e7454bca3e22c5377dac562ed436adbd2ec11c09d04cc96697c9a48c39897375

Analysis

max time kernel
259s
max time network
263s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03-07-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adguardInstaller.exe
Size

142KB
MD5

07bb8ad867d95a4861c8955318345f1e
SHA1

3a099b064ea860743676ed795c9289d74f2fec4b
SHA256

e7454bca3e22c5377dac562ed436adbd2ec11c09d04cc96697c9a48c39897375
SHA512

7a8fddd909807a5689b6ae1de0050b5d16421048d6a04bf050abb2d3cbaa52a850cbb02eacdc0541ef5c1205bc546465ae6297679352b1421c810e5de8b006fa
SSDEEP

3072:c4qZHnMyBV3vAhLFvGyfmKvK9MkBrE8wp8:c4qZHdV3vovK9Mkhip8

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\adgnetworkwfpdrv.sys	AdguardSvc.exe
File opened for modification	C:\Windows\system32\drivers\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Windows\system32\Drivers\vwifikerneldrv.sys	AdguardSvc.exe
File opened for modification	C:\Windows\system32\Drivers\vwifikerneldrv.sys	AdguardSvc.exe

Manipulates Digital Signatures 1 TTPs 12 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	AdguardSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	AdguardSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	AdguardSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	AdguardSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainUrlRetrievalTimeoutMilliseconds = "200"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds = "500"	rundll32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{20c8adf9-c3e4-4951-a042-94b7c98126b2} = "\"C:\\ProgramData\\Package Cache\\{20c8adf9-c3e4-4951-a042-94b7c98126b2}\\adgSetup.exe\" /burn.runonce"	adgSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adguard = "\"C:\\Program Files\\AdGuard\\Adguard.exe\" /nosplash"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adguard = "\"C:\\Program Files\\AdGuard\\Adguard.exe\" /nosplash"	AdguardSvc.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
20	3920	msiexec.exe
22	3920	msiexec.exe
24	3920	msiexec.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,15063,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\d3dx9_11.dll.tmp	AdguardSvc.exe
File created	C:\Windows\system32\prfc0003.dat.tmp	AdguardSvc.exe
File opened for modification	C:\Windows\system32\prfc0003.dat.tmp	AdguardSvc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Adguard.Tools.exe.log	Adguard.Tools.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Adguard.BrowserExtensionHost.exe.log	Adguard.BrowserExtensionHost.exe
File created	C:\Windows\system32\d3dx9_11.dll.tmp	AdguardSvc.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.de.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.no.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\nssutil3.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.zh-TW.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.fa.dll	msiexec.exe
File created	C:\Program Files\AdGuard\x86\AdguardCoreTools.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdguardSvc.exe.config	msiexec.exe
File created	C:\Program Files\AdGuard\nss\nssckbi.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.pt-PT.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.ko.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.hr.dll	msiexec.exe
File created	C:\Program Files\AdGuard\x64\AdguardCore.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdguardSvc.exe	msiexec.exe
File created	C:\Program Files\AdGuard\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\default.adg	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.bg.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.he.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Drivers\x86\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.ko.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Adguard.exe	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.ru.dll	msiexec.exe
File created	C:\Program Files\AdGuard\logo.png	msiexec.exe
File created	C:\Program Files\AdGuard\x64\AdguardDns.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\libplc4.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Drivers\arm64\AdguardNetReg.exe	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.be.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdGuard.Utils.UI.PlatformDependent.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.pl.dll	msiexec.exe
File created	C:\Program Files\AdGuard\x86\AdguardCore.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.it.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.ru.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.id.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Arm\AdguardCoreTools.dll	msiexec.exe
File created	C:\Program Files\AdGuard\libs\inststlib64.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\libnspr4.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\Adguard.Network.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.fr.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdGuard.Utils.Base.dll	msiexec.exe
File created	C:\Program Files\AdGuard\x86\SQLite.Interop.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.it.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\Adguard.UI.resources.zh.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Adguard.Tools.exe	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.fa.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.sv.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdGuard.Utils.UI.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\libplds4.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\arm\AdguardNetLib.dll	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.fr.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Adguard.Global.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.ru.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.sk.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.vi.dll	msiexec.exe
File created	C:\Program Files\AdGuard\nss\freebl3.dll	msiexec.exe
File created	C:\Program Files\AdGuard\Wizard.wmv	msiexec.exe
File created	C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.CrashReporter.resources.mk.dll	msiexec.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.el.dll	msiexec.exe
File opened for modification	C:\Program Files\AdGuard\Drivers\x86\AdguardNetLib.dll	AdguardSvc.exe
File created	C:\Program Files\AdGuard\langs\AdGuard.Updater.resources.bg.dll	msiexec.exe
File created	C:\Program Files\AdGuard\AdGuard.Updater.dll	msiexec.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57e493.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF9B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Uninstall.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFEA.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFFEA.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF8AD.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFFEA.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFFEA.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1622.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIED9D.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF8AD.tmp-\Adguard.CustomActions.dll	rundll32.exe
File created	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\Uninstall.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1622.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF8AD.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFE22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFEA.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1622.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF649.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF649.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF649.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF649.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1622.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1622.tmp-\warning.ico	rundll32.exe
File created	C:\Windows\Installer\e57e493.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED9D.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF649.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\wix{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI1622.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIED9D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8AD.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\Adguard.CustomActions.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF2D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1622.tmp-\Adguard.CustomActions.dll	rundll32.exe
File created	C:\Windows\WinSxS\poqexecv2sys.log	AdguardSvc.exe
File opened for modification	C:\Windows\Installer\MSIED9D.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF649.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF96A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIED9D.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF649.tmp-\Adguard.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF734.tmp	msiexec.exe
File created	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8AD.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFFEA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED9D.tmp-\warning.ico	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF8AD.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF9D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD65.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e497.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFEA.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIED9D.tmp-\AdGuard.Utils.Base.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF89C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe	msiexec.exe

Executes dropped EXE 16 IoCs

pid	Process
4844	setup.exe
3568	setup.exe
1000	adgSetup.exe
1880	AdguardSvc.exe
4308	Adguard.BrowserExtensionHost.exe
2992	Adguard.exe
2444	Adguard.Tools.exe
316	Adguard.exe
1068	AdguardNetReg.exe
4900	AdguardNetReg.exe
3076	AdguardNetReg.exe
2428	Adguard.exe
6064	Adguard.exe
6024	Adguard.exe
5480	Adguard.exe
5408	Adguard.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
224	sc.exe
2332	sc.exe
4916	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
3568	setup.exe
876	MsiExec.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
876	MsiExec.exe
3668	rundll32.exe
3668	rundll32.exe
3668	rundll32.exe
876	MsiExec.exe
3076	rundll32.exe
3076	rundll32.exe
3076	rundll32.exe
1652	MsiExec.exe
876	MsiExec.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
1652	MsiExec.exe
1652	MsiExec.exe
1652	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
1652	MsiExec.exe
876	MsiExec.exe
4288	rundll32.exe
4288	rundll32.exe
4288	rundll32.exe
1880	AdguardSvc.exe
1880	AdguardSvc.exe
1880	AdguardSvc.exe
1880	AdguardSvc.exe
1880	AdguardSvc.exe
1880	AdguardSvc.exe
1880	AdguardSvc.exe
876	MsiExec.exe
3112	rundll32.exe
3112	rundll32.exe
3112	rundll32.exe
4308	Adguard.BrowserExtensionHost.exe
4308	Adguard.BrowserExtensionHost.exe
2992	Adguard.exe
2992	Adguard.exe
1880	AdguardSvc.exe
1880	AdguardSvc.exe
316	Adguard.exe
316	Adguard.exe
1068	AdguardNetReg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
200	ipconfig.exe
4316	ipconfig.exe
1792	ipconfig.exe
4608	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AdguardSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AdguardSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	AdguardSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall"	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AdguardSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Adguard.BrowserExtensionHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	AdguardSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	AdguardSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	AdguardSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Adguard.Tools.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\Content Type = "message/rfc822"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-910"	ie4uinit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-903"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-53504"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\command	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0E5674DA1C957254AA41A33512538F4C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-10046"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-913"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{20c8adf9-c3e4-4951-a042-94b7c98126b2}\Version = "7.17.4712.0"	adgSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdns\DefaultIcon	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-32554"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.partial\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\ = "&Open"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\ = "Open in S&ame Window"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{20c8adf9-c3e4-4951-a042-94b7c98126b2}\Dependents\{20c8adf9-c3e4-4951-a042-94b7c98126b2}	adgSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\10DCDC8AF56B96143A9A1FE3BE3AE13D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\DefaultIcon	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\open	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rlogin	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\ = "URL:MailTo Protocol"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\ = "mhtmlfile"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\print\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\mshtml.dll\",PrintHTML \"%1\""	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdns\URL Protocol	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adguard\DefaultIcon	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.website	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\ContextMenuHandlers\{FBF23B40-E3F0-101B-8488-00AA003E56F8}	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shell\open\command	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394\DisplayName = "windows_ie_ac_001"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\PackageCode = "81390FD5AA7B90441B6F2D3DBE670828"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\ = "URL:File Transfer Protocol"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\ = "htmlfile"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\printto\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\mshtml.dll\",PrintHTML \"%1\" \"%2\" \"%3\" \"%4\""	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,5"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\ = "xhtmlfile"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\10DCDC8AF56B96143A9A1FE3BE3AE13D\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adguard\shell\open	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht\OpenWithProgIds	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	ie4uinit.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	AdguardSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdguardSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AdguardSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	AdguardSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	AdguardSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	AdguardSvc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
640	Process not Found
640	Process not Found
640	Process not Found
640	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3568	setup.exe
Token: SeShutdownPrivilege	1000	adgSetup.exe
Token: SeIncreaseQuotaPrivilege	1000	adgSetup.exe
Token: SeSecurityPrivilege	3920	msiexec.exe
Token: SeCreateTokenPrivilege	1000	adgSetup.exe
Token: SeAssignPrimaryTokenPrivilege	1000	adgSetup.exe
Token: SeLockMemoryPrivilege	1000	adgSetup.exe
Token: SeIncreaseQuotaPrivilege	1000	adgSetup.exe
Token: SeMachineAccountPrivilege	1000	adgSetup.exe
Token: SeTcbPrivilege	1000	adgSetup.exe
Token: SeSecurityPrivilege	1000	adgSetup.exe
Token: SeTakeOwnershipPrivilege	1000	adgSetup.exe
Token: SeLoadDriverPrivilege	1000	adgSetup.exe
Token: SeSystemProfilePrivilege	1000	adgSetup.exe
Token: SeSystemtimePrivilege	1000	adgSetup.exe
Token: SeProfSingleProcessPrivilege	1000	adgSetup.exe
Token: SeIncBasePriorityPrivilege	1000	adgSetup.exe
Token: SeCreatePagefilePrivilege	1000	adgSetup.exe
Token: SeCreatePermanentPrivilege	1000	adgSetup.exe
Token: SeBackupPrivilege	1000	adgSetup.exe
Token: SeRestorePrivilege	1000	adgSetup.exe
Token: SeShutdownPrivilege	1000	adgSetup.exe
Token: SeDebugPrivilege	1000	adgSetup.exe
Token: SeAuditPrivilege	1000	adgSetup.exe
Token: SeSystemEnvironmentPrivilege	1000	adgSetup.exe
Token: SeChangeNotifyPrivilege	1000	adgSetup.exe
Token: SeRemoteShutdownPrivilege	1000	adgSetup.exe
Token: SeUndockPrivilege	1000	adgSetup.exe
Token: SeSyncAgentPrivilege	1000	adgSetup.exe
Token: SeEnableDelegationPrivilege	1000	adgSetup.exe
Token: SeManageVolumePrivilege	1000	adgSetup.exe
Token: SeImpersonatePrivilege	1000	adgSetup.exe
Token: SeCreateGlobalPrivilege	1000	adgSetup.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeDebugPrivilege	2276	rundll32.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeDebugPrivilege	3668	rundll32.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeDebugPrivilege	3980	rundll32.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeShutdownPrivilege	3724	MsiExec.exe
Token: SeRestorePrivilege	3920	msiexec.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
348	firefox.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
348	firefox.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
348	firefox.exe
348	firefox.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe
2992	Adguard.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
348	firefox.exe
348	firefox.exe
348	firefox.exe
348	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4844	4440	adguardInstaller.exe	73
PID 4440 wrote to memory of 4844	4440	adguardInstaller.exe	73
PID 4440 wrote to memory of 4844	4440	adguardInstaller.exe	73
PID 4844 wrote to memory of 3568	4844	setup.exe	74
PID 4844 wrote to memory of 3568	4844	setup.exe	74
PID 4844 wrote to memory of 3568	4844	setup.exe	74
PID 3568 wrote to memory of 1000	3568	setup.exe	75
PID 3568 wrote to memory of 1000	3568	setup.exe	75
PID 3568 wrote to memory of 1000	3568	setup.exe	75
PID 3920 wrote to memory of 876	3920	msiexec.exe	78
PID 3920 wrote to memory of 876	3920	msiexec.exe	78
PID 876 wrote to memory of 2276	876	MsiExec.exe	79
PID 876 wrote to memory of 2276	876	MsiExec.exe	79
PID 876 wrote to memory of 3668	876	MsiExec.exe	83
PID 876 wrote to memory of 3668	876	MsiExec.exe	83
PID 876 wrote to memory of 3076	876	MsiExec.exe	84
PID 876 wrote to memory of 3076	876	MsiExec.exe	84
PID 3920 wrote to memory of 1652	3920	msiexec.exe	85
PID 3920 wrote to memory of 1652	3920	msiexec.exe	85
PID 3920 wrote to memory of 1652	3920	msiexec.exe	85
PID 876 wrote to memory of 3980	876	MsiExec.exe	86
PID 876 wrote to memory of 3980	876	MsiExec.exe	86
PID 3920 wrote to memory of 3724	3920	msiexec.exe	87
PID 3920 wrote to memory of 3724	3920	msiexec.exe	87
PID 3920 wrote to memory of 3724	3920	msiexec.exe	87
PID 876 wrote to memory of 4288	876	MsiExec.exe	88
PID 876 wrote to memory of 4288	876	MsiExec.exe	88
PID 4288 wrote to memory of 524	4288	rundll32.exe	90
PID 4288 wrote to memory of 524	4288	rundll32.exe	90
PID 4288 wrote to memory of 1584	4288	rundll32.exe	91
PID 4288 wrote to memory of 1584	4288	rundll32.exe	91
PID 1584 wrote to memory of 3928	1584	cmd.exe	93
PID 1584 wrote to memory of 3928	1584	cmd.exe	93
PID 3928 wrote to memory of 4068	3928	net.exe	94
PID 3928 wrote to memory of 4068	3928	net.exe	94
PID 876 wrote to memory of 3112	876	MsiExec.exe	97
PID 876 wrote to memory of 3112	876	MsiExec.exe	97
PID 3568 wrote to memory of 2332	3568	setup.exe	98
PID 3568 wrote to memory of 2332	3568	setup.exe	98
PID 3568 wrote to memory of 2332	3568	setup.exe	98
PID 1880 wrote to memory of 4308	1880	AdguardSvc.exe	100
PID 1880 wrote to memory of 4308	1880	AdguardSvc.exe	100
PID 1880 wrote to memory of 4916	1880	AdguardSvc.exe	104
PID 1880 wrote to memory of 4916	1880	AdguardSvc.exe	104
PID 1880 wrote to memory of 224	1880	AdguardSvc.exe	106
PID 1880 wrote to memory of 224	1880	AdguardSvc.exe	106
PID 1880 wrote to memory of 2444	1880	AdguardSvc.exe	108
PID 1880 wrote to memory of 2444	1880	AdguardSvc.exe	108
PID 1880 wrote to memory of 4136	1880	AdguardSvc.exe	109
PID 1880 wrote to memory of 4136	1880	AdguardSvc.exe	109
PID 4136 wrote to memory of 1796	4136	cmd.exe	111
PID 4136 wrote to memory of 1796	4136	cmd.exe	111
PID 1880 wrote to memory of 4584	1880	AdguardSvc.exe	113
PID 1880 wrote to memory of 4584	1880	AdguardSvc.exe	113
PID 4584 wrote to memory of 4316	4584	cmd.exe	115
PID 4584 wrote to memory of 4316	4584	cmd.exe	115
PID 1880 wrote to memory of 1068	1880	AdguardSvc.exe	116
PID 1880 wrote to memory of 1068	1880	AdguardSvc.exe	116
PID 1880 wrote to memory of 3048	1880	AdguardSvc.exe	117
PID 1880 wrote to memory of 3048	1880	AdguardSvc.exe	117
PID 3048 wrote to memory of 1792	3048	cmd.exe	119
PID 3048 wrote to memory of 1792	3048	cmd.exe	119
PID 1880 wrote to memory of 3384	1880	AdguardSvc.exe	120
PID 1880 wrote to memory of 3384	1880	AdguardSvc.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
  C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe AID=18675_page_es_welcome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\Temp\{45BB09B6-D2D3-4F05-A943-F66CAEE66EB6}\.cr\setup.exe
    "C:\Windows\Temp\{45BB09B6-D2D3-4F05-A943-F66CAEE66EB6}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=660 -burn.filehandle.self=668 AID=18675_page_es_welcome
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.be\adgSetup.exe
      "C:\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.be\adgSetup.exe" -q -burn.elevated BurnPipe.{2F4884BB-DFE7-4252-801C-CF1903D5D904} {9284B163-A245-43DE-9D0C-75D146FFC9DD} 3568
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:1000
  - - C:\Windows\SysWOW64\sc.exe
      "sc" query adgnetworktdidrv
      4⤵
      Launches sc.exe
      PID:2332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 404BBFCFA18F06587087166DE831DF56
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE8D9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642390 2 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstall
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIED9D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240643500 14 Adguard.CustomActions!Adguard.CustomActions.CustomActions.PermanentActions
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3668
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF649.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240645765 33 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallInitialize
    3⤵
    - Manipulates Digital Signatures
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:3076
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF8AD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646328 59 Adguard.CustomActions!Adguard.CustomActions.CustomActions.CheckServiceStop
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFFEA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648234 101 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallFinalize
    3⤵
    - Manipulates Digital Signatures
    - Adds Run key to start application
    - Drops file in Windows directory
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\system32\ie4uinit.exe
      "ie4uinit.exe" -show
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Modifies Internet Explorer settings
      Modifies registry class
      PID:524
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /C "net start "Adguard Service""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\system32\net.exe
        
        net start "Adguard Service"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3928
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start "Adguard Service"
        6⤵
        
        PID:4068
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1622.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653843 141 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstallOrMajorUpgradeFinalize
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:3112
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 126A061613058E2502A3B25A16A6F24E
  2⤵
  - Loads dropped DLL
  PID:1652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9C4B567D92A083615FE1D2DC0C642E00 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3724

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4584

C:\Program Files\AdGuard\AdguardSvc.exe
"C:\Program Files\AdGuard\AdguardSvc.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files\AdGuard\Adguard.BrowserExtensionHost.exe
  "Adguard.BrowserExtensionHost.exe" /register
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:4308
- C:\Windows\SYSTEM32\sc.exe
  "sc" sdshow "Adguard Service"
  2⤵
  - Launches sc.exe
  PID:4916
- C:\Windows\SYSTEM32\sc.exe
  "sc" sdset "Adguard Service" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCRPLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  PID:224
- C:\Program Files\AdGuard\Adguard.Tools.exe
  "C:\Program Files\AdGuard\Adguard.Tools.exe" /clean_runouce
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "schtasks /delete /tn a65889988e8047a9aff242d4531b1ba5 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn a65889988e8047a9aff242d4531b1ba5 /f
    3⤵
    PID:1796
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4316
- C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
  "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1068
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:1792
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:3384
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4608
- C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
  "Drivers\x64\AdguardNetReg.exe" -u adgnetworkwfpdrv
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe
  "Drivers\x64\AdguardNetReg.exe" adgnetworkwfpdrv
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "ipconfig /flushdns"
  2⤵
  PID:2220
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:200

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2992

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.0.879563362\1930484125" -parentBuildID 20221007134813 -prefsHandle 1708 -prefMapHandle 1700 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa23c559-444a-4f04-a0ac-eca89d7a8508} 348 "\\.\pipe\gecko-crash-server-pipe.348" 1796 271102d5458 gpu
    3⤵
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.1.1172035894\1566607916" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c503ab4d-8aae-4247-b129-28dfa419ce07} 348 "\\.\pipe\gecko-crash-server-pipe.348" 2152 2710526cb58 socket
    3⤵
    PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.2.287377665\906791570" -childID 1 -isForBrowser -prefsHandle 2752 -prefMapHandle 2884 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8bd0a74-cce5-4613-922d-26a64b0cb6d6} 348 "\\.\pipe\gecko-crash-server-pipe.348" 2892 2711459b758 tab
    3⤵
    PID:3748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.3.2037444104\1990613466" -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 3636 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d181448f-b95a-4e78-aead-b3c54ef64dce} 348 "\\.\pipe\gecko-crash-server-pipe.348" 3652 27115523958 tab
    3⤵
    PID:3076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.4.1019299718\2036376661" -childID 3 -isForBrowser -prefsHandle 4316 -prefMapHandle 3640 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4856b53-a1db-488c-8205-29f02feaa3b0} 348 "\\.\pipe\gecko-crash-server-pipe.348" 4328 271164ba158 tab
    3⤵
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.5.227866534\1509893165" -childID 4 -isForBrowser -prefsHandle 4924 -prefMapHandle 4900 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a5173f3-41e5-49cd-92c0-7d90061e9b61} 348 "\\.\pipe\gecko-crash-server-pipe.348" 4892 27112964858 tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.6.681084586\1445121925" -childID 5 -isForBrowser -prefsHandle 5048 -prefMapHandle 5052 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf1bf943-c044-47ef-a1c7-51f58589c691} 348 "\\.\pipe\gecko-crash-server-pipe.348" 4876 27116c03558 tab
    3⤵
    PID:876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.7.2139853339\1987325404" -childID 6 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {404836f5-edc2-4e97-94ad-1929bebf9e65} 348 "\\.\pipe\gecko-crash-server-pipe.348" 5240 27116cc4f58 tab
    3⤵
    PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.8.2000780168\1160935775" -childID 7 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6168b9f5-a595-4184-8793-e3f489228196} 348 "\\.\pipe\gecko-crash-server-pipe.348" 5672 2711800be58 tab
    3⤵
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.9.1613235317\1106799562" -childID 8 -isForBrowser -prefsHandle 4940 -prefMapHandle 4952 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca9c5afd-5db7-480c-8c22-c1c115d219f7} 348 "\\.\pipe\gecko-crash-server-pipe.348" 4924 27118c24458 tab
    3⤵
    PID:5032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.10.832747222\1460524140" -parentBuildID 20221007134813 -prefsHandle 5036 -prefMapHandle 5928 -prefsLen 26689 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f634c04-1390-40f3-8f75-d11e25f32752} 348 "\\.\pipe\gecko-crash-server-pipe.348" 5976 27118df7758 rdd
    3⤵
    PID:6104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.11.489594827\637236329" -childID 9 -isForBrowser -prefsHandle 9916 -prefMapHandle 9920 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {250d209d-e92f-419c-bdad-eeb25885c280} 348 "\\.\pipe\gecko-crash-server-pipe.348" 9912 27119051b58 tab
    3⤵
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.12.1843695830\2025487602" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9928 -prefMapHandle 9904 -prefsLen 26689 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1596953c-3566-4510-94b7-ee03a209668d} 348 "\\.\pipe\gecko-crash-server-pipe.348" 9796 27118f19e58 utility
    3⤵
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.13.284253069\1589566884" -childID 10 -isForBrowser -prefsHandle 9512 -prefMapHandle 9548 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8bb65e3-38a2-405a-b7e6-e7da8855a905} 348 "\\.\pipe\gecko-crash-server-pipe.348" 5420 27112d32058 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.14.1598683074\1598970949" -childID 11 -isForBrowser -prefsHandle 9704 -prefMapHandle 9792 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ca9705e-e8d2-4735-a5a4-528c01e01f84} 348 "\\.\pipe\gecko-crash-server-pipe.348" 9900 271193a9d58 tab
    3⤵
    PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.15.1055623013\1070506195" -childID 12 -isForBrowser -prefsHandle 9348 -prefMapHandle 9344 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e0966a3-6d08-4794-9e95-bab4975365be} 348 "\\.\pipe\gecko-crash-server-pipe.348" 9780 27112df7658 tab
    3⤵
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.16.513488952\1885168560" -childID 13 -isForBrowser -prefsHandle 5732 -prefMapHandle 9952 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7acf7d19-8887-4d36-a498-1aa1ea6478dd} 348 "\\.\pipe\gecko-crash-server-pipe.348" 9804 27112d32058 tab
    3⤵
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.17.1035231047\851201501" -childID 14 -isForBrowser -prefsHandle 9092 -prefMapHandle 9088 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27241d51-0b82-47d5-b55b-b42f31e740f3} 348 "\\.\pipe\gecko-crash-server-pipe.348" 9100 27112d32958 tab
    3⤵
    PID:836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="348.18.788157638\664595711" -childID 15 -isForBrowser -prefsHandle 8852 -prefMapHandle 8848 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9318d77-d6cf-41a6-9b08-a5d028a7009d} 348 "\\.\pipe\gecko-crash-server-pipe.348" 8860 27115dc2b58 tab
    3⤵
    PID:3592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc
1⤵
PID:2112

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe"
1⤵
- Executes dropped EXE
PID:2428

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe"
1⤵
- Executes dropped EXE
PID:6064

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe"
1⤵
- Executes dropped EXE
PID:6024

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe"
1⤵
- Executes dropped EXE
PID:5480

C:\Program Files\AdGuard\Adguard.exe
"C:\Program Files\AdGuard\Adguard.exe"
1⤵
- Executes dropped EXE
PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57e496.rbs

Filesize
358KB

MD5
3cdfb5ba0cb83e64d5d7581bca92b505

SHA1
fac3e4aeb58389509fcb4b8165db3be11f9a3d9a

SHA256
b81681fd5c27b23e5c4acba3041d3e1164f33759c5e98626bdfcf2b76696b33d

SHA512
27bf69b096f2a78fc6036e5a3f6ad06c1115d650338a7bbdf700a3346ea8d24678adb8c91c980a3e3ee7dad5d360f4e91354d20ee41b8107e9611423ff230471

Download Submit
C:\Program Files\AdGuard\Adguard.exe

Filesize
6.9MB

MD5
6d5f84eab0080bb45f9094974a6c39af

SHA1
dd05ba579333daceddf4c45693d03fd84a8ff945

SHA256
ea41e815eecb2b9fda34e2cb3c59a0f2703896d3b3578ed7d961a2a492d442c7

SHA512
832c188ff6b8824344f45ff0d2b37f130228c753e1657f6bb1bc14e37764d933a6126a55283caac2cc0d9e379ccb8c1acc80576dec2422fc5f8254d9af37764b

Download Submit
C:\Program Files\AdGuard\Drivers\arm64\AdguardNetLib.dll

Filesize
192KB

MD5
7257436b13445d12a54aaf9cbff8f029

SHA1
45c908ae57133fb87ea77d0aef20ad268b0c721b

SHA256
374512cb07d70a9ccf2b43affb96ab99fc02dcf07ef70b7b38f0c279b12991ca

SHA512
69c13443db0b7128099cfaa914018393c043ca96c25764b1be10035bba0db8efeabe2725473b95aef704e9de971462c3e615610188e5479a5067331d6096d764

Download Submit
C:\Program Files\AdGuard\Drivers\arm64\AdguardNetReg.exe

Filesize
127KB

MD5
0c6bc1676b5e7a48a52a015405925f8f

SHA1
c8b85daec736ce4217ddcc3a41f9c261ff635053

SHA256
32826a974608c145b2a2ffc925d5698e179cf08e04bc957aea3293344d9616a3

SHA512
3f750d99e8b01545afd1261883d5fa6990fd8ecdfabe62564c3e7cc1f423f0e409b6305cba2582f89e439c6690aa6c4f8ba5a71a0d7d0494f29692304dc3b858

Download Submit
C:\Program Files\AdGuard\Drivers\arm\AdguardNetLib.dll

Filesize
153KB

MD5
520658c251bcde9fe6c71fb0f0d20986

SHA1
db75ddf587c128c315a3ba98e1c96749111a3374

SHA256
09d7da40bb51e62000ae46cc625490f559c035d6d059bd8657ef8b6d103cab20

SHA512
2785563612e0c4507256dc260c195919f0072aa730f2d5a842cd59823a5fc1db45303c9dbf6537bbe1e971a8a61cc436c4d6d2a4ad79bb727cc8c6f3835169dc

Download Submit
C:\Program Files\AdGuard\Drivers\arm\AdguardNetReg.exe

Filesize
101KB

MD5
8e37e56d595056bf58e4840b2e0a6312

SHA1
5f82d763f0eb83ae16f0a51dd9b64c3f1db8a3f2

SHA256
3bcd226bf0a6de378ee6ff79e5a2c19260f15f28633174ce23472fbfc8aa331a

SHA512
f35b6da8d6454f52e8555c001fcf216b6c8d04486c2cd28a59028354be596cd6a4cecfe6f6537070f4ed21cf303849cbc4009ed72540efc84f6fdf5ee19c309a

Download Submit
C:\Program Files\AdGuard\Drivers\arm\adgnetworkwfpdrv.sys

Filesize
60KB

MD5
fcb1f6082b2dd42faae9e2fd76de5920

SHA1
fd312dee422bdae43cfd9beec596e2e1a806efe4

SHA256
2b743aac00d054e7c041200c88950305035c70da3d415c05eeb7844b040d93ce

SHA512
52db56608282ff6d18c380710a1d495c45f1c4cd0ed224abbd58a77ded237f347fec96401036b6510fba0735d65721799c65d070436b919bf92b07dc2ff05dfe

Download Submit
C:\Program Files\AdGuard\Drivers\win10\arm64\adgnetworkwfpdrv.sys

Filesize
88KB

MD5
7d26090469f422f0dab254be116f1917

SHA1
55943137295bb8a9400ac73f5dadd648df6fe155

SHA256
4d3d8984523fafd3aa4ba35b9eeb348ea5a6b284b54e92a03e608dc17f71f44d

SHA512
8bd3b4a3ab71a2b22b7ce268605f739a76a12ae2976cce76a81279746890c39a281cf2aa98840178520056924c30d145374402b9a5f4a219eb978f9ccb0a9f1e

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworktdidrv.sys

Filesize
68KB

MD5
4a83e369a535895500cef8f099cc1818

SHA1
4d5697c783f877f823f03e6b77e1a07f79e17b9c

SHA256
2458d32c657b52a79703c26db4ee0503164ea4b764580c67492bfbbb9522596b

SHA512
956932d81026d1648d2adccb3a2ffbdd7a6ac14f1642e154dae98218c4fe500fd9d729fb5c0b96a51d49a711560ee7bfaabf610af562e7f2d4701c63935dc4e3

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x64\adgnetworkwfpdrv.sys

Filesize
87KB

MD5
73210a1c72d9946fd168c961c2d0916e

SHA1
ab848f3bbac8334275c8093e30b561fd71c46ccc

SHA256
274b4429872e302bd0672a52b8b8d43b3cf497d288af57d851ef02c2defc9586

SHA512
a3acbd11d5c3d132bf968ce75842a456bde3bacdd39a2d60ccf0513d00ab5b8d62d86346b68dd89eb42b87240e18825fa74b68e1eb0d6dda35c09ed995cdcfb9

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworktdidrv.sys

Filesize
62KB

MD5
a216964ab28f54e9ec12f73207c1fe91

SHA1
a8b9a3049233c1603ca7b71ca1ac442de13e1436

SHA256
ec8d1f0035069d6552b3a12aee85c2307a10c94c4769d4ddd4868e9e10b33afc

SHA512
6c806ffc7ae23c1818539257576e711ef0296ca1d0a132da0fc77145dab43c33a41cf54bd58abf9fa1135335c00596e8cff4a0f31231986230a14d93029f26f8

Download Submit
C:\Program Files\AdGuard\Drivers\win10\x86\adgnetworkwfpdrv.sys

Filesize
75KB

MD5
2f5b7ce78c3a9d47f2f288051fc57e36

SHA1
b59bad8ac2762e1d473c5fc75a2bf6c6936c9c72

SHA256
2635b3ee42749a58138347ac577b59240047513166876c2b9ff5fac25f184652

SHA512
05b98b2d45d3654865aba3a99717dc8a3a35b1b7c510beaa085bb4a4eb39caa5dde973883bd0a3b92e61c86cc1d5a0a286375b73f8a6c70af9823160289424c6

Download Submit
C:\Program Files\AdGuard\Drivers\x64\AdguardNetLib.dll

Filesize
200KB

MD5
7ec3d16685f1a49e0ea7ffa4536d239d

SHA1
1603e6b9e9910accfc35dc711792581bf6468854

SHA256
a8acc0c9798946de909555f143f99c4a20bffdc1d0affa30addac4e902c72f74

SHA512
327ed37c214c1ff5afa8159e21f9aad83fcc3ff28c3246a0da16bc824c77002bccc7a6483a8e06fd1e8333514c71525ea84e94d56e9fdf0ee5b44d8e44d3d2e3

Download Submit
C:\Program Files\AdGuard\Drivers\x64\AdguardNetReg.exe

Filesize
134KB

MD5
ce1898aaefa0685319b0b1ce9edeb355

SHA1
280d1ab8788faf7bc1326567c95b84bb741d8395

SHA256
15d7010351178309baf929953b404c53284f7c3a5dd1b6e336db52a278c6d58f

SHA512
15d4d32e1043a6f1152d6a13cc37e11ceab98aaf362b47b68f35e0d3e8a90d295977fbf74524e89c3619e966b8b6be66b614c91b6ac94a83f7a978dd5786abf1

Download Submit
C:\Program Files\AdGuard\Drivers\x64\adgnetworktdidrv.sys

Filesize
68KB

MD5
a766442b6595bf4c242684d7a285ef84

SHA1
07e35acad189c43a9a3dedc66853e06541a9e73c

SHA256
6c0a27448725c857de552b84642670481d2fe5c3fd7cf5533cc67146d60f1669

SHA512
174613c8296f5aa5c01daf94f9b3346eb14d854630a0bd1c40ce9e86d2dfb90c8ad64cf340fff1e31c8df985837915dcdf28af312ea2a72b91881cb47d569c95

Download Submit
C:\Program Files\AdGuard\Drivers\x64\adgnetworkwfpdrv.sys

Filesize
112KB

MD5
0f54c2c61c86f31ff652c457886eaf39

SHA1
fdeeab13d5faaa008d11cba4b9114d2192363585

SHA256
fd7855f73f30f12042ea28e6502c723fc8c7e108844dcd48239f952eb59fdfb1

SHA512
f238e216c397e017605af51c6966aadd5843207924e4089d6280ea7491c388176fadce11db4987f47cc6e53329026bc58f10ddd3a6645fbd84860a559e9fcafe

Download Submit
C:\Program Files\AdGuard\Drivers\x86\AdguardNetLib.dll

Filesize
164KB

MD5
9ca27a976342edfd9ea1381a7802b8b6

SHA1
87a55f2524ccea1d7b6ab89236aa506d6a2a455e

SHA256
560cf2a72005278f373cf09196198c31967ab506b1f194414a7293a29bb1805e

SHA512
9d59b1842b5f522a68a5f4e6d8a9f81de49c631c6667f18a98774011dc1644038cfbeb78ef51a3f68e5bc67a66592c83f70aa17079812e375bf87aabe6416a9c

Download Submit
C:\Program Files\AdGuard\Drivers\x86\AdguardNetReg.exe

Filesize
114KB

MD5
cf841c8ac4724a43295b6d857639b4a7

SHA1
abd6b869e5074271eecd88e1cbbd8e852f91fadf

SHA256
800642e9cc36cfc4ccc8e985320b0730efea8d8a5c1489980eb4e07f7349af28

SHA512
a623b08c1ca9632963668bf3bbcedcfb4be9b8f4ad0c615260bc5a68f2b4db82c584bab381bd0bcfc30b43fc903f0cdd8c46030060276bc3adfaff97fde3b11b

Download Submit
C:\Program Files\AdGuard\Drivers\x86\adgnetworktdidrv.sys

Filesize
62KB

MD5
9c5bc33aaa22573400a055cedf321b5f

SHA1
45e242506c6990b1f51d8430833c29481ebac468

SHA256
ae056708a1c7d93c08c52bcd108f26e610373f882943a87be98aea96b3db4809

SHA512
940920b7d1cec62c827d821c91324fcf78ade1ad42db4c3c46773a22ed156d8191c42c4ca89621a14c14e3dd7e36a2be9871ad22ba178ef9c018f6d733e3b6e0

Download Submit
C:\Program Files\AdGuard\Drivers\x86\adgnetworkwfpdrv.sys

Filesize
105KB

MD5
5e969448b7f189719cc1d37e85f0f6a3

SHA1
38efabdbe17c63ea0511b7fdc395eda531f15018

SHA256
ebc648139bcd1847befdd7f059c407a7d70b00d33def0218077ae660c9329f26

SHA512
c819ab1cf11f6c1ebc85546de5a013d2b0e9b6ee382b5afae8dd9d8b01be32ccbda8f5ef6afa37957cd5251a7182573cebfc30bf704b47388258b9881170160b

Download Submit
C:\ProgramData\Adguard\Backups\user_S-1-5-21-160447019-1232603106-4168707212-1000.config

Filesize
322B

MD5
b6ea95711f0e237d9de49dd1cc9aee82

SHA1
3f178836b34480aab8d0b70897f418b2b0d326ba

SHA256
df0cc242fa69d2e977dca8bafe5c4539171bbb7f5a146397683fdb7be6ebce04

SHA512
43459d257968d49fbc6060c6ccd63d67ede48515b4b6cdca30c46c67cb6bd75c211bebf44d71ee6eaf56a76d3b0a885271167c6dccaf333598da14a8612b9871

Download Submit
C:\ProgramData\Adguard\Core\sfbr.db

Filesize
44KB

MD5
84b7679ab9ca3356d6e760deacb99360

SHA1
1fb57f42c2c4a669c808255460b6ece3a5a64ad5

SHA256
7f75536c9907bde92890ba00772756b632b1ed6f10088ce02eba0535671eaad4

SHA512
223c8d9070c9dc3c23493d928542b220d59ed22f9eb9be0cd6ca3e7fb833c27cd51aa5f582f4194bd21d34e97383751b5012c96a934e7c2bc916064658422d2c

Download Submit
C:\ProgramData\Adguard\DnsFilters\e23eb40027b845b38a5a25116d9325d5\dns_filter_15.txt

Filesize
1.3MB

MD5
944e57aa00fdd46c02cc108ada88a667

SHA1
b3f61ac3314076e904d34005a677b0a9173a13d6

SHA256
fd2645cb2b1b9aeee70df96f4096942a39025fcfb04746fbec4242b29368f378

SHA512
9791671dd0071b8de744827eabfed19cf370e249fecd2e21479a14c2ecc1f1d6643a6d85c8b00b3a92fa1b34b8e20405b3f1ed30692a059200730a76bf15defd

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
19.3MB

MD5
e50b5670df76ef2750ba77d2944cfa1e

SHA1
efaec5e7c611392cbd3176c10a7d89bc89adf0ea

SHA256
6a2408485eb28895d87cf329923583e1ae9cdab500739508a40fb60aa774eabc

SHA512
35bb929d1a6a537ae1f5156db54a0a270a0cc5bc23f96be0f4b3037c83fb12a38301c345417e6fd9e711cf1e8b58ce9cb6b55c03f688caf943abdac3e8d8bd61

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
20.7MB

MD5
2df27c8f2f05cfc1546c50abb94ff64f

SHA1
5059f10fa56b4728b3f569e7aa3c781eaac7b790

SHA256
30088ff3edb75bc8d1c15a36bac7ac7f044b9e1c5ddebff0d7fb8601ac51463d

SHA512
148cc12c472a6f0f93c0609654cebe0baaad524fab5966a204bb08cd21ddd44823f1470b964324f5f8517aa5b41c96db323221ad4b28ef82ff594450f3fd440b

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.4MB

MD5
7b597978f6d35006df503545a589a260

SHA1
8f8f59a54067839f3ff87d16e36e4793884903af

SHA256
7896ecc7665f8bbed95d0def7110e43d5f09f4f28cfb27ffcd81a5cecea626fc

SHA512
3006ceb27136077bde932355a635f42cff65b47eeadccaef41a252345597f54a5a0994d9485e263d952dc6bd1acee49b5eae30bdb66a6f2df05d1054fb1e3bee

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
9861a7b93b3791047bc546c054f2739d

SHA1
78288465b0199927e1feea9a348cb8de59b6eccc

SHA256
70db22650f72cc8ed4fa3078bf470e20a24f841c0da4cc863d4669773d82e450

SHA512
f080f47fe385c2e29017ee44dd7d1f4e17475c4b29b863581f472293498a41408e8fa086554c5eaa8358e41acd653206a2005ee338a245e95594156b570c534a

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
14518de33b57903b323c4cef470e0835

SHA1
fb7df52a922096b4104e9dd28c47981153e03c6f

SHA256
e88db8a3d261ec036a99955ae6b0c62d08223f746809937db57d9336c0578a0e

SHA512
e4fb0e1056f26aa1d509af71bf409e46260363f530696cfdcc3d3d4d7884ce3a9d095f84ec29ad7d5ae560fc08cc998b1f96735c073b0a2df5b76956e0c65e01

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
96dc3e92cb8aa573e369ecd469b5a8ff

SHA1
a66bc58b55d283321320a35c32e13219ad46e510

SHA256
8552face5d93e8680649f3f90681d883346b7cee19f87b259e1a1d0868047bde

SHA512
b9e8144bd3c2261cce63d8f3115b11f3ab3ebc9da7ce135722c2053bec349dc685f1951e837d5b073dc6b4e4f508e1c4e92ea919add97d069d238a2df8528874

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
21.8MB

MD5
150da8ce07e46325c886246ad41e748c

SHA1
2417be9dfabbd37c2c81b2029b8b02b88c598a64

SHA256
41ae526022e9dbaf7b72b53690280bfa44b1dc36db596273539f8779e88f0d36

SHA512
3e7a8752d6ce83da99812e5352475b9a2dbacbc30d458984cd504ca5ce1c70a8d0f79c55091fee47bb8bf697e82bafa9005bc99e57fdd959b57d9f7ff599c673

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
27.4MB

MD5
d1c928e3bde190e5c205985a8fdb98ef

SHA1
2d65fa716f2fda7e1336b48ccacb20e9b7f61984

SHA256
b5c8b6c43c17868d8585e8a9d52bbda07cde7ff09d818ed00bc8e3c38bcb6061

SHA512
3f2273d975bb0e10702374773f47ab193baba129f7294c72b38197e2aac9ebaf94527937c13b531b3f14173d83951f18e1b8f2a0d7a6f9d5edb23e6ec93900f5

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
8KB

MD5
fe08f91005abddd75cb2d3c35bb02918

SHA1
5e13771120fb9cfbcf7f04eda42a86705499782e

SHA256
30f794f55ac9374fbaddd4c98cba6987edc65493e93dd824e38211a36a1a23ee

SHA512
441d64e9a16d9177d1db7d0a89c41f0255c9ec2c4d40503f5e874ec2a5165578fa2a454e8e1585419c8d637a57f9f8513b34793ce0f33f13393d60b6b3d75ea0

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
16KB

MD5
5bd550f60d394babe481ad520973be5f

SHA1
09636251c32d55ef8e2536fcf65f4a309a48a52b

SHA256
c3cb870d5699a95e8e2a1d824c28a27af15a77af736379463e897b18b94184cb

SHA512
e1df471faae794520c8200ed7cec68527559a15ebeb71da20e0b95fe59065d6631dfb2f1c9e0a8b4edfaab7ed7f78fab4d58d4d64f4d8c961d1fb9150b72fd6d

Download Submit
C:\ProgramData\Adguard\adguard.db

Filesize
16KB

MD5
c3fc8b0445af1425fe319fe241a3f6d5

SHA1
997617c45ffb21fccedec777abd40ab8736eb673

SHA256
f2805deb39d830d0d212d7f80cf3116b63d2a07ae63d93fe3425b1c0ff392072

SHA512
02e8270473d14429ce55cdf995580b87aaa8ac00425accc6641a7b2ec400a10da00496dbec3fc54ae512c2fd22b22c09bdce8f39d4eba160d41819e2286f12a4

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{2843ADA2-0F67-4F78-92E2-B7A4AB26A670}.2.ver0x0000000000000002.db

Filesize
44KB

MD5
db238f41651ea88c8b1d86a35385cde7

SHA1
a93ededac7b1f89a58f484a9d7f1687be2feb78e

SHA256
1a5b9eb0421cacbcc6d8b3eae50559036a12de0fa036b4229ff8997c2f002277

SHA512
586ac088fa33ec73696dc8482bf755af346ff9351972576ba57816e32936f692993668bdd25acfacb25b97a84881c90acc617d54d68bf2f2c916acff59563126

Download Submit
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4712.0\4isau5zz.newcfg

Filesize
1KB

MD5
1543a151c570c3fd0b6fa8ad13ca53c5

SHA1
6f0a295ab64a7d46a4676b583ef5268480cafb7e

SHA256
fc8ad8662e39f99604a2cf9eec0e04520172a5b17207a212fbc280373eaa2b58

SHA512
3cc2f55ecc8b71d3a7acc1662de98e0c61824d563dbc051716914d07553cd1198ced7c6d3523f3b9b3146f11ff347caff56be8455ba5dd5b3fb4be10bd2a1487

Download Submit
C:\Users\Admin\AppData\Local\Adguard_Software_Limited\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\7.17.4712.0\user.config

Filesize
1KB

MD5
92ef2b438ca5bf0a36a11165102af092

SHA1
1b9409047b80ceba51b18ff1b08fed068e0a4c7c

SHA256
0854f1df92d97e676fe753e90c97513482ea9976a072bbcf73fb7e8c4a387784

SHA512
6de4749de0a34674fb6e10a5d5922073e05c52bf08ca9a358c48c3f9acb403029309be1dd8fb8029a762255dbb00ad2927667866855b39ff5b013c2c9126c9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
cd6258539a68a12cfd67aa32b47b9524

SHA1
4694142a8a340a1c8f704ddeca923c838b8fb57f

SHA256
da7f78245a20604ec25221bc9a2e74909854ee550bdfbe2458b48aaf764ebe98

SHA512
8c0ede0e8d16fa647eb181979fd44cf384407a40fcc6dc87151b83f8fe1df181ab2d8c4b365b5b771388e83104e519c4df2a3cf411a3a2f8a3a2dfc7c46ae524

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\13435

Filesize
16KB

MD5
dffe23da7d2487fe1a02ddd458cada47

SHA1
caf43f8e56c8f608d013789ffb83dfef91459913

SHA256
4c0f3c376836caa8fb5250c87b681dc281a24bba7d2f9f4b84090d661c71fe5a

SHA512
21dcea271baef5481cb80ddf83b3b418a90fe1692104ccd352438c81cbec563922a95878357bb9dabd6393f5d307ab733f8039e539a603771c38620839d1df1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\20415

Filesize
16KB

MD5
f866ae610695e99af141e1dc18dcff1a

SHA1
66d83fb2db5fdb1f50089d3219a6458b0443eb18

SHA256
f44e56ba57fd043adb2f252e3d9d144cb594d77898a4c4bb7329fb9c6b9d083f

SHA512
aa1c2ca58c1bb88d35f0b6a9f07543c0f62f326cd4840bfc029faec042cac79f1ec8be548920e0af7250efe48c5274bbe20ce89e5ef5c1ba80d521c3a185ad8d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\27067

Filesize
9KB

MD5
7dbd37909e0243b372b7066507a04692

SHA1
404e3997f447994231aabfc55e0d5c40734a0205

SHA256
caf5b165a15ff7f48404e84d4fe855838f58050a515791c10e3ad2b9fbee4be4

SHA512
b9747b216c243cffb2e04c17349d49949e984fd22dcf59d63f7986b0a5c55b2f179ceeddf10e2f389f994000b68510af72d8b116185a2958d270b860c51fdfc0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\30785

Filesize
15KB

MD5
2ec5f737cf6528e80fd70fe158191a45

SHA1
04fc3c4b24d91fc2dce0d7f7009e2c63257870ef

SHA256
bcb7c7d7e25c36d0e6bb1802b8a157977de8495c2bb298060edc658c54f5c7dc

SHA512
7f9f6e2c65c5f34e6eaadad0c69a668c3486a5d19a9fadbf82a47179bd3d4eb9b18c0c76cd4ac25b30f5599aad0b68f38f94b04d0affe7f5a0ce7cc9bcce82b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\8BC41489A061CB66DBA3936262EC56D42D4A307B

Filesize
11KB

MD5
b01880acfe67960fabdf93484c72abc3

SHA1
503319e9b44b5e41a1262b712caee49ebf8723d4

SHA256
9f44a7f6b70fc4161544b7978e5161c7744f06488a9f20a64bf4ef44c811fa2b

SHA512
55e2b3dfa4a0b84901c156ff02542dfc20865d21d06ed3029d51f50bf49361d61e56154b3edf833524154d028ae67448fc484a7fcf071e6c5968b98c7255384c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Adguard\Adguard_20240703223657_000_Msi64BitPackage.log

Filesize
1KB

MD5
59a9d9436ae834c3a8cf285f6efeda65

SHA1
1f2a74879bf5c830146e1de1d4c736e18e5678c7

SHA256
a6f6266b8fd73d6ac0e0e82b45c25a827b11ebebf002a81fdb7eaff44062427d

SHA512
5405e32de1808065d8fb428d25a93d638ef11b6ab437a805978e7a9cb67681dc286432fd3c4c61b03baa1845c587415ff6acb0ab151e58673dfbaccd9138b46a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
e506514b91618409dd04c336b8a9195d

SHA1
5999cf1016fd63ca2f53d9f245546d4930e58235

SHA256
6e7ae71db9dedc3cfc33b708c2c2770f080b1d756207df1a295a0aa5a091ef40

SHA512
81eaa64109b0d5783efb97af19677544bf1423c26a1feed4e2a131214df1eac53fa19cd1dcc77c9eccb31bf598039132e46d1086d9f0b972ca177abdb212a242

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
9c7db82c205000427d82cb49e7df674d

SHA1
964048d80226398a3693cd69b479a501aab1b3a4

SHA256
0f27677e5baca0d1c7d717968e113718d1a1294ec7894478a436efcb2a5718b8

SHA512
e3d729cf1bdb2fa7d86dc97c5cc08523670edbd949ccc03ce2b738ac1ea85ae7597031d5b3b8623ba43f9fe6559719e65037b0cfedccad980777f463647e1545

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\3202bc7d-123e-47e5-aa13-ae442d45f6bb

Filesize
9KB

MD5
7e51343307a78338a70698c5592b4834

SHA1
49a99c1228b2671a348dd15a434c682525354398

SHA256
f1260a05036c04591c1d525aaa1ee89e5739fd5e1a5276da2af15cace7487935

SHA512
8fd49d3a9d691219248b5c2bd2cc3575c24ebad91965eb0445d5c5b921efcc52255070bc00c97df257658b76c0c497ce6383a1c11955274d7a57e68706530fd5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\5563f0b6-d975-4d56-af65-05696f2c4d2c

Filesize
856B

MD5
6ad64d5379e7938b3673edf17db9cebb

SHA1
0856abfd001f6cb9b2b384c6251478cb6cf8a96e

SHA256
b301e13b71e3c4a99a9a82faec8fb8365255ed468556ebbbff9c447fbcdbde2a

SHA512
38fb9ba236cc06692ceb1e02d13073170e33918fd9963205621a1761d136cf391f87ba2db8bb811e00ae588f847f7bdfa9e919e2e35fce2ddbf1b170b6f697b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\bc595536-310f-429d-83e6-aa58202a3146

Filesize
746B

MD5
e0772abbbcbc99467580357637ff8c12

SHA1
ec3909c23ddb7670d12b46c04169245023731a56

SHA256
7c4791e1d89612a130b3acd7d5ef434116e5c9c7242d2089c66aa8189f4a592d

SHA512
d249f135bab482badc5d53e9fef6bb75f97ebbc426e7ec39c75533f9d35bdab77683269928d614da81a0f90c0abf7e442efa992e2001aa62e7be66446803e86a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\e6d5bbb6-36c7-4ba3-8121-7b473ad920b1

Filesize
1KB

MD5
e7810f1e42041d951f3050c276ea1989

SHA1
719d03bb774ca8fa722686d1faf1067f26731ef7

SHA256
1c1dd282e6bba8d810e387f9a7b7025cba8eda68c43aa90a168cf8a142128405

SHA512
b376cbcef4afebf2434506c320ce360e917d3dd4a00e5defa68f0165bbccf7a72f65a89389e3521d667229b579f740b8cc9d562f250232ba711eb9d9c910bd7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
5a822718b493ce51fbfdbf04288f8434

SHA1
1baa55b50fe1c121f19ee79b298ceb2d1592526d

SHA256
f71d959510d0f1b08c7cb1beaa3285f7e2b61224e7d2ffb409c6c0d6a92b55de

SHA512
c24e65e893b1c6d9deb850a473fd6dfcb83393388960bf109dbae67f76eea47ce7defc2fdf2a921c2a297258af5ffd42dc4411ab5cbdbfe9d8b075e7ec1206dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
12fc87318b2eb53e520b9a53525d6bfa

SHA1
6c7bd575fa0f8e08fce6ed1775672513306a1405

SHA256
b5f7b6528eaa0433c378cb63d2a7356b32a96734bba2cc3bdcde701627616ae5

SHA512
48da98df07240cbea21b5e0713331f4656dbd034325d9c440d41508b9aeffc484c38f4e1bf16548b3611f5183b801a124d86f9f9ea64d81b691dfacddaad85ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
0f2ec4e568586d3411bbea08dfdc65a2

SHA1
d2b2cdc89526a8483e87f7ea353a1f6700ed6f47

SHA256
399bd62550b05df4877ca63407b0a77212165b3cf4d14330b0883315112804e1

SHA512
f7f70337aa7e44d729717586f0e7acd4403d17f0ab4edef3dc621c48bc7bf0161772381af63bccc89537fd39e457e0b12dd530577e69181be6313c9e28aef8b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d762571f66cb89dff0e8e9047d1d278c

SHA1
a6804bf1934b5dc5174a5013a9321195699cfd7c

SHA256
790298ffaac0106c0ad4c009d7c1e23ef3195c08c22b451b02959c83f7d63f47

SHA512
94ef44999afef77865fe7da2980e89f19684381cb38585cbe9003c41b3930e62d8a790bc4d1280f6539e11ff4ce90052e92d232076e86b29dcd558f14164bbd2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
6ec440120bbec4605e730d8e6eada643

SHA1
5b530249160b06a46e999b6c07aab1043f7991b0

SHA256
91e60ee5c67fbbfb7fd836b5acd776ded84295b73e093d4044cc848da931733b

SHA512
483af35eed06be0c74296cbc04afbca041e7f75f10dad295d98e22d8bfc1e05fa84275e872a29c77090ea3889eaf8c2bae604e5c47c773ea5705a57c98d8319e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
c5f426f22be7989d466009ed101c9527

SHA1
f87cdb340a30e162cae4790df55e691a01f34e98

SHA256
d61ad10de71faf21c575b2c4af99fb7d0d2ee4f88c65fd921d0b475963456790

SHA512
8ff99f5b388a6fb8c3c8fb92aafd03f01c1995b953a8ee3d3ccbf861677698e6badc095c86ab17f1a3eefd49e8d1bb239c34d90cc1a6e3b94933ec7769e7d26d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
6b6322dc39bc8916f90f1c90ade156b0

SHA1
bcc81aff648f61b694a970f5b77e988a208f0daf

SHA256
f5cfe67226f5d0f95e9ac0ec72c148428c2fa7cb1f9438acc92a93fbf7ff4969

SHA512
b51dc544f25a1118f571f22cc4e78b7b9e44a1ca861d3121d7a22866186baeb7e54c9e36879ca38fded1080f191e88d546327f77c4e23a1130ac046f74046e58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
3d57dd868888b581471c5e4c734c7dbe

SHA1
f8d252b31b92f6afe3d5738da68daa9ea0a4b5d8

SHA256
f75930d99abe69133b0e1894c7410d728f04cb56ebaf097b3b5c59043a745865

SHA512
eaddfcb081e4d4a64682250acd4d706e08f4d2e9ba801f68433858c17e44f721581b31be268e4ba271217e0eb4635699ce78f836517e429dedd38564e479fbbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
25KB

MD5
5e6464c96922f501ac85db48a1a75a46

SHA1
1525e345c413ef4f8712d81e514d501d9528cb1c

SHA256
8b171b2fc4ef5268e97a572c6001611f0dc3ea1c495185284fbce830a27b51b6

SHA512
5fc0a2ef326eb1d78726d175049ac528774e39839542087897fb4ac8a3c556e1b321ac48e0ab2d1429717f0001beb1ea10978b266fb360c24eeb54d6bdfc004f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
bf39d67bfd9863dc37a27b9feaba6a15

SHA1
a10be0b8e274a55a4abc5418e91d50235e0046ab

SHA256
7b116cb08e53bfaf3905bb3b742a11cd6d9b0ea0051fe448a766938c350cd66e

SHA512
5d74a8cdd9a11c4081bf801c472d3ba20e5fe8877fa035b7a0d3cdff2cca147faf0a7f5cd56034d28bc5bcb9a7a360870d03dcd2ef5276fa048d307b5e69e8c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c790fc2d320acf945a14a794652a4f99

SHA1
9baada6a6f48ed1b68f099af2469e232bc6d41f3

SHA256
29925438f788e0aa4c11c2285f82e26bbb3d6462a1fa0a7e9d5fc75dc7ed2370

SHA512
eeae7a3107d6130c6e4b48a983af4710895ae757817de16df7186dcd860a362883b1631b0bd027effe685b8c51e7e6b208c0510ca8795c17d79f499dc34d6ec9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
aad7652ae4e6ff7a8415a0b217638a2f

SHA1
008ce1f2ce96cae6e9ed4af7de8716d00b0e2081

SHA256
a601e77fa528c652dc89cab03c9ea1796dc20a7f634a0a35c9c0fe2e6700924b

SHA512
f444298b46feb21fe135e9b91bc7035be5a9c808a3a3a8c0e53c2afb3ac5f54e762047fb57caa691ef73893d4137246afa5f907ff8bcfc37c23c05254095d853

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++endowmentoverhangutmost.com\idb\2135660075ientParvi.sqlite

Filesize
48KB

MD5
6ca91d530e155f4758de7252309eb52f

SHA1
72e6aa56e38c1b41219100ae4885898cf4f960a9

SHA256
14abe858b2e40428b88d6f06e93d6c561927bea10c2017e6304d44b93ea94c6c

SHA512
9066b01053f363398afb352c79fcf39382f469247569f80e8a918411885b6567385f34c6fa1871afda8689cf6b3e511ed9caab9e4f5ef0fc44672f4ca00432be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
C:\Windows\Installer\MSIE8D9.tmp

Filesize
692KB

MD5
3437a454079f74c047152d752ac97a0b

SHA1
6807aebe497b773bfdc2b2db118ebeb20abfe8e4

SHA256
6050249774c748754508ef9b960a3f8dfd6b61a6303a3a86830832006759cdb1

SHA512
803c91d9e676f74ea832ba8d4b8d4edadcd97707ff4d7682e26ec5780b3f815d208f8ca55b1683c997e7bf5d27859b16b742c7c56005bb9bdb3356656f5b9997

Download Submit
C:\Windows\Installer\MSIED9D.tmp-\CustomAction.config

Filesize
228B

MD5
d044d23e8084c869cbdae714ba47b866

SHA1
40d25b0fec3e43b7d966d02928d60904e32bd84a

SHA256
f12f1b6613d92efcb62e63b99a0f5950c97fb3c0999201c736f86798f7a588fd

SHA512
62d2fa90de8440e322e5257e0b5f1a5aeaf79c3cb98417bf7160b8fd66c6a70e0b948479e114cd5a04985c1e7244517d2b7ea049953019e99abe4e872a80c3e9

Download Submit
C:\Windows\Installer\MSIED9D.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIF734.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIF8AD.tmp-\System.Runtime.InteropServices.RuntimeInformation.dll

Filesize
32KB

MD5
82deb78891f430007e871a35ce28fac4

SHA1
4e490d7ec139a6cde53e3932d3122a48aa379904

SHA256
2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237

SHA512
e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a

Download Submit
C:\Windows\Installer\MSIF96A.tmp

Filesize
127KB

MD5
93394d2866590fb66759f5f0263453f2

SHA1
2f0903d4b21a0231add1b4cd02e25c7c4974da84

SHA256
5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

SHA512
f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

Download Submit
C:\Windows\Installer\{A8CDCD01-B65F-4169-A3A9-F13EEBA31ED3}\AdguardIcon.exe

Filesize
384KB

MD5
e1769fd831d70274d0183e3e68994684

SHA1
5db7df3a9a0cf3489272ed99d8cdf6105dc9a620

SHA256
f6558d3f7c36fea39912c10e20d878244a079594a01173dd31918043b250f681

SHA512
504f28d6ff9e72a6662500b192b0263735662c65adae507c65881bef865092f29473af576ce286a30a061a08a2098c078726ce8f6f8c932331fcb52317d76649

Download Submit
C:\Windows\System32\drivers\vwifikerneldrv.sys

Filesize
273B

MD5
7e0f64f9385cdc188a0d841731188e5c

SHA1
9dd91703f8b0aba5bdc78e05d78fc2c454ba208f

SHA256
0e0ee3d06952cedaeb042fa16a0d74364020fe1e086dd1b86ac00d1b17209265

SHA512
137c87c7920bfd2edb71c4f8d20ec430fdf06e3f7779a2ebf087396b364a1e395f699e0539ab4e765e721330d6dfb17830bc256d37e019c46fb444c2dc423ce8

Download Submit
C:\Windows\Temp\{45BB09B6-D2D3-4F05-A943-F66CAEE66EB6}\.cr\setup.exe

Filesize
3.1MB

MD5
7709f83d3c33c7da6fb72bf3a340f3d3

SHA1
bf279d5404c3badfc6cb2943fe55fd36883e5461

SHA256
efb81133361ec54c4f2dec1d03b325d1e32f28dfc68338861b596a7c1d2cac54

SHA512
4282601c91e68b4bd7c454fac907d167cd3f42cd99a96c1121980bf95bb0aaff5cf97de524b8a5248b41470b56ce49c0a8c96f54bf076edf641cbdd8df66030f

Download Submit
C:\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\BootstrapperCore.config

Filesize
1KB

MD5
898c2a320bea0580f37beeccda8f2378

SHA1
eccab214a148e6a7a9535bf1c83b714c756dabf2

SHA256
4440270efc95c694150a665b62ca89b8b93b1271dfb2757e8dd1a68ef2705498

SHA512
e4608aab984c6e97b00e80d2635a283392f1eb24bdb65f5fce92851eb63ad474e5050ac46e5cafe2dbd438dd026269253bd4ec427f08b2a09788d6b1d49bcc84

Download Submit
C:\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\Msi64BitPackage

Filesize
41.5MB

MD5
2598011525466f5cbf7d92d504a79808

SHA1
9cdd6da56a9b6495780c803eaa4a6c2b59667a96

SHA256
6b0cf585f2f871960f5b5d340c4adb836111116868a08629aeb8f0bb73adeea9

SHA512
f2cd8e4a4eaf860bfe277e37d85353fd3fdf05d8c888f93145df4d96ac04a478227e3f9ba45d32576666e55e075242a6549ab4d28b5f38eb83cf83ff5b6474e7

Download Submit
\Windows\Installer\MSIE8D9.tmp-\Adguard.CustomActions.dll

Filesize
475KB

MD5
824c1e589703e706f730731d7ba0116a

SHA1
b87258ac864e0b1a3e60e9e4304c40f5a08aecac

SHA256
90562c207430b60c8cc7cbac04723a7cfa7b77dcd1cc634f08158a32a8b58339

SHA512
e37e7d8282b36168e0cb537367e3d9bcddf0305422ee62e517490bb1c2565677062252ff5a6ba77ab2122c711b71da824dc621a2289be4d837dcf0ba7dfc79d6

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\AdGuard.Utils.Base.dll

Filesize
879KB

MD5
39b2236a3c083292a14f65585ad73e28

SHA1
012a24cc5993cbc33ebace8cace1c1dae1e899c3

SHA256
4b930935f4a6ecf9908c9c50f969c5daea41c3de2bd6540cd6f220fd83bffe8d

SHA512
d3b2f971fc856e3927603334ed428658000b4228776039c4c1c0c9811551209073873aea7130ae46dde2971f694d7fedd2a37dafd5ba325a7d0db24a8451f889

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\AdGuard.Utils.Installer.dll

Filesize
55KB

MD5
abd2f4a5cfa8a9608fb14e3fbf44871f

SHA1
b5249f54a6a73c27bcbbdc07fb6c86d9745be35f

SHA256
06c54e61d243584be70b1b1cfaa412c99e7c5107df45be187a157422edf9eaa5

SHA512
7dcabb779787317c68a6eeb85841ca063fd9d9e3f0a90ff3afc1fd6fddc522913528d8e09e46e9430a4b7c1c1cc67347a5ce89f6adeb1ad262c6ced0c041c1b5

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\AdGuard.Utils.UI.dll

Filesize
621KB

MD5
ec3d9350a9a400fb3271c7327f5bf5a8

SHA1
0eea26f71e7d03579303b9ffc34549fa7ac843e9

SHA256
aa43b82246de237cc9898d6ec2b18bcafe3a1bafbada9fb7939359866d2909e4

SHA512
a789b3056303ee8680aca458c01c947dba6c33c14966a65ee27b338cab2c25fb6481435063814be81760bed25d385f4313149f5f4792620660cf6252a2e0c01e

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\AdGuard.Utils.dll

Filesize
1.8MB

MD5
1f79f405d3659eb62779f948a397967d

SHA1
c01403d8ae03c41726f9f5d72f1b79dc3e96191b

SHA256
b262d6ab962e2dfd034e63df34ad8aed15f1caf1ac1b1259facba9535fca71e4

SHA512
b5a397b6f62ee5c7c2dae0cebcd509127200deb5f651eb5d850a2e9182a5eea67925e96df0e3b1ba9cb0f17a4ad78e29833ed3baf22e5e9ec07ff06d47d64ced

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\Adguard.Burn.dll

Filesize
279KB

MD5
c339956355beb63fe6e06c2f9de758a1

SHA1
99311f1291f2f8de43506f074edee0117f5af93e

SHA256
a6f38c1785e14d6fdf0769892edbd5b0b4c5cb8b11ee230b88a902a3309c9c73

SHA512
7ff364ef49c63de1658c0d0c0ab7bb06462006fb6dc663f2749235118c3b5610ec2473a27d4bf920b068974e3a74795f60aa1b87617cb1af4a246c2b2347e2c2

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\BootstrapperCore.dll

Filesize
87KB

MD5
b0d10a2a622a322788780e7a3cbb85f3

SHA1
04d90b16fa7b47a545c1133d5c0ca9e490f54633

SHA256
f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

SHA512
62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\Newtonsoft.Json.dll

Filesize
647KB

MD5
5afda7c7d4f7085e744c2e7599279db3

SHA1
3a833eb7c6be203f16799d7b7ccd8b8c9d439261

SHA256
f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

SHA512
7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\SharpRaven.dll

Filesize
114KB

MD5
89a2762f19597b82d5c501366e5b2f29

SHA1
f5df7962015164e4bfed0ae361f988c1e581677e

SHA256
a236377db9ee299087c4f8fa6e345765ac4a25aa5d7fabfd8b724f1889324167

SHA512
bd2a4ab78835092abb0cf3cae0850c8b2aa344247f6479cfd59d52bba60c4b605ada4bf885e1ab0b86d4fab138a9084900b954e62e6384d794f2ce61c999cb13

Download Submit
\Windows\Temp\{48EDF22A-F828-46D3-A3F7-510198A5F9FF}\.ba\mbahost.dll

Filesize
119KB

MD5
c59832217903ce88793a6c40888e3cae

SHA1
6d9facabf41dcf53281897764d467696780623b8

SHA256
9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

SHA512
1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

Download Submit
memory/1880-599-0x0000020098780000-0x0000020098838000-memory.dmp

Filesize
736KB

Download
memory/1880-598-0x0000020098860000-0x0000020098936000-memory.dmp

Filesize
856KB

Download
memory/1880-798-0x0000020099490000-0x00000200994B2000-memory.dmp

Filesize
136KB

Download
memory/1880-621-0x000002009A5C0000-0x000002009A99A000-memory.dmp

Filesize
3.9MB

Download
memory/1880-792-0x00007FFA3FE70000-0x00007FFA3FE80000-memory.dmp

Filesize
64KB

Download
memory/1880-592-0x00000200FE4C0000-0x00000200FE588000-memory.dmp

Filesize
800KB

Download
memory/1880-769-0x0000020098FF0000-0x000002009900E000-memory.dmp

Filesize
120KB

Download
memory/1880-593-0x00000200980B0000-0x0000020098140000-memory.dmp

Filesize
576KB

Download
memory/1880-1742-0x0000020099A40000-0x0000020099A7E000-memory.dmp

Filesize
248KB

Download
memory/1880-1743-0x00000200999C0000-0x00000200999D2000-memory.dmp

Filesize
72KB

Download
memory/1880-594-0x0000020098310000-0x00000200984D4000-memory.dmp

Filesize
1.8MB

Download
memory/1880-595-0x0000020098220000-0x0000020098300000-memory.dmp

Filesize
896KB

Download
memory/1880-596-0x0000020098140000-0x00000200981C0000-memory.dmp

Filesize
512KB

Download
memory/1880-597-0x00000200986B0000-0x0000020098772000-memory.dmp

Filesize
776KB

Download
memory/1880-600-0x00000200981C0000-0x00000200981C8000-memory.dmp

Filesize
32KB

Download
memory/1880-601-0x0000020098310000-0x00000200984D4000-memory.dmp

Filesize
1.8MB

Download
memory/1880-604-0x0000020098A40000-0x0000020098AB6000-memory.dmp

Filesize
472KB

Download
memory/1880-603-0x0000020098780000-0x0000020098838000-memory.dmp

Filesize
736KB

Download
memory/1880-623-0x0000020098FC0000-0x0000020098FE5000-memory.dmp

Filesize
148KB

Download
memory/1880-602-0x00000200989C0000-0x0000020098A3A000-memory.dmp

Filesize
488KB

Download
memory/1880-622-0x0000020099420000-0x000002009945A000-memory.dmp

Filesize
232KB

Download
memory/1880-793-0x00007FFA3FE60000-0x00007FFA3FE70000-memory.dmp

Filesize
64KB

Download
memory/1880-620-0x0000020098940000-0x000002009899A000-memory.dmp

Filesize
360KB

Download
memory/1880-619-0x0000020099850000-0x00000200998F8000-memory.dmp

Filesize
672KB

Download
memory/1880-605-0x0000020098140000-0x00000200981C0000-memory.dmp

Filesize
512KB

Download
memory/1880-618-0x00000200997B0000-0x000002009984E000-memory.dmp

Filesize
632KB

Download
memory/1880-617-0x0000020099600000-0x00000200996A8000-memory.dmp

Filesize
672KB

Download
memory/1880-614-0x0000020098F50000-0x0000020098FBC000-memory.dmp

Filesize
432KB

Download
memory/1880-616-0x0000020099510000-0x00000200995F6000-memory.dmp

Filesize
920KB

Download
memory/1880-615-0x00000200980B0000-0x0000020098140000-memory.dmp

Filesize
576KB

Download
memory/1880-606-0x0000020098DC0000-0x0000020098E22000-memory.dmp

Filesize
392KB

Download
memory/1880-607-0x00000200986B0000-0x0000020098772000-memory.dmp

Filesize
776KB

Download
memory/1880-613-0x0000020099020000-0x00000200990E4000-memory.dmp

Filesize
784KB

Download
memory/1880-612-0x0000020099B00000-0x000002009A1DE000-memory.dmp

Filesize
6.9MB

Download
memory/1880-608-0x0000020098EC0000-0x0000020098F4E000-memory.dmp

Filesize
568KB

Download
memory/1880-611-0x00000200992B0000-0x0000020099412000-memory.dmp

Filesize
1.4MB

Download
memory/1880-610-0x0000020099100000-0x00000200992B0000-memory.dmp

Filesize
1.7MB

Download
memory/1880-609-0x0000020098E30000-0x0000020098E96000-memory.dmp

Filesize
408KB

Download
memory/2276-196-0x0000024755F30000-0x0000024755F5E000-memory.dmp

Filesize
184KB

Download
memory/2276-203-0x000002476E4F0000-0x000002476E56C000-memory.dmp

Filesize
496KB

Download
memory/2444-1744-0x0000025899490000-0x0000025899554000-memory.dmp

Filesize
784KB

Download
memory/2992-1754-0x000002C044A80000-0x000002C044AE2000-memory.dmp

Filesize
392KB

Download
memory/2992-1926-0x000002C044ED0000-0x000002C045008000-memory.dmp

Filesize
1.2MB

Download
memory/2992-1727-0x000002C028F70000-0x000002C02964E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-1778-0x000002C048C70000-0x000002C048CA8000-memory.dmp

Filesize
224KB

Download
memory/2992-1750-0x000002C044770000-0x000002C0447EA000-memory.dmp

Filesize
488KB

Download
memory/2992-1757-0x000002C044880000-0x000002C044890000-memory.dmp

Filesize
64KB

Download
memory/2992-1756-0x000002C044870000-0x000002C044878000-memory.dmp

Filesize
32KB

Download
memory/2992-1755-0x000002C044760000-0x000002C04476A000-memory.dmp

Filesize
40KB

Download
memory/3112-768-0x000001B546AA0000-0x000001B546B16000-memory.dmp

Filesize
472KB

Download
memory/3112-771-0x000001B5469B0000-0x000001B5469CE000-memory.dmp

Filesize
120KB

Download
memory/3568-147-0x0000000007A20000-0x0000000007A28000-memory.dmp

Filesize
32KB

Download
memory/3568-116-0x00000000062A0000-0x0000000006380000-memory.dmp

Filesize
896KB

Download
memory/3568-101-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/3568-126-0x0000000006A20000-0x0000000006BE4000-memory.dmp

Filesize
1.8MB

Download
memory/3568-149-0x000000000BBC0000-0x000000000BBF8000-memory.dmp

Filesize
224KB

Download
memory/3568-122-0x0000000006620000-0x00000000066BE000-memory.dmp

Filesize
632KB

Download
memory/3568-145-0x0000000006FB0000-0x0000000006FB8000-memory.dmp

Filesize
32KB

Download
memory/3568-148-0x000000000B4E0000-0x000000000B520000-memory.dmp

Filesize
256KB

Download
memory/3568-112-0x0000000002C40000-0x0000000002C52000-memory.dmp

Filesize
72KB

Download
memory/3568-132-0x0000000006580000-0x000000000659E000-memory.dmp

Filesize
120KB

Download
memory/3568-108-0x0000000003CC0000-0x0000000003D0C000-memory.dmp

Filesize
304KB

Download
memory/3568-137-0x0000000006FD0000-0x0000000007078000-memory.dmp

Filesize
672KB

Download
memory/3568-141-0x0000000007080000-0x00000000073D0000-memory.dmp

Filesize
3.3MB

Download
memory/3568-140-0x00000000069D0000-0x00000000069F2000-memory.dmp

Filesize
136KB

Download
memory/4308-818-0x000001E3687F0000-0x000001E3688D6000-memory.dmp

Filesize
920KB

Download
memory/4440-13-0x0000000000C40000-0x0000000000C67000-memory.dmp

Filesize
156KB

Download
memory/4440-6-0x0000000000C40000-0x0000000000C67000-memory.dmp

Filesize
156KB

Download