hxxps://www[.]advanceddriverupdater[.]com/download/

Analysis

max time kernel
145s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.advanceddriverupdater.com/download/

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 21 IoCs

pid	Process
4936	adusetupipg_direct-adusite.exe
2952	adusetupipg_direct-adusite.tmp
964	ADU.exe
3688	ADU.exe
1856	adunotifier.exe
2212	ADU.exe
1180	ADU.exe
4740	ADU.exe
3900	ADU.exe
4256	ADU.exe
4668	ADU.exe
3572	adunotifier.exe
3324	ADU.exe
776	ADU.exe
2016	ADU.exe
1856	ADU.exe
3860	ADU.exe
908	ADU.exe
1232	ADU.exe
2056	ADU.exe
3092	ADU.exe

Loads dropped DLL 31 IoCs

pid	Process
2952	adusetupipg_direct-adusite.tmp
1856	adunotifier.exe
1856	adunotifier.exe
3688	ADU.exe
3688	ADU.exe
3688	ADU.exe
3688	ADU.exe
3688	ADU.exe
3688	ADU.exe
1856	adunotifier.exe
1856	adunotifier.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
3572	adunotifier.exe
3572	adunotifier.exe
4668	ADU.exe
4668	ADU.exe
3572	adunotifier.exe
3572	adunotifier.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Advanced Driver Updater\is-UHVA9.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\extract\is-GBKNS.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-4AAFJ.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\WPFToolkit.dll	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\Interop.Shell32.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-IQAIO.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\updater\extract\7z.exe	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-U2SU4.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\Interop.IWshRuntimeLibrary.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-AJF02.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-I0S3I.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\extract\is-QAL9G.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-TC7J4.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\Xceed.Wpf.Toolkit.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-HLK6Q.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\amd64Helper\is-CP4LO.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\extract\is-B01RK.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-3969U.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-K79DK.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-CRNTD.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-096RV.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\ADUNotifier_log.txt	adunotifier.exe
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\difxapi.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-N5BM5.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\x86Helper\is-IV23P.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\WpfAnimatedGif.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-DUQE9.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-3K8AJ.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-UMKFL.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\ADUNotifier_OutOfMemorylog.txt	adunotifier.exe
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\unrar.dll	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\difxapi64.dll	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\AWSSDK.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\notifier.json.partial	adunotifier.exe
File created	C:\Program Files (x86)\Advanced Driver Updater\ADUNotifier_Corruptlog.txt	adunotifier.exe
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\updater\amd64Helper\DriverUpdateHelper64.exe	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\updater\amd64Helper\difxapi.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-EG9K9.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\unins000.dat	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\ADUNotifier_log.txt	adunotifier.exe
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\updater\x86Helper\difxapi.dll	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\notifierlib.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\x86Helper\is-UR2AA.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-RFJDA.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\x86Helper\is-2DMH6.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\extract\is-M91TR.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\ADU.exe	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-S0Q0O.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\amd64Helper\is-E652N.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-MI3VF.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-NREHK.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\unins000.msg	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\Delimon.Win32.IO.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\unins000.dat	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-O1J68.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-4GC3P.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\updater\amd64Helper\is-KDEA7.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\Microsoft.Win32.TaskScheduler.dll	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\updater\extract\7z.dll	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-08GHC.tmp	adusetupipg_direct-adusite.tmp
File opened for modification	C:\Program Files (x86)\Advanced Driver Updater\adunotifier.exe	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-ABUHL.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-VCQPQ.tmp	adusetupipg_direct-adusite.tmp
File created	C:\Program Files (x86)\Advanced Driver Updater\is-0HSV5.tmp	adusetupipg_direct-adusite.tmp

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_processor.PNF	ADU.exe
File created	C:\Windows\INF\c_monitor.PNF	ADU.exe
File created	C:\Windows\INF\c_media.PNF	ADU.exe
File created	C:\Windows\INF\c_diskdrive.PNF	ADU.exe
File created	C:\Windows\INF\c_display.PNF	ADU.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\adusetupipg_direct-adusite.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3504	3688	WerFault.exe	153
3468	4668	WerFault.exe	163
3932	3092	WerFault.exe	176

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adunotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adusetupipg_direct-adusite.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adusetupipg_direct-adusite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adunotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADU.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	ADU.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	ADU.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	ADU.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ADU.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	ADU.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	ADU.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	ADU.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	ADU.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Driver	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Driver	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ADU.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	ADU.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	ADU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	ADU.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	ADU.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	ADU.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ADU.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
2784	taskkill.exe
3040	taskkill.exe
1328	taskkill.exe
4196	taskkill.exe
2348	taskkill.exe
1248	taskkill.exe
4068	taskkill.exe
2992	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ADU.exe = "11001"	ADU.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 222187.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\adusetupipg_direct-adusite.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 829454.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
2116	msedge.exe
2116	msedge.exe
3624	msedge.exe
3624	msedge.exe
4416	identity_helper.exe
4416	identity_helper.exe
3900	msedge.exe
3900	msedge.exe
2952	adusetupipg_direct-adusite.tmp
2952	adusetupipg_direct-adusite.tmp
3688	ADU.exe
3688	ADU.exe
3688	ADU.exe
4668	ADU.exe
4668	ADU.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
3092	ADU.exe
3092	ADU.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	964	ADU.exe
Token: SeDebugPrivilege	1856	adunotifier.exe
Token: SeDebugPrivilege	3688	ADU.exe
Token: SeDebugPrivilege	2212	ADU.exe
Token: SeDebugPrivilege	1180	ADU.exe
Token: SeDebugPrivilege	4740	ADU.exe
Token: SeDebugPrivilege	3900	ADU.exe
Token: SeDebugPrivilege	4256	ADU.exe
Token: SeDebugPrivilege	4668	ADU.exe
Token: SeDebugPrivilege	3572	adunotifier.exe
Token: SeDebugPrivilege	3324	ADU.exe
Token: SeDebugPrivilege	776	ADU.exe
Token: SeDebugPrivilege	2016	ADU.exe
Token: SeDebugPrivilege	1856	ADU.exe
Token: SeDebugPrivilege	3860	ADU.exe
Token: SeDebugPrivilege	908	ADU.exe
Token: SeDebugPrivilege	1232	ADU.exe
Token: SeDebugPrivilege	2056	ADU.exe
Token: SeDebugPrivilege	3092	ADU.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2952	adusetupipg_direct-adusite.tmp
3688	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
3688	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3688	ADU.exe
3688	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
4668	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe
3092	ADU.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 580	2116	msedge.exe	81
PID 2116 wrote to memory of 580	2116	msedge.exe	81
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 3396	2116	msedge.exe	83
PID 2116 wrote to memory of 1516	2116	msedge.exe	84
PID 2116 wrote to memory of 1516	2116	msedge.exe	84
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85
PID 2116 wrote to memory of 1816	2116	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.advanceddriverupdater.com/download/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80aeb3cb8,0x7ff80aeb3cc8,0x7ff80aeb3cd8
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2348
- C:\Users\Admin\Downloads\adusetupipg_direct-adusite.exe
  "C:\Users\Admin\Downloads\adusetupipg_direct-adusite.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\is-94R00.tmp\adusetupipg_direct-adusite.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-94R00.tmp\adusetupipg_direct-adusite.tmp" /SL5="$4027A,11636622,861184,C:\Users\Admin\Downloads\adusetupipg_direct-adusite.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2952
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2348
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1248
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4068
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2992
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2784
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3040
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1328
  - - C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
      "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" firstLoadHelpFiles
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:964
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "Advanced Driver Updater_DEFAULT" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "Advanced Driver Updater_UPDATES" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "Advanced Driver Updater" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4916
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "AdvancedDriverUpdater_DEFAULT" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "AdvancedDriverUpdater_UPDATES" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3916
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "AdvancedDriverUpdater" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "AdvancedDriverUpdaterRunAtStartup" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1676
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "AdvancedDriverUpdaterNotifier" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5008
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "AdvancedDriverUpdaterNotifier_startup" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3572
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "AdvancedDriverUpdaterNotifier_trigger" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "Advanced Driver UpdaterNotifier" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2872
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "Advanced Driver UpdaterNotifier_startup" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn "Advanced Driver UpdaterNotifier_trigger" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
      "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" firstinstall delaysec=0 autoscan fireafterinstallsilent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:3688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 5616
        5⤵
        Program crash
        
        PID:3504
  - - C:\Program Files (x86)\Advanced Driver Updater\adunotifier.exe
      "C:\Program Files (x86)\Advanced Driver Updater\adunotifier.exe" createschedule
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1856
    - - C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
        
        "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
        
        "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
    - - C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
        
        "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
    - - C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
        
        "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
    - - C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
        
        "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,11452091026262487866,14132729942858853516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3688 -ip 3688
1⤵
PID:2800

C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
"C:\Program Files (x86)\Advanced Driver Updater\ADU.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 800
  2⤵
  - Program crash
  PID:3468

C:\Program Files (x86)\Advanced Driver Updater\adunotifier.exe
"C:\Program Files (x86)\Advanced Driver Updater\adunotifier.exe" startup neweventtrigger
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3572
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
  "C:\Program Files (x86)\Advanced Driver Updater\ADU.exe" loadvalues
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4668 -ip 4668
1⤵
PID:2668

C:\Program Files (x86)\Advanced Driver Updater\ADU.exe
"C:\Program Files (x86)\Advanced Driver Updater\ADU.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 2340
  2⤵
  - Program crash
  PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3092 -ip 3092
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Advanced Driver Updater\ADU.exe

Filesize
8.4MB

MD5
4a2e728249398a4e102c1931aeeb0485

SHA1
8b778388e355568ecdf1ced9a40b5fe3e9a1f35f

SHA256
0a02706bd6cae98ada7d6c6336c89127beed48e9a1eb5b3de99bb53a9f68c730

SHA512
15beb2803a576b2fe6d52a0271933e549d6f7af523332adf6e2d8e969ab535d418a898fd6ab5bcb07167c74bf36a3c18ea8371c8582ff190e7d0961ededafe49

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\ADU.exe.config

Filesize
3KB

MD5
e5ad00863924decb7e9146105dd32c35

SHA1
b9c8edc7e6032813a46e27170f5f82b822d1e1e2

SHA256
c7d8d60d0069c559defd5735e42dbde9092c8facd75c284ad96133a9d3460373

SHA512
efdb25c92b56b08e2a7039315234beb69e7cc44eb903a25c25d7e190338d61294234d17c3ea327dc412075c82036f9f284e3a95c20ec1b7fdd8b2e8fbee4f3c7

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\Microsoft.Win32.TaskScheduler.dll

Filesize
112KB

MD5
c757150e058428e2a0757701930c223c

SHA1
aa162301c63621214581792b8fde77adf42e124c

SHA256
e3d4a237487e2dcd925c84559957473692bf04cd59b5f95748594345a047231e

SHA512
c7763f4558460092989dd393c4febc220e3fb5b9b13eb4ad4041623bfb527f887c09e39b5aa6c529412f6c9fa837155ae3d5d8d959211cb1452d4b4ed3966f06

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\WPFToolkit.dll

Filesize
456KB

MD5
195ed09e0b4f3b09ea4a3b67a0d3f396

SHA1
01a250631397c93c4aab9a777a86e39fd8d84f09

SHA256
aef9fcbb874fc82e151e32279330061f8f22a77c05f583a0cb5e5696654ac456

SHA512
b801c03efa3e8079366a7782d2634a3686d88f64c3c31a03aa5ce71b7bf472766724d209290c231d55da89dd4f03bd1c0153ffeb514e1d5d408cc2c713cd4098

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\Xceed.Wpf.Toolkit.dll

Filesize
1.3MB

MD5
efc28f72b84fd42494a2d7513ef55cf0

SHA1
6363670c2625450b41f92a50c40ed995a7d4d068

SHA256
5d0569f7e78c684b7149ddaf784aeb5125ceeaaac9d351b6f10df408e4d6ee2a

SHA512
13a0f4aa5696dbe7ea6be17d47b7661e10eb62e3bfdd65496c2672df0f2fd75a9bf94a075bd0f0b59007619d56897d1a676cb1da254e72046720c67bd9932721

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\adunotifier.exe

Filesize
288KB

MD5
0cb9c218c171ebcd2c2cd1e66ca856c5

SHA1
c9b1b925db0fe260bded834170faacaa523f08be

SHA256
8b35eda64e157f5e359c7766036ebd205ed35f8761d8d1b48698f8d3aa5cb532

SHA512
9cc2d019bd21eb04cb5e52077f74bd4fd9fc9b3ef34e659e8cd550876433bb89b6a2b001f00d8bc2315736b5928b2b70a335297c77b425de2fdd9c25e1351198

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\eng_adu_en.ini

Filesize
103KB

MD5
007787db3416a182cee15bcec2065ec7

SHA1
af52699ece5501a3af36ff9e6f2f60649add38a5

SHA256
eea10c453b2cef0faf35375762e65da40f38237e95ab78ad96d4f260a3ed61fb

SHA512
f4acd880410fc2f6128448a2d3bc49c0c4fcc1bb333dc71764982f1a8f6a4a220e976713b6140437f79fbf34fbc07201d3914aa595bf3d21148e93f1ceb8e3e1

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\notifier.ini

Filesize
539B

MD5
411922a6822fd2d56c665e60a0caeb3c

SHA1
89430ef454f37528ad8ab95a90fae97b43e07d30

SHA256
1b7ec4dfe9eac142b9b3dd778c97340e7609742dc45af0f4e21488fcc8769545

SHA512
c3a251e854aeb88cf98650ca8af7781f7f0c4dbac05f3f298de8324cb65ca33b173970b9fbae8b4830eb075240fcbc55d43b3e2f6e639ee181289ec83b4a9754

Download Submit
C:\Program Files (x86)\Advanced Driver Updater\notifierlib.dll

Filesize
643KB

MD5
8baa75d9ac8ed4ac8eaee3d64c2cc09d

SHA1
0ef945a773486510007327e82aa0cf3a4b9e7e27

SHA256
eadd97796bdeffd8d0ce0870977c41623cdee3d617fdcbf5e82c9f86d3177889

SHA512
d83474cfbde356108154a8d8eb74967fe8084c627d12be962933e1d77a98357e42fac10062e1a445d81e2cd1f3007aa144fd8c1f173adfa4312c82408e9e1f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Filesize
1KB

MD5
4c062903cc7e08d58df4ce3bd2a147e9

SHA1
ff768f5511de7e13cf011958a5961b05e5545eee

SHA256
201352ea1ac3b7d6ea14ccd83222b918d90bc326ba5c9e08f77ebb125dca715e

SHA512
062735644eddade5e444a2f811b15bfe7743aa1d4c60b2d960fcb96fde0b20fcca02d9f4b18e4d0e2ff711bf028636ac538c25d5ed7b589bcd195b90696e1740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DB39D85112BACC551037FC8249B0F036

Filesize
504B

MD5
c10edc387ab603ee9682fa2561b8dbc0

SHA1
a72206eefcdc19a42decc466210050dc32fbcf2a

SHA256
4dc10dd772928245af87cb2222de8c9f8eaaff4a0294ec444e88bdf8584542bf

SHA512
383d3cd9a0779a26f97bf08fc510049acb093f88479912823ad4538667e49e5e7de4767b9923863ddca05151af84af66b808e4592052ac165f806efdb6540ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
ba71e841d2767ad67718bf810581f5b6

SHA1
50983db617c4fd17b6005bf1d13ad116b2f12dc1

SHA256
ab3ff00adefc1840fe3a07d0e8deddf92282d892aebed1687ebdb800e54629fe

SHA512
931bef353b5f9e2e1a4f47b14d7227c03d5596bdda0ee2470c60c3ee2643f68a106c452c651491cf219fed2a2a84bebdaef33a6fd59402d7374b44ea119f5a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Filesize
508B

MD5
3897a422f6b63c438e2c61ea8c25b164

SHA1
440dcb70b6c0c135cd564e5ecba1974e3d0ea24d

SHA256
84b3eaa9f8d9aa1b82e7ad3d0c219e7e1a91c1f2eeebee02dfa39d0b1a3156f2

SHA512
299159672f39be2ee6278391db09bc4462e73d027ef8bf9d9fc6e13bc6b10a446954bcb8fd94ff66a8bc01aabd1ccabe805c9876c69e82fd96063c26efbe8b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DB39D85112BACC551037FC8249B0F036

Filesize
550B

MD5
5101761095871d33c40762316725a648

SHA1
3652cb0d826dc74cf234c03a7819a727201fa1b2

SHA256
aa59cfbca73e4d8ea2898e547750c3221c7df54b9e3a4887e31959232b54c4f4

SHA512
067616a46ae984e8afa89259612c0274eab04920da91001dde5e22bc5fe5149d8501cd259d843fa1c3ad219bcd793c6b39ad623ce1fabb2dda3de990a59274f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ADU.exe.log

Filesize
2KB

MD5
53eb71f4b6619659857a50ac3645cb70

SHA1
c7f7f501b2ba64a62cdf9ff3e08bf080232b4954

SHA256
9471ff85f2940d3420b01d679379299dfd174228809686e6b37aee5ebaa32b3b

SHA512
63cc58b9132b26d4c8ceb1434dbed534dc207e768ee73f0bcdac2b163743bb9764347358bb67e8ca657cf05edeef594fa38c9ad8be81a7e922b33533f8626a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
789d25312be75abf83480273c4f3ab9f

SHA1
5e0b4659f1c0c4f7e07d69aaf5cbbae53ff716fa

SHA256
62fcdee35d5a8f1218a03f6c54dee794dff98dd015b4bda6774e9cbafa736643

SHA512
0e567d85107736e10f869878f2fb707e268350fef2f84af262c870ba80fc1fd51c60caddb414dcc674e73c923f63f53d066fe79391ee6fbf8e511b443d767321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5ccf878ae54e88fad5a9d8c3b1624649

SHA1
c8840e466dbeb2a420ed18d26daa6012ca553c79

SHA256
a7f76bc14b1001dec7d56b19c934a71fead6000b3ebfcf10fb6f29b21e9bfb4a

SHA512
f1afd982150ba456d249dbf6564b91aeced0af0ecdfb96aaa91b373f6bd6cdd2ec139901cd7482f9b67e213b8fc2c707e5b40b914a2ba6c5cc0d3f58f739250b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2971fd30995496f27f4f7626ce3626b3

SHA1
b9d0cc04f278884a6154b0bb98b2b78b499f1021

SHA256
7088bd214f022de7128379589ee32a9c78af43cff18ee49ca0497f5dcc9f8b02

SHA512
99290f8fbbf5ef31c2f2f2c80183e3e4af4b68e6947993e923c708eea4b985bbb2cfc27336180ed72523629eff346c95520172656a6c5beab1629eec880ad69d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29a23eb3c7d2394df29695d1f9d2b713

SHA1
27135d14d06604299a2c8fa458d7284e138e9575

SHA256
45f5b37463524f17430cb1bf1c7f29ced9be651c6e44c75e90798b722ab68037

SHA512
333f6e39d64a6e2e0804ee447782bb30d1cb5ece27e7006a948dd42dff2a51bf562a2811c66f1a29bc2f4a86065abf209150f3b9a92103a2b8db3a0c1f77ead1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54a3548caef26c1b0a4d7181314c88f4

SHA1
2df40a28c7c51b41ba481ad97a5fd80fce610358

SHA256
39d52be8311f4300e299db519051803f46d42df95c68e8635673d008ea8978a1

SHA512
afff57e8f66969e092fc309f4cfd4a2f7166c0e90b8773f1c2f79f55f53909b65c36572b221e056d9034c160da23f397caba5ec50e1a10eea1edfe241a41ec2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
31704285caea42d73ce07c18f06449c2

SHA1
d89525f363db46c9dcadd551559c2323dedc348c

SHA256
895ee80aaa9ec8276e0ca30d37d39b9081e76519e5b431b98e160e7e13569fe3

SHA512
193725c0cf00f6f44421a9decdb03eb11d498511c27cb4524916aebc611ab48061f0534a9b58e6d2fb1c721aa812dd82b67d6f1bf10423a23b89229f5f0213e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d5ec0555506f842087b92d001301f8b2

SHA1
81112c980a1ef6e3b1e12fddbb9d3467de6e6978

SHA256
bc48d1b522d1cdbb2b5b425c3bc865982f890e9787b03e768c3acbc0c20b20b5

SHA512
86a1aef9a3c0c207a1cbfadc6fded4e493a9290209fd96a06c1e15e1683a52fe363b242ce05938949cd6cd5be2914d675d4351eb4cfbaed7a4b49ded1e4aeb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8a5ea1707d9545feada4413433732c83

SHA1
ba947cd6d75f20acf30f2d4295e7990f7ea7a432

SHA256
f430943e79f3e38c4f0569b4a07cf96112cc5b8a92d2d4cef1d5045c0add57d3

SHA512
1aceb67f638e2bb583f64b5e7866e4d133342ae09540952ff0265620724e742bc911a8e514d9e9bc4b3f84611227f5e44331e51210c4af8196ba17e563c12030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b65aac3f-6052-430f-8ae3-e4d0fda912bb.tmp

Filesize
11KB

MD5
f748a476f9b6d4d16d7efc433d2270ac

SHA1
062acb32483a411b183eecbb5388b68abcb788f6

SHA256
4740b63221f43d2434fb692e60d91c7b1aac2265d0cf7fd1804bcd2ea5c85638

SHA512
904639af5850f5d9288ff7d34a14b91be4714ade0c7ea7494ff86688525d516697e4e6f8d9c826b7ad4ca40ac82c45c27380d84f495903f96ccc1d0c3eeaa856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BP5TNA7\jquery-3.7.1.min[1].js

Filesize
85KB

MD5
2c872dbe60f4ba70fb85356113d8b35e

SHA1
ee48592d1fff952fcf06ce0b666ed4785493afdc

SHA256
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

SHA512
bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BP5TNA7\new-bootstrap.bundle.min[1].js

Filesize
78KB

MD5
2e477967e482f32e65d4ea9b2fd8e106

SHA1
ddc6e9ead6d16ae9237399ce41e8c1620cc59c36

SHA256
0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c

SHA512
ecf8bfa2d7656db091f8b9d6f85ecfc057120c93ae5090773b1b441db838bd232fcef26375ee0fa35bf8051f4675cf5a5cd50d155518f922b9d70593f161741a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-94R00.tmp\adusetupipg_direct-adusite.tmp

Filesize
2.6MB

MD5
11f142b5eb0b5a6a77c790506999c004

SHA1
b618de2e8d0abbf202e6f42a9c6a2630f6dd66c8

SHA256
8d646b419e7a8877c55aa95cae4f28bf7766402e33e82cb36edd78b214d8459f

SHA512
7513f0cb3fbe005007a7b8eeae24ea5df157b95a4ed026b89279f4cc9fe005e623489e6cc4a7c2b77ea2ab3bc7e053c8f710240f9b07cb257324cf98c3b4a772

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U9RHG.tmp\isxdl.dll

Filesize
152KB

MD5
82201cd8f401f00000b7575b24b3ad0b

SHA1
fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

SHA256
9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

SHA512
a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
4KB

MD5
d311161cc223c34d3255b0a4773c3b88

SHA1
02a6cffa37bece300db3c1deba60cfbba14bc80a

SHA256
20fb7e1f47160c584f722645aeeaf3952e436174bb0a7e28b434061eacfc0f0c

SHA512
17be741a2a46812cc71c308ab4fa8eae3f962e2906d4404c4b2bdeb72188eb773a44f307cd4b07d7a5e46808576547698a04df619d02c17000f0d7304d9c84b0

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
4KB

MD5
70e6edb42c5536f178364405d75e7fb7

SHA1
29d4ca47d3439123aec35ff9b89d7c12a84e1855

SHA256
a348b31bdf1b7abaa57aa7a594bf5185dfd0a8b2b195ecdf39a793cfcba67dff

SHA512
5557d891a1ac80a1f73b7213eeb3481d6a901008c1a2d760202e749408f143d6d7489032c0e14fdf9b51682e019cd0a0ae8f516fd91a5dbe5b691415c68dd565

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
4KB

MD5
9ef6adadbdba9e1282880839b7b2fa5a

SHA1
3a15e8414ca7401eeb3339e14bdbf3957948ce56

SHA256
0f08dacff1bba0d9765a398294427dc28ea5a8bc868e3f1d4d934469bd934bc3

SHA512
eabdb8f23f3730b978d91c39a27ca7d9cdd85fbed3ec4d7b4ac101ece6da74334e1e36921dfe37dc5a667d45caf13d01e394cd1d694cf4ca0f6526566c438384

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
5KB

MD5
1abb5e86290679286aff4d7d737b96d2

SHA1
12716d6c415b0ba55186348623ce0fe2dca9842b

SHA256
99430187b07de48a79a987b75cb810ab13ac974a377fb4cf563c6fa163eff8ef

SHA512
617e527cbf6adecaee28013ba6fb209290fa27a7223faf5709ddf2e97a7c18fc78776c90d09a6d8007ffebea57d46591638271d71751052bee431bbd8f415635

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
8KB

MD5
4f9b92c145e8253dcb9eb82e8fdf076e

SHA1
c1d091b227175c20203b85a9b50501533fff2379

SHA256
75cffcf5aa6e91671ab46880ffdb0cb66bfc16a0aabf28c00ee6e203f14be177

SHA512
e423c08b81f56cebba9e6f3116520cd4e217c2725a9185985102425ececd9d0fa1ebea4b6913470a3edf2f1438a190d77337e5d1091fa46ded1946125bf409a6

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
11KB

MD5
d89ca39cf3ae235e38cfd64cb4723c17

SHA1
caf53292f64e67dbc69aeea9df764226f698a7cf

SHA256
aa59dda6fa314294433bbf3613eb26f1b9380b76ec59790070779fbd61599cb4

SHA512
354ab8b923a5531cab7b97f6d2a393b377cb1ca5c16bee7edef77b7126050b6bd19c3b50bac97a48670c5c6c58c6d518b3eaeb8f9fb28456fde23695ae4267de

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
11KB

MD5
10275e7b7afa494be63a41cd76f38f72

SHA1
29fc7f2f463a39c55142e764150c31b9bc927d73

SHA256
c4c12f0d219d8722b33dbc7b71cae30a986591dcece27fbaaf78e187779ba901

SHA512
452a312d90d255f31cb9d1943a424314978a3ae875c9ef005e797f61f18d4dbf17181143f1516674cf2954de1133f29a7b406fa558ab7690d897645bb2247cb0

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Logs\adu.txt

Filesize
14KB

MD5
bdd8c5406aee8b38af97b13926cc5cce

SHA1
25143708694f27fbfff75bea7b1e94dd0d759c24

SHA256
7b578723c0a30f753ea592ab55cd08808d2e1f77e9ef7bcdb6c72bf0281bf186

SHA512
b9aebac5c9320fa023ebecda58b46e6e86d5249e3af8a42c3f496ed08aca9cd1b24d01573bb30b5adf52057b6a9329f639e07b458115ab4e9a9f5ba8e237d269

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Duplicate Files Fixer\imgBanner

Filesize
87KB

MD5
39a474565b1b25215f9cd1473d8e20d9

SHA1
b61801f6069d384977bb73a2767cdf338f1ccfe5

SHA256
4b89dbf73e217491fd29244f7d71c53b563f82b698fc6bd767b11af0ae748439

SHA512
0d3a32da16885510847c605b4cc8df15e240868452c647f97230414909020524a2a3dcd675514aa372d8f3ce3aa028b0b498e61e00eef4f8683aefea515b5239

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Duplicate Files Fixer\utlImage

Filesize
585B

MD5
066051bed54437b858648b7505680501

SHA1
adffb6973b85ed6f904d307b7d499fa0cf2ba6e8

SHA256
b02ad830e82517a2831518715ec95345d9c5870848eafef1350a2ecde77fa977

SHA512
3daac76b88a76ca53ce177100ecfd4cbab507350fbf9c201d761d3e7db62929e43df77e58d8c54dd7287112ddd2a3321dbf8c1cc8df97370eb3a924ddad50617

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Duplicate Files Fixer\utlhImage

Filesize
584B

MD5
66628f69e35cb9be1142d2edb6f6a5cf

SHA1
bb7560e5e4cbd3f92764d614f32f3cbd6cb95aef

SHA256
8e6ff04f80cefd777ce8321aafb06ace82d6b4e76605c8ab9b5b3ed789452364

SHA512
dad78dda9ea4e52880a13395a1220e2a6848192e68c90bd2529aa58e39a1e41bc00facad5e5a3650d396d38e550155ed54840432a9846e0be89bd2119cd73eef

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Duplicate Photos Fixer Pro\imgBanner

Filesize
81KB

MD5
2045577eacc9280acea9422af196b9c1

SHA1
d1c6f12098b87e38d20c3a4bd9a6efd36d9bafbc

SHA256
e6a9bddb46b8367e80ac1f19b9f160c7dd58b6f95915e2a661c1d346ad0b1385

SHA512
a0efb33107a0e1efdc5aa9db519bb37fbafe887dcb15c88b1c8942ea4da57ceb90bc0538b899df34c4a06c08b6642c3dddb7e56bb54ff226cc7b62f4f71947e6

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Duplicate Photos Fixer Pro\utlImage

Filesize
361B

MD5
fb62b128f427900ff4883dae641a7684

SHA1
0d03abfe8dac7b38af370b07fe0f4c480debdeef

SHA256
5fbdce1ef07e17d6a687410dd48cff104abd747229892106b89682cef9c03539

SHA512
6e464b5802b565edb96a647e5cd7c31bec76babdf71b17dbe02eeccd78d9732651e3e802fbe00e1bdba25fde1b6e4f26edc90bae537e3ce707751ef945344e1c

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Duplicate Photos Fixer Pro\utlhImage

Filesize
362B

MD5
f2e45f7a3300cb194e234437f07c6f25

SHA1
429586e24565190ce4d480d59bd8b365c4f076a4

SHA256
eaf4676585c29360631b8ebca62a3cf12f8649ffe6b46fb2a63c13e1c9ee71aa

SHA512
ef609c89632bc4b0ca7191fad54fec78e41d9f1cbc2ff905701844e3e30c4c4fac870be59c91b54c3a3402d3f82738c479c7d38c49ef76f732fde0697705f7fe

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak Antivirus\imgBanner

Filesize
89KB

MD5
11ae022077461668a60c92fcb13455eb

SHA1
fe087d402c99b0512ab08bce218095c3bbc2bbf1

SHA256
3a7085e415b1c1af80d8cd930d7c6f733688f99022d690fb97032c7ee1af127f

SHA512
fd45899a59c7c7860c5362e09d67697ae4680c6b90a6b39a46e42941df8333843179369054cb1ec7b4646ad7d74b10936378ff2d8c15b6cf8119d037d6bb6973

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak Antivirus\utlImage

Filesize
463B

MD5
45bf28371385af46704b47a165759061

SHA1
bc70c05a0b453c3c5b23d49f72cc441f29361f90

SHA256
3e29e44784def36e1345c3ee0976a89324dc47612ebe9f3e8910b6c3870d3c59

SHA512
826339790b4139b2f743826f12f3592d65d983ae3d033ebf11cd07b6a77a43fcb60e98c38a214594a87c8b761f81bdabbae698de2dc37a20155d5203325cdd0a

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak Antivirus\utlhImage

Filesize
463B

MD5
b87ca91a59e8d94011e0a4a0c08f3d99

SHA1
6f4dcfafdc52bbbbd79221e21dd2392c38792e98

SHA256
4f6b91f7338f22b322c3a18449a090bb147e99927693c52e9d120d8cfbd520c1

SHA512
808c09df1f2ba5a097d78a455dc1cb3d2d7e36dece5b931bdea9f81c3b606948e3b17f7693e474d416adb6b1dc02fdbb1669967974a99302c5bfa0a5c2a02550

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak Software Updater\imgBanner

Filesize
77KB

MD5
942df430d4b4353a74ae57204f98682d

SHA1
9b2a549f696df499bbe602a3e0be39db0ecf3088

SHA256
02aec0b249ca686fff1782c4ea0497138ac0e523633779242757c750e313d49c

SHA512
2c74d07cacbd9d65a0bdf622a73c8e0e21812b7aed4fb069fdf40f295dd46f005432ecc0679bc3a1d4634ea07a1623c02d487b78ff1ff4f43128578cea5a8237

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak Software Updater\utlImage

Filesize
695B

MD5
e72afc1c1473d93a22b8be8889d92dfb

SHA1
c738cda11ae8efcac9770b9fc7db4793d4307386

SHA256
136a3be3f04bcadaf4488d95ddbeb7e1ab24d38bd0431929ad22fe4cd820622b

SHA512
0653d7026db2bf4758e9bfce922f37bcf0ff17129ab79e49341188c7d6b9c739245517bdd7717af3c021b16e81f7e7368e776efb81e856fbb59b5639c8316e6e

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak Software Updater\utlhImage

Filesize
695B

MD5
1ad1fd34db9ce5fe780bb8b61dd956ad

SHA1
e45e28eee052a18cc0fb997d98375cc44e3bf3da

SHA256
dd3e84004aa8dde303b399451836f23fd1447daf82251d8671d0607bf619a193

SHA512
32516bc29bdc48fa82cd21599f311b7408a5122c10105fcd061c1e1126b59c7384741d0115951bf96d507844faa7af50fc22dc302e28d9dbd2da7ce201ac4c4e

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak VPN\imgBanner

Filesize
54KB

MD5
da3d109d964f58521e32722e850e6506

SHA1
21264218c69a2a925841ef50072aa3c15326c88a

SHA256
d0b95433ebbba8134385da9af46139623f71febe38955c4558fc911ca79ecd37

SHA512
aac626355a8347c9c3ed6af2b6a8eb7bead0f06717ee3ae9211ec9d29f9e4ed12e4e0fb754ba08c7ac7f20b00afcdffcafa7900a75682c297390118ec08e62da

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak VPN\utlImage

Filesize
604B

MD5
bf5b7849fc2e43a7e65a488e7ded6d41

SHA1
d04348d1417a7fe1bacad57354a9b4fe607a61cd

SHA256
c0ed6e791d977a0ceb41b0c795ec92565ba853f588800f09ebab85be563ab7e5

SHA512
eea9a700ce8b26eaf3926b87478dea0620d9549a17251d0074b6ae5eb92d6ab040be3b892a1244858fcdcd9df21f4e721726a2f36de8a110b302fca5bbe0ad3f

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\Systweak VPN\utlhImage

Filesize
604B

MD5
6b0ac6cd7c5eb674f70e6e04ff572eb5

SHA1
e3a92bdaadf6b9a5fd1331395213bd51a847c4ec

SHA256
61968825f077b291a8826d2395238c5ec00723aa30866cc1c1cdf973b3c1649f

SHA512
49f3dc2ea51195bc7603eac71ebfab2adaed2f0b8ee42ef6e2e0e8d3fb6e2c7e32f00cc5e42d072e6bcefeb6738c9a5b03f71192c8e1e9be57f882ff377716ef

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakPass Password Manager\imgBanner

Filesize
59KB

MD5
254caf23e6265a0dd34df53018e3c806

SHA1
a1e48e2f6b42535bafc15f6259010d1c86b0b641

SHA256
175493b11286e1053de75b74663bcc4ab225f5c97395b85c601c40bc44d71a05

SHA512
18840ee688fa1e7f964a3d0be1bf116ced5a10af112eda20d07d18671d9e34e5b6d481ceb2d0fd1a1f8295c92a97e2e39c3a0797aeb7c439abeaf8b43a6c5ad4

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakPass Password Manager\utlImage

Filesize
504B

MD5
6d8a2cd87726e63223060f8462d8148e

SHA1
f6688542eea7d7ef2b546a81ccc79de705b92c43

SHA256
e57b76d3aa84dfd1c8223bc6ae36f1623704f4aebe2904efdd08d9d5df6ebcc6

SHA512
ac3744d934f01f5c20a36fe15269cd0654fb6986f100fb893d9d7b077d132badb188f4167533793b0d0c136b03d8efdedbd85a061f428044a974e8d8a5abe971

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakPass Password Manager\utlhImage

Filesize
505B

MD5
bed96d6d63299e41334e3c48969ee1b1

SHA1
620d4045622aa31200be9e15735fc6ee83cd606e

SHA256
86d74025161362cc2a3ae403bd06412102b96213821314b9d1f3ccda11bce817

SHA512
ba36ef19d8ff3d58e7d4bf149d1b1640516f167bb990efd314f59cbeac54a616c05f854d72502107291e7c416823d91cdf86f4d0d18d212b0224cfb5793d11ea

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakShot Screen Capture\imgBanner

Filesize
146KB

MD5
ac7273440e15d90ad171d5504f6b0476

SHA1
709858d609547aa19c7d4009377b53cfa08ff696

SHA256
56561e82a8823f4d966856827c7862b96fdcc6d5b89374316a6302225f15db22

SHA512
a996ed7f86aaf6a8f44cc45321f9f06794b5c9dedcc2bcb5040a30aea635192371be29e81e88cefd0f1c465cbb0a9363571821977a20e11ee847df3be7d2eabb

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakShot Screen Capture\utlImage

Filesize
383B

MD5
ed660d7fe9d42f3931078b8fbd49ede2

SHA1
876352b77cf923a10af7a5082b590e7c5d6431ce

SHA256
eb9536b448cd3e6c32b5ba49b51455f477788d32de586cc5f552d60590dd5d5f

SHA512
22693ba20677ca6087ea768ca508b9522fa75e8b53e18ba296d5d1107f31030670526422ac698bc1beca9112421e00c916aefe465f2f3277c9cf5179eac0ef2e

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakShot Screen Capture\utlhImage

Filesize
385B

MD5
e3dd7abc7ddcfa261c74f6d392342b94

SHA1
1b2c70615c901f61ef2bd5235db48f946c92e791

SHA256
602512a07bdb42ca64e69b9c7aa1068e5d2e5fa953ed4d438da81c3f364737b2

SHA512
b6193f40c66128290b2c842139ddc72f009dd83d59572c3ab87255cfca7ab8ec776ba100782117434c1adbbd88ddaa54d51a9ab24fdeaeedab6880a7a9663775

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakShot Screen Recorder\imgBanner

Filesize
76KB

MD5
58be3e97fb67dfe5532905bbd93e0813

SHA1
069f8ccf568a1a66e2192e92fff69cbc06aef0fe

SHA256
e105cbf4d10c9043af422e9b02c69c82a3aedf249ffbd2c135a0f81076c92e77

SHA512
92008a1d99abc28dc261a94af57c697ab6b612b2890a6c4117925124e0564553822d9170e97e41eff8e0e365eb1b27658d482bb50950faf1d3580805eca53f40

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakShot Screen Recorder\utlImage

Filesize
497B

MD5
c64fe9684b2b06fb15b1034250224314

SHA1
5d21e311513574486d63063155558300ec336cba

SHA256
cdddd30a12202fd56c34e1d2f6f88360bb3ce226685da59106b5478c39725bfa

SHA512
cf18c3e30383bde4acc82400ca5682bef72f85643789cd62131710e97f969701e81c199c5fcb89b8e52accd8617362fca271f80a7312a246216140622b40a38b

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\StoreBuyNow\TweakShot Screen Recorder\utlhImage

Filesize
496B

MD5
c5206494c4e7b58e54f30d43f77df8eb

SHA1
71bb1a7e43d581ef53c1e334a485bd9c4253fd6a

SHA256
a9ff1eec0f1acde74199ad9dc326db9aaa497a2906890ff32d7efe7d720d4773

SHA512
a95993c88cff5a63a92127464acf8659f45ce322f30d3637e7454f664619636b1721f9f87e1d0847f381c0681051e6ad1cc7324c0300eb9ee9644443f2df0d9e

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Store_BuyNow.ini

Filesize
47KB

MD5
6ca29062b4ff3463753bdaa56dd4d59c

SHA1
3b1567cf9bd8b73e87a0234d8a500d965ca9e2cb

SHA256
e2697037ec1767c8aabee4e780949271cd4486a3c1af11e6514404afb6ab3d66

SHA512
7bf75c87df722cdafae921ff1a71222b4d116960993a2e10f9eff9e23ee398c8166d0f7a034098d742e9022c29ba07918db86f4ccaeb7e8bb5cbfec7a9d3fe07

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Store_BuyNow.ini

Filesize
47KB

MD5
cc976a37518d04cfac664adf3d44c64d

SHA1
d848b2badcf8fd84307f7927ed893aa0f314ee64

SHA256
e0bf13b0c6d677b628c97fed1975777a4ba41a9b40d33db25d44261d3590c13d

SHA512
fb3c23e4e1eb2cf6c3e0530b001e840394f0196177b1e052a565c2337028796ae1c0d494dee1d0cc6091fb9861a1e011bf8971717e1cb451bb409961fb9e42e9

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\Utility_kit.ini

Filesize
46KB

MD5
6c67dea772f4fc9e37fa99a5675d5c81

SHA1
878df67a3ef61f8696d2254527f6068351f16d0d

SHA256
acb8174f954f99f45a8ffcc86c3ce16bee3897154705ae1086dea199344403a7

SHA512
2dd480c95f0c30949ed41561f2043a8e01f7616ea2888a2761450f352e838f6f348254168ee5371aefbef3db7f021c02cb63ea78612313b7563f8ffef2ad6fab

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\dbupdate.ini

Filesize
1KB

MD5
04defb9132a807c2d20abd8ecb000a68

SHA1
bbc767c15a7bd336ee4dff8b90f87c92f2bb510b

SHA256
dfa3df0889c2816466e662707e9e6fdb329adbaad2848a4f88cdc079e8999268

SHA512
84656a0d4ef07f697112da560e2976af9c7770a671a086794de1bbc580e6ad2493473068ba94cb7ef4e6a7acda5d3fc5cd4d6890db197d882c81ed6e35afaf16

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\dbupdate.ini

Filesize
1KB

MD5
76f3840da13c123e668db4283feb9cbb

SHA1
f6abe28306fc417fc75b3b2fc8d614ec497123e1

SHA256
357ce27365982a49c31064fe8d5bbc743cfc1150f3a1bb437577f2c2105a0a3b

SHA512
540f0681be0c1e5b54120b3b7d8c498277a2cece17feccaedb58fa433832e60c353a3f7a6edb2eb2a16310d4f7b554ef7c8ebb56a1b407ff2fb640c1ddfa92db

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\Advanced Driver Updater\ntfrUpdate.ini

Filesize
22B

MD5
95995f9c44b713bae60b6d2469aaf58e

SHA1
348a83b1e8c768b1277070b91cc11a6820df66fb

SHA256
58f901e8f531dbf9305c6bf17ac96addccf5778e6491612a57c5fe0c9b5bb3e0

SHA512
b6e430dcc858b56724b072b8c4575824e796563f9e4981c79cc2e1ae86cc7a091e1fe045f8e8ebc1b493c9fe1d3b6d981a0aa941ad151c4fb4fd2c7cff66c59b

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\hash.ini

Filesize
10B

MD5
1b3d9d5a814e2fbe1d52a2d671763232

SHA1
95b7d51505c48d854c0061cf83c4fddbb655bf8f

SHA256
d2d77593fc5e6c2ad76c480f7ed3eb710d2a296781ee65faaab71eb3b0b125a0

SHA512
8cdc04744256f47db37b95a2de6dbe300f068956dbbbb5210a042c7158950e501ebe8b68d837b66cf4e08176bd16d3fb62d6543fbe2de3ab2b1b4a5f4d69ad74

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\sfuni.ini

Filesize
130B

MD5
1f94ef8e5448f7b37a3b8783c29d04f3

SHA1
90839962bfcb7e8865411000088048139e6172e7

SHA256
6524bbf91de509c5f96266485bf81e4f6a95aaf57b6867e0fab91b7fba2ab638

SHA512
bf2c858fe8ab017531ecaffecf0c5a189594be812770dd38e2ff2a4f6223c4547916f840ed9df02bb998b97640fd65f5a0cb300e2b9d94a6da438922430cc971

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 222187.crdownload

Filesize
11.9MB

MD5
2fbe758545594774315b2825b804b7af

SHA1
9a9ca07bf1ae93897a218f3b09a84afa8977ae81

SHA256
c5a71898b977332d18d869f8be52b6db4792ae44c3d7e39777d8a18821cb55d3

SHA512
2bad801faf456271c37397749be1bfa40eb6be76bb4d94e11450ccee5934a21b8105cd8f6801e7b58d6aed4e1df95933a854a4b7ba6c6b1d4d7f65ef3ba38024

Download Submit
C:\Users\Admin\Downloads\adusetupipg_direct-adusite.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/964-397-0x0000000005F20000-0x00000000060A8000-memory.dmp

Filesize
1.5MB

Download
memory/964-398-0x0000000007D60000-0x0000000008194000-memory.dmp

Filesize
4.2MB

Download
memory/964-409-0x0000000008E10000-0x0000000008E76000-memory.dmp

Filesize
408KB

Download
memory/964-385-0x0000000000770000-0x0000000000FDC000-memory.dmp

Filesize
8.4MB

Download
memory/964-418-0x00000000091D0000-0x000000000926C000-memory.dmp

Filesize
624KB

Download
memory/964-396-0x00000000067B0000-0x0000000006D56000-memory.dmp

Filesize
5.6MB

Download
memory/964-395-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/1856-588-0x0000000000A20000-0x0000000000A66000-memory.dmp

Filesize
280KB

Download
memory/1856-593-0x0000000005440000-0x00000000054E2000-memory.dmp

Filesize
648KB

Download
memory/2952-229-0x0000000000400000-0x0000000000696000-memory.dmp

Filesize
2.6MB

Download
memory/2952-589-0x0000000000400000-0x0000000000696000-memory.dmp

Filesize
2.6MB

Download
memory/3092-1493-0x000000000F910000-0x000000000FC67000-memory.dmp

Filesize
3.3MB

Download
memory/3572-1271-0x00000000074C0000-0x00000000074D2000-memory.dmp

Filesize
72KB

Download
memory/3572-1272-0x0000000007EA0000-0x0000000007EDC000-memory.dmp

Filesize
240KB

Download
memory/3688-625-0x0000000007810000-0x0000000007832000-memory.dmp

Filesize
136KB

Download
memory/3688-647-0x000000000AB80000-0x000000000AB8E000-memory.dmp

Filesize
56KB

Download
memory/3688-655-0x000000000B8D0000-0x000000000BA20000-memory.dmp

Filesize
1.3MB

Download
memory/3688-651-0x000000000B0A0000-0x000000000B118000-memory.dmp

Filesize
480KB

Download
memory/3688-658-0x000000000B8B0000-0x000000000B8B8000-memory.dmp

Filesize
32KB

Download
memory/3688-657-0x000000000B8A0000-0x000000000B8A8000-memory.dmp

Filesize
32KB

Download
memory/3688-656-0x000000000B7E0000-0x000000000B7EA000-memory.dmp

Filesize
40KB

Download
memory/3688-646-0x000000000ABB0000-0x000000000ABE8000-memory.dmp

Filesize
224KB

Download
memory/4668-1159-0x000000000E390000-0x000000000E45E000-memory.dmp

Filesize
824KB

Download
memory/4668-1133-0x0000000009150000-0x0000000009160000-memory.dmp

Filesize
64KB

Download
memory/4668-1134-0x000000000C6A0000-0x000000000C6E0000-memory.dmp

Filesize
256KB

Download
memory/4668-1160-0x000000000E460000-0x000000000E7B7000-memory.dmp

Filesize
3.3MB

Download
memory/4936-594-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4936-228-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4936-185-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download