
a79e1c30e9308afe4d680f0bfb82de3e8c1fe94aeca453ec4092c3ed4789ae6b

SHA512
f3dbd77e3a2ec3915b34d1387388abad45c99459ce03c06dc9a83d04f751b837c7b56cf9b4b7630f7fcd897a1d8057fce4cf761b1dc140a3928431b22b9b5b82

Download Submit
C:\Program Files (x86)\AdGuardVpn\wintun.dll

Filesize
538KB

MD5
fa0391a861b949de22e0a59c6faeaed5

SHA1
d451ef2224b27938eeaa97ad26f75b686d86082e

SHA256
d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931

SHA512
e44889d0f3044f90962181d7d8787076f70b6e1d7974150f16f83d33a97f1fc4bdd0c7a38eee7a1ea8e8dc4f66ed37dab004f2855dd361de8fdd4ae6e08fa048

Download Submit
C:\ProgramData\AdguardVpn\Backups\user_S-1-5-21-2080292272-204036150-2159171770-1000.config

Filesize
818B

MD5
8c2d64d17da287fdb3f5b5b21913baff

SHA1
2e9e8b4712f8e78a47172df6a556d80846cabe9d

SHA256
ebdb936c5dbf742b2b7d7c25452e2e9fdb98a91a0286d2469ef1e4d7dd042ded

SHA512
590cdf4f541d7c5b53c4dc500e20be07c66c969a33d658a1876fe08c9222f22ae4bae580fe63e2dc51c0c983b3619b153149fd88245355ca5b4bde3c6f5c9112

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
a8caccb824930938859240969b1fdeb5

SHA1
0a665d9d31068ca040e5ab49fb1a40a5e72dfe11

SHA256
6a3f798db8bbe2d3b710e217467275660c6278630dd71aca80f0251075014744

SHA512
5293bf51a41a119cab850ee612816bd0e7181e0b9a1e53c1cd79312bf64213d3bf9cb10c257ea1ee8da6697a4d299425fae22f0e7c77abcc141b9490f7fc84a7

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
c78e316046bf48a2a746e9eb2faa2e46

SHA1
49780a441d70285b1e67b6b9fe524ab4bf7b41b0

SHA256
9d7c852f78d52ad74ecf7c47bb00965d11257fc8804cd6237586cad57dd613ce

SHA512
58b0cc1c834e9948eb81dc2fa0189f3ac382416b69cd11ef7befb5827955100f9a4255f8bbcee6af0db162553fdc7d9cc2a7577a1a0b659434097d9eda74e8b1

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
47461dc64a375929bebea956da3a5f78

SHA1
d1bc3d6fed0433e83676ed69edf6604d548589f9

SHA256
d6fbeb7658b99dcce10560ddb4d0527312904eabb00b74ba75445ec1086a88ed

SHA512
b06b9f45dd1390b5e068a53d51bfbcf76f45e4456245292f5ad9cb5e96821b83459599d14bbbc32a8e6e20dbf68229b30bef04102c6be2abb843df7ea20865a3

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
c693e646eb4c05ad884428b460f27abe

SHA1
9aa55f8d4e78fdd99b289278422fae5ac249ff4f

SHA256
f9b2efab947873666327b3f44d53035ea83bc10189fc1bd72907ed4d08824976

SHA512
8b7cffcaa0ec81dfcbb8d6d8e1aa8fd672905e3606c3bcc56b646b378c11c5f1efc49a07eea3ee1ccc411cb17ac86d19f811ffbbfc8e9d8e0b6dd4dbf5a0cea5

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.1MB

MD5
b81daf38ea962fba39714bb230a8e63a

SHA1
81d81a218767aa87df246abee396828f6f4befa2

SHA256
079c7e82fbf270bf23b48f245a9e20cc995689f5587bc219fd45f2fdde839b79

SHA512
995f9283eaa88315288088c414a74989ddeb4053751fcd3ad4f94cc96f9eb73532d06115f834bbe8f937277c80aa89fcd65f6fa4b5f46f651c36c5dffd99bd30

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
99ecef8ac2ae2617509d8db6d2f6f4c7

SHA1
766239cc9b837361b5302c0987c5885b82548a9c

SHA256
4dcec5574548fd67e6abde2bb7fb9e541f79d669b4b9c5e0481f03d9d21c2c80

SHA512
7ba1adb0733cd76f18878aa866406ac68d24e67f1654d273513299932275e3fd9a54a7a6b1667dc0f66f3c4a8ca885830f02cb80613d51219becf507629ce834

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
100e5f9ea1f7eb81c7c527ddf8c36976

SHA1
1efc401961929427bab53bb1cbc336009fe9f53e

SHA256
9b505d19f702554ca2fd051a4406bd892eb17af3d7ae793300bdd83cda0fe679

SHA512
60594d235ce23193534f533268daed9366a32dd0377005a9d85f29f8ad461a51e950d8fdf46607518b091fe7d5b2b8c58018ea4c8be690eac7efee62400e17ef

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
efd7247765d16390efce0d1ef816b4f8

SHA1
4818f6b27a8527f69a1da35af2707916d02f58c6

SHA256
8fbb50c204d34033bc03a16938b71effd8d7e718543145296e0cf01e22f40dc9

SHA512
d3fb47a55b27fa6df00049862f3c529bd7eeedbf506d8cbe97124eadfd798894c1691bbe873c6a0939cf3510387d938f6c7261f4653b54c0dc6ae249158356d6

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
5791f0f3120ff39f1f755c0ca70b8df6

SHA1
43e89d9c6bc12295b9d6db4ccb2e0740a495006c

SHA256
ef28150d0d6d804d401ced858c31f401dabbf16fea499118d153fa04756a188c

SHA512
ad6de7e6042804d6169b7b5b89e120a00ce51a928c379059ac3eb0a8eee106fc926d41a6cfc5e86f47825689875ffc224475c16c0e4e0e6375be18d8b4bc7640

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
1.5MB

MD5
b02e5935841b52481a601905ff4f2ba0

SHA1
15b939ac5df31ba55c34887b78ca58197649ea82

SHA256
42c4717c99314b469b51fca6216b501629083181d5b827fdebc6477620ea35bc

SHA512
76e86c3f8ef35125121debffb610be33190869ec9d33c18504ca901f957261d2bcdbfc7a1b9f9730dc3c7b02454d75ad4318d9b61813b5924a53ec3bf8847a1a

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
16KB

MD5
00363a7af099086cf9df7b097b5fea49

SHA1
d0dece125af0f8cec184a96e7dd3e2f752836386

SHA256
42dd02cc6b15eba1be142c3f4bbe4bb69f9019880f3f8dfac9503995f5bc5182

SHA512
490e349b0e2cc1afefd6aa8a9b72fe5b5217b70864ffba5d70833267a57ea9ee9aab0192187b229a279432f12c0cffb7f5e48baccd5a9d24af2880ffebe0e1b4

Download Submit
C:\ProgramData\AdguardVpn\adGuardVPN.db

Filesize
16KB

MD5
afe5650236a4111c8b60f2a4c1ee7d3d

SHA1
31199638d620ea8195fc5329518fd04e3e7936b0

SHA256
711ae261d70a8cc1b7c7fc131c3a8eab9f05569b6ef6426f8831fafcdcc47257

SHA512
d471c657f8309e185d9aa13b108d08c37cdca59adaa48440d2e6abd6e11395c531a5a89cf6dbcb339f15559a88fb85a5d12f0c42dd2870ae17722d037582fa17

Download Submit
C:\ProgramData\AdguardVpn\statistics.db

Filesize
8KB

MD5
8c2277d01067d3323b2e29289e076db2

SHA1
c2f13e3193aedbe6e8f6291ee60b5779b22a73a1

SHA256
c28f7bab84362237b15108d0bda41d701fa3b6a32a0c2d82b5c1a7c75f12dcd3

SHA512
039d8d052049d6209c2e99a538f1257aa946ec3a06d5867b5b33488486fa2fbfa3ff27557309cd05d5158717f7cc7372e722f876ae8c159459e1d776ae87f025

Download Submit
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\AdGuardVpn.exe_StrongName_dcjvqv4mwhaksv3lahul52a3q4k4nm25\2.3.1403.0\cgvd0lui.newcfg

Filesize
938B

MD5
08f9ec0cf3cbcc691ac3db64d5187687

SHA1
90c68d536271548f22254b3c3d1196d6512c4bbb

SHA256
a7a39d0c31850f1691ba406ebfaa34a07bfdd82a6fad03df1d05bb1f345661f4

SHA512
422caa21f1dddb77a278db16a33b2815b5c02913b8edd383278b1561a962d8e6b2dbef52cfbeeb33a8ac94b07610aac4060af3aed8a2c8250fe2fc2919cde1f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\96b6eb01-2f67-450d-96e0-5bc7d23bf255.tmp

Filesize
138KB

MD5
2c23edd11a6954d02cd799ac2711fb78

SHA1
074485d6fffc0b3cd73e08ce2fb20d5f8532b00b

SHA256
3a901ba71f3930a2c51ddc6a0380ab754b9a588b25ce8edef56f0d1a903ce6ee

SHA512
948bdbeb6b9b21d9ef89d31cb3531d2fcdf75a05a5261698b828e777fb8a3939545dff94488ee6227609309175fb662eac084a6b25517c46deffe900751ed143

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
99dbc78e0fc0f11f805b8990263bd95c

SHA1
d1b06787811077832ff798b79f546931f08f168e

SHA256
1bf4495da301b7a6e29641366ad6b65b5f1b72a710b9d58c02f449862012a174

SHA512
2a0bb218d45b2891bedff56560c91eaddaa6465d1169d228e02d42105bd22480ce8fc977e7d61a4ea17143531ae3c4618c82fa99afe23eed67e015f6546f75b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
434d255d6103760b1e920a5d7ea0e17a

SHA1
513a78b220213ddb0416a63e3314499683a72a72

SHA256
b8935acd37311ac75168fce6f48b3f2a38fff37afe33aa1552f64debe18cf796

SHA512
b24b7d2dcb322d7151b11784d89bb66637b3ae6870fde0351e1b897b3a67aafc90c378a05b67413e67262290eb722dfdb747eba10224c3c150b5f466abdbdcd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
847B

MD5
f8ec7f563d06ccddddf6c96b8957e5c8

SHA1
73bdc49dcead32f8c29168645a0f080084132252

SHA256
38ef57aec780edd2c8dab614a85ce87351188fce5896ffebc9f69328df2056ed

SHA512
8830821ac9edb4cdf4d8a3d7bc30433987ae4c158cf81b705654f54aaeba366c5fa3509981aceae21e193dd4483f03b9d449bc0a32545927d3ca94b0f9367684

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdguardVPN\AdguardVPN_20240617232944_000_Main.log

Filesize
1KB

MD5
6e96605a84a8b3edb20c30c66bd511d1

SHA1
98c6ab6a07c45898018d9e49ae876c52dac78a34

SHA256
a42abac481187db61f650fd251bd2f147dea0ba37d80f76f75a5c456ddcd8b38

SHA512
cc572c6ec8cffe184aa407a78df6c2bab99bfe466c6ddaaf364b7bcebff8e89a4e2943334bbdaabbaaa1f522599fcad299dc3ca9169ebcb2b0b3a199a13b41b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe

Filesize
31.8MB

MD5
b005e4007eb93f23bb0e7f03fb634d46

SHA1
2ddd20cc6b44752baa19a8c871233ade7f27bbfc

SHA256
0cb50652e644a2dba3b47bf2d55acdd27ce1007286b37e615c6c7c115ba0a4ea

SHA512
992dba117a2e7076be418537c09b4028089f4df3e2f2723c7ea91e96efaa3246a062c8a399e5209ba8b1497fe0b1b4b64308f9ec9bee924ec06949990882c366

Download Submit
C:\Users\Admin\Downloads\2EU.file.crdownload

Filesize
113KB

MD5
9e5ce67c3c16565bec9652528ce925fd

SHA1
9852d432799585ec9e512a3dd2bc0c5cc32723ef

SHA256
e557b63a8849f78c85b57f79611a6d3efec2d19ad90534cdbec3d161e18d3f0e

SHA512
a7042f8668fe1e90ba39432a10c303646268d65e4ede5d256495bf7594b29bf76441e9d103e3b3a1965587a86ee048e0f3938d1f108406e666a3b9e6ecb51f9c

Download Submit
C:\Windows\Installer\MSI21EB.tmp

Filesize
5.1MB

MD5
249cd4661f2f2ac3ceaa5e1ea521dc33

SHA1
7b509ef275668338bfc833d7b807d582d23e683e

SHA256
d292e2f69eec2bbc73d71e6b39350a634a5e8164a478bd7ed5605da0d1399c69

SHA512
591c932628f354309715e21325403351224a52d6ac7a1435a307d38a2a3623296dc3efeb6af872f1266255b122c0c1279555a8dadadbd1d02a285afba2de3776

Download Submit
C:\Windows\Installer\MSI21EB.tmp-\AdGuardVpn.CustomActions.dll

Filesize
359KB

MD5
166d76ae5b77fd387f04c13681bec6e9

SHA1
995e64c8e229f1e0ca67cd87156d0372e60dee95

SHA256
a745e44404ad39477124c2f31b0229d59404d0af450f870a456b9eed9c7afa82

SHA512
f899fd9523673f2f243f91201a6b8b0c8f7b7c2caf4927e1650e81a4161cac62f8ababccf5123392209430af445a8550d5a9e4959645055827f317d076b80bbc

Download Submit
C:\Windows\Installer\MSI21EB.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI3B01.tmp-\CustomAction.config

Filesize
228B

MD5
d044d23e8084c869cbdae714ba47b866

SHA1
40d25b0fec3e43b7d966d02928d60904e32bd84a

SHA256
f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd

SHA512
62d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9

Download Submit
C:\Windows\Installer\MSI473A.tmp-\AdGuardVpn.dll

Filesize
6.1MB

MD5
d1a5895b27ab2b99d91faa998d23b58e

SHA1
407caed4fbd0d9ea1646ff0afedc11334f39b3ad

SHA256
364531a0a4c65b2132398b1a9085cf3ade18cf9315795f4792ffdc2ddbb4e4a8

SHA512
2557f86bf58bfbecaf583819740095e0b2a3bd7dad1e11f11d21c542c5547c7eba08d55ecc4580e11e65125b88212f504c3e8aa9bd44a32fa6160a12573f3190

Download Submit
C:\Windows\Installer\MSI473A.tmp-\Adguard.Vpn.Common.dll

Filesize
383KB

MD5
0fc409ae184fefb12dc266ed5f0a3862

SHA1
9eaa83402a9c2e7dece73114fa780bc8c65572a1

SHA256
43913461eceb87c5d7b45e3449851ee4f66af8cdafcc9db3c2874c2cb861ab65

SHA512
6dd3e463aaf27cd62f1fa066344ceac23d6af2b84cb0ffc3c23f44b752d126641c00354f20a66c76e81109ae39da817b82e408d203102d1b33b83fb4bb9014ca

Download Submit
C:\Windows\Installer\MSI473A.tmp-\Adguard.Vpn.dll

Filesize
1.5MB

MD5
e8b18df3ef0d16daab0b0c8a4d79e399

SHA1
8af84e066266bbf5226bc4be7e7933fd76da9c9f

SHA256
ea32a09c257867be8527e9f64dd2b19502992e913436d18c37376f92ac74333a

SHA512
6316fbaec1800304719bfb8fb3c87cd865e6024a40a783fe9396e4a10bcb5a634ebaf9225393b4f20b9d4e4cd224349659987844555046cd6413728e10d89823

Download Submit
C:\Windows\Installer\MSI473A.tmp-\Google.Protobuf.dll

Filesize
401KB

MD5
a93c82719e98c382d81bc0dcd99ad402

SHA1
8814b631fd15c35e737db42bc908791302496a83

SHA256
6e5db014ae75b455a97f7f161507ae1058f489333126f30607e6e534d3ddea82

SHA512
60d897ef434bda51921e111a39b50b4e2b832c8dc3a8444a4b36a2a9d898ea200d990ea2edfab02689b4c1a03d1cb9110428727dac13d70318b850d4289529f2

Download Submit
C:\Windows\Installer\MSI473A.tmp-\System.Data.SQLite.dll

Filesize
337KB

MD5
ae8e6840bcfce9ab0f6db77a5f60ca1a

SHA1
0981e864217c2ec5c67ced185458010e4bedac6f

SHA256
dafa4a7e1186e5fe8223317f654795b9142d72917006edad03ee3d1de5162bc6

SHA512
b3c3ea043cc8a286c9b7684fa7402534e2ab61d3ea9605cbf65ef88e1af13a2efa4e4911c2bfc1518b33a315d098e72cebc04f8b47967adf6cffa2ad7765f5a2

Download Submit
C:\Windows\Installer\MSI473A.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll

Filesize
32KB

MD5
82deb78891f430007e871a35ce28fac4

SHA1
4e490d7ec139a6cde53e3932d3122a48aa379904

SHA256
2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237

SHA512
e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a

Download Submit
C:\Windows\Installer\MSI4C40.tmp

Filesize
127KB

MD5
93394d2866590fb66759f5f0263453f2

SHA1
2f0903d4b21a0231add1b4cd02e25c7c4974da84

SHA256
5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

SHA512
f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

Download Submit
C:\Windows\Installer\MSI4D5A.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI4EB4.tmp-\System.Buffers.dll

Filesize
27KB

MD5
8174d97f8ee460b4c965be8f9f01a83e

SHA1
e445779d1c5b9a1edb3fc732c7bd57c8f16db69f

SHA256
9d3af29e14d26fde4da4c1ddcbcaee2e6b120115e21f364907c6f69b8ed09a25

SHA512
346acc32c2fd860901d69b48dc809c5730375d7cdeb1978ca8cbe98fb6a4065c607c47563ff6564f6ffd9606b2d4240c1763746bdd90e6e8e934887933135889

Download Submit
C:\Windows\Temp\{1980D465-880A-40E2-BE74-FE877F328F68}\.cr\setup.exe

Filesize
7.0MB

MD5
29467fd9be93c4ac0ba9d863ae30edf9

SHA1
f19cb3f6da9dd998e0bfb7183d13ca9b592c7899

SHA256
edb674894994d5cac133abec9e5e2ece8560dc8bcc70a3bf94d341c87a15e8e2

SHA512
164afba38bddd8411800886df66599db53ee979d4320bd9b986f716f7c287588ea63f8fd01027c838b50aca22fc10b60b42cbfc66dd53465f741a90ff162458c

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\AdGuard.CrashReporter.dll

Filesize
476KB

MD5
d8cdfe259c09b2de638ef4a5bf2d4dce

SHA1
c06074a1965c2c773e92f85418dceb2c5fdfeaf0

SHA256
5bc6335bc9649af916a82965e3b55c1b693c216b4fa4d76740f2db4616e82cd5

SHA512
752e99adf65bc926f2c1ae47ecadf271f788d46ceab47c525fd8ec97a9388fe8f38564c63896a8d61aaba5652f37703cd234f463bef58781466aaa2b0ac0b079

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\AdGuard.Utils.Base.dll

Filesize
886KB

MD5
7df624f2ab3dbe6c5fbca91f6ea59430

SHA1
702a5c61afb3d56c89513e08244359a1b7f4f6e7

SHA256
b43544bf5e511b4049289ce847f7710de6b5eefb2cf7956ce452ffe53ca0ba7f

SHA512
ee38023bdb887d8be5b18167280126809c3c9230d630c4cdae8e650aecf8fde2b6a1df234fcd5d6ce2eede09b504137669c8e0ea06c6aa454a10d6073a3a6558

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\AdGuard.Utils.Installer.dll

Filesize
55KB

MD5
abd2f4a5cfa8a9608fb14e3fbf44871f

SHA1
b5249f54a6a73c27bcbbdc07fb6c86d9745be35f

SHA256
06c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5

SHA512
7dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\AdGuard.Utils.UI.dll

Filesize
621KB

MD5
ec3d9350a9a400fb3271c7327f5bf5a8

SHA1
0eea26f71e7d03579303b9ffc34549fa7ac843e9

SHA256
aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4

SHA512
a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\AdGuard.Utils.dll

Filesize
1.8MB

MD5
5078eddd8dc8d0d328d7eeceb459929b

SHA1
60f4a74dbc5f4af10526198a5a43e09f84b54c98

SHA256
c63ce2079d0ee96ba13cbba30b6cf4c7ef42720815e82d8eac2526adbf881f40

SHA512
b09b7fbdcc899bfe27f76080d95b3882875a5f53faec52c97418554e38373327088b750581c85fb6d66d19d3c1cccff6f313fcf73519b48d6b32f260a7f3a84c

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\AdGuardVpn.Burn.dll

Filesize
255KB

MD5
dee30f3e6ba778c751f2f60fb4670478

SHA1
498124da412a7a4d8bb6b78228f800b583262100

SHA256
44c456f809e765a91c4527b55591301eaf74260d92fdd786f3e4053b700b2864

SHA512
f8f3928aace5e6fb593966ac6d2ed113598c37a0b767cbe4eda7d9f53e3e612bcf4642ffe3bf1432fd564716c1f4a02f72d8e6d0279d6262593b1f9fdca19a04

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\BootstrapperCore.config

Filesize
1KB

MD5
427918825375ce8aa01f208629c901fa

SHA1
bb983d3b30454deb48695e495b8483195d72c927

SHA256
eee85d8d43e427f87e043f9516bc2511c891980a134eba7e2d6097438ef860e4

SHA512
1368fb726b21d96278773e37ff36b20952578c814f7e4d3ef76cc81a5b2d608f04e65c1e6328f19aa59f40dd2701d6f5afa167cde14143d385cd075a8359b4cf

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\BootstrapperCore.dll

Filesize
87KB

MD5
b0d10a2a622a322788780e7a3cbb85f3

SHA1
04d90b16fa7b47a545c1133d5c0ca9e490f54633

SHA256
f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

SHA512
62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\Newtonsoft.Json.dll

Filesize
647KB

MD5
5afda7c7d4f7085e744c2e7599279db3

SHA1
3a833eb7c6be203f16799d7b7ccd8b8c9d439261

SHA256
f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

SHA512
7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\SharpRaven.dll

Filesize
114KB

MD5
89a2762f19597b82d5c501366e5b2f29

SHA1
f5df7962015164e4bfed0ae361f988c1e581677e

SHA256
a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167

SHA512
bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\.ba\mbahost.dll

Filesize
119KB

MD5
c59832217903ce88793a6c40888e3cae

SHA1
6d9facabf41dcf53281897764d467696780623b8

SHA256
9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

SHA512
1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

Download Submit
C:\Windows\Temp\{931F93B4-3993-4306-82F8-66F8A410B5B1}\Main

Filesize
26.0MB

MD5
2aa797ca84648d5d758a5ffd2abb85b6

SHA1
690b3e5313df89c6b455275efa1a2c02a2006b61

SHA256
6912c25dd7cdd7109996d75f789fee679e7cfa7f1065cbaaba28a76926a30d2a

SHA512
a43a81c4a2581671bcdcbb30171221cec596e82adf33c7218ca029c623b0747cf89d4c1e86b667c3eefb3885dea6038407d1e7aa5c30d6db16b2fb4fecd907ee

Download Submit
memory/512-502-0x0000000004E10000-0x0000000004E32000-memory.dmp

Filesize
136KB

Download
memory/1052-1009-0x0000000005540000-0x000000000555E000-memory.dmp

Filesize
120KB

Download
memory/1052-1007-0x00000000051A0000-0x0000000005216000-memory.dmp

Filesize
472KB

Download
memory/2072-244-0x0000000007E50000-0x00000000081A4000-memory.dmp

Filesize
3.3MB

Download
memory/2072-228-0x0000000007480000-0x00000000074FA000-memory.dmp

Filesize
488KB

Download
memory/2072-251-0x000000000C740000-0x000000000C778000-memory.dmp

Filesize
224KB

Download
memory/2072-250-0x000000000CDC0000-0x000000000CDC8000-memory.dmp

Filesize
32KB

Download
memory/2072-249-0x000000000CE00000-0x000000000CE40000-memory.dmp

Filesize
256KB

Download
memory/2072-248-0x000000000C270000-0x000000000C278000-memory.dmp

Filesize
32KB

Download
memory/2072-243-0x0000000007920000-0x0000000007942000-memory.dmp

Filesize
136KB

Download
memory/2072-240-0x0000000007DA0000-0x0000000007E48000-memory.dmp

Filesize
672KB

Download
memory/2072-234-0x0000000007420000-0x000000000743E000-memory.dmp

Filesize
120KB

Download
memory/2072-197-0x0000000003760000-0x0000000003778000-memory.dmp

Filesize
96KB

Download
memory/2072-204-0x0000000006D30000-0x0000000006D76000-memory.dmp

Filesize
280KB

Download
memory/2072-208-0x0000000003800000-0x0000000003812000-memory.dmp

Filesize
72KB

Download
memory/2072-212-0x0000000006F70000-0x0000000007052000-memory.dmp

Filesize
904KB

Download
memory/2072-218-0x0000000007580000-0x0000000007748000-memory.dmp

Filesize
1.8MB

Download
memory/2072-252-0x000000000C710000-0x000000000C71E000-memory.dmp

Filesize
56KB

Download
memory/2072-223-0x0000000007340000-0x00000000073DE000-memory.dmp

Filesize
632KB

Download
memory/2416-821-0x0000000004F00000-0x0000000004F64000-memory.dmp

Filesize
400KB

Download
memory/2416-834-0x00000000053D0000-0x00000000053DA000-memory.dmp

Filesize
40KB

Download
memory/2416-818-0x0000000005010000-0x0000000005188000-memory.dmp

Filesize
1.5MB

Download
memory/2416-829-0x0000000005630000-0x0000000005698000-memory.dmp

Filesize
416KB

Download
memory/2416-833-0x00000000055C0000-0x00000000055E6000-memory.dmp

Filesize
152KB

Download
memory/2416-837-0x0000000005570000-0x0000000005578000-memory.dmp

Filesize
32KB

Download
memory/2416-836-0x00000000053F0000-0x00000000053F8000-memory.dmp

Filesize
32KB

Download
memory/2624-88-0x0000000000530000-0x0000000000550000-memory.dmp

Filesize
128KB

Download
memory/3136-1500-0x0000000000100000-0x0000000000120000-memory.dmp

Filesize
128KB

Download
memory/3204-1640-0x000000000E820000-0x000000000E828000-memory.dmp

Filesize
32KB

Download
memory/3204-1496-0x0000000000D30000-0x0000000000E48000-memory.dmp

Filesize
1.1MB

Download
memory/3204-1615-0x0000000006920000-0x0000000006EB6000-memory.dmp

Filesize
5.6MB

Download
memory/3204-1628-0x00000000083A0000-0x0000000008402000-memory.dmp

Filesize
392KB

Download
memory/3204-1634-0x0000000008600000-0x0000000008608000-memory.dmp

Filesize
32KB

Download
memory/3204-1639-0x00000000095E0000-0x00000000095EA000-memory.dmp

Filesize
40KB

Download
memory/3204-1756-0x0000000014830000-0x0000000014838000-memory.dmp

Filesize
32KB

Download
memory/3344-323-0x0000000000100000-0x0000000000120000-memory.dmp

Filesize
128KB

Download
memory/4720-847-0x0000000006350000-0x00000000063FA000-memory.dmp

Filesize
680KB

Download
memory/4720-853-0x00000000069E0000-0x0000000006A5C000-memory.dmp

Filesize
496KB

Download
memory/4720-839-0x0000000000CB0000-0x0000000000D32000-memory.dmp

Filesize
520KB

Download
memory/4720-840-0x0000000004700000-0x000000000486A000-memory.dmp

Filesize
1.4MB

Download
memory/4720-861-0x00000000073F0000-0x0000000007411000-memory.dmp

Filesize
132KB

Download
memory/4720-860-0x00000000074A0000-0x00000000074DC000-memory.dmp

Filesize
240KB

Download
memory/4720-859-0x0000000007500000-0x0000000007592000-memory.dmp

Filesize
584KB

Download
memory/4720-858-0x0000000008EE0000-0x00000000094F8000-memory.dmp

Filesize
6.1MB

Download
memory/4720-1361-0x0000000009DB0000-0x0000000009DC2000-memory.dmp

Filesize
72KB

Download
memory/4720-1363-0x0000000009E10000-0x0000000009E4C000-memory.dmp

Filesize
240KB

Download
memory/4720-1367-0x0000000009FF0000-0x000000000A0FA000-memory.dmp

Filesize
1.0MB

Download
memory/4720-857-0x0000000007810000-0x0000000007BEA000-memory.dmp

Filesize
3.9MB

Download
memory/4720-856-0x0000000006CC0000-0x0000000006D0C000-memory.dmp

Filesize
304KB

Download
memory/4720-855-0x00000000072A0000-0x00000000072FA000-memory.dmp

Filesize
360KB

Download
memory/4720-854-0x0000000006A60000-0x0000000006ADA000-memory.dmp

Filesize
488KB

Download
memory/4720-930-0x000000006C9B0000-0x000000006C9C0000-memory.dmp

Filesize
64KB

Download
memory/4720-852-0x0000000006B40000-0x0000000006C98000-memory.dmp

Filesize
1.3MB

Download
memory/4720-851-0x00000000068B0000-0x00000000069DA000-memory.dmp

Filesize
1.2MB

Download
memory/4720-850-0x0000000005B70000-0x0000000005BCE000-memory.dmp

Filesize
376KB

Download
memory/4720-849-0x0000000006700000-0x000000000677C000-memory.dmp

Filesize
496KB

Download
memory/4720-848-0x0000000004700000-0x000000000486A000-memory.dmp

Filesize
1.4MB

Download
memory/4720-846-0x0000000005DB0000-0x0000000006346000-memory.dmp

Filesize
5.6MB

Download
memory/4720-845-0x0000000004CB0000-0x0000000004D60000-memory.dmp

Filesize
704KB

Download
memory/4720-844-0x00000000044B0000-0x0000000004678000-memory.dmp

Filesize
1.8MB

Download
memory/4720-843-0x0000000004E40000-0x0000000004FC6000-memory.dmp

Filesize
1.5MB

Download
memory/4720-842-0x0000000005260000-0x0000000005804000-memory.dmp

Filesize
5.6MB

Download
memory/4720-841-0x00000000043E0000-0x000000000447C000-memory.dmp

Filesize
624KB

Download
memory/5084-314-0x0000000004F80000-0x0000000004FE0000-memory.dmp

Filesize
384KB

Download
memory/5084-310-0x0000000004EF0000-0x0000000004F1E000-memory.dmp

Filesize
184KB

Download