fabookie | 58d351c4724c28b369df9524058ae8b67ae110fd880e6d6ede9d78f9eaa47b73

Resubmissions

08-12-2024 23:53

241208-3xp88swmes 10

19-07-2023 10:01

230719-l2n4asdb6y 10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-12-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

19.1MB
MD5

8ebac20b51430b0cc35cef0bb4343524
SHA1

d73890138f1bac7f87cbb0137a86b000ca1dfdc8
SHA256

0017a2f18f49ca0a4cc0a1f6a524faa5658ae033eda508906b626329c232fba5
SHA512

0db3f4eb3df46f9811793edd29388fe7c9a36c3c9f94f4f16caaaa70d0a28aa4e8a38ccc96fd57270dab9d23b0313f85aab0808e81c660512bc8abc7d2f90674
SSDEEP

393216:obnSY7czVZQ+jQ3o3xrcJpuEJsVLDV3EJCP2qzFMlSQbY3hyt:GOVSiQ30xrUQkoFz+qaghyt

Score

10^/10

fabookie discovery evasion persistence privilege_escalation spyware stealer vmprotect

Malware Config

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral3/memory/3012-49-0x0000000140000000-0x0000000140619000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Fabookie family
fabookie
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	DnsService.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	DnsService.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	DnsService.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4704	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	sample.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	Folder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	AdblockInstaller.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	Adblock.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adblock Fast.lnk	Adblock.exe

Executes dropped EXE 13 IoCs

pid	Process
3196	Software_Tool.exe
3012	Resource.exe
1688	Folder.exe
396	AdblockInstaller.exe
2880	Folder.exe
4780	AdblockInstaller.tmp
4728	Adblock.exe
2084	crashpad_handler.exe
4560	DnsService.exe
1788	DnsService.exe
2332	DnsService.exe
2412	AdblockInstaller.exe
112	AdblockInstaller.tmp

Loads dropped DLL 13 IoCs

pid	Process
3196	Software_Tool.exe
3196	Software_Tool.exe
3196	Software_Tool.exe
4780	AdblockInstaller.tmp
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4560	DnsService.exe
1788	DnsService.exe
2332	DnsService.exe
112	AdblockInstaller.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral3/files/0x002800000004506b-18.dat	vmprotect
behavioral3/memory/3012-49-0x0000000140000000-0x0000000140619000-memory.dmp	vmprotect

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	myexternalip.com
77	myexternalip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdblockInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdblockInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Folder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdblockInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Software_Tool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdblockInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Folder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1936	taskkill.exe
1908	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1396	reg.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe
2332	DnsService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4780	AdblockInstaller.tmp
4728	Adblock.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3196	Software_Tool.exe
396	AdblockInstaller.exe
4780	AdblockInstaller.tmp
3196	Software_Tool.exe
3196	Software_Tool.exe
3196	Software_Tool.exe
3196	Software_Tool.exe
4728	Adblock.exe
2084	crashpad_handler.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4728	Adblock.exe
4560	DnsService.exe
1788	DnsService.exe
2412	AdblockInstaller.exe
112	AdblockInstaller.tmp

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 3196	1048	sample.exe	81
PID 1048 wrote to memory of 3196	1048	sample.exe	81
PID 1048 wrote to memory of 3196	1048	sample.exe	81
PID 1048 wrote to memory of 3012	1048	sample.exe	83
PID 1048 wrote to memory of 3012	1048	sample.exe	83
PID 1048 wrote to memory of 1688	1048	sample.exe	84
PID 1048 wrote to memory of 1688	1048	sample.exe	84
PID 1048 wrote to memory of 1688	1048	sample.exe	84
PID 3196 wrote to memory of 396	3196	Software_Tool.exe	86
PID 3196 wrote to memory of 396	3196	Software_Tool.exe	86
PID 3196 wrote to memory of 396	3196	Software_Tool.exe	86
PID 1688 wrote to memory of 2880	1688	Folder.exe	87
PID 1688 wrote to memory of 2880	1688	Folder.exe	87
PID 1688 wrote to memory of 2880	1688	Folder.exe	87
PID 396 wrote to memory of 4780	396	AdblockInstaller.exe	89
PID 396 wrote to memory of 4780	396	AdblockInstaller.exe	89
PID 396 wrote to memory of 4780	396	AdblockInstaller.exe	89
PID 4780 wrote to memory of 1936	4780	AdblockInstaller.tmp	94
PID 4780 wrote to memory of 1936	4780	AdblockInstaller.tmp	94
PID 4780 wrote to memory of 1936	4780	AdblockInstaller.tmp	94
PID 4780 wrote to memory of 4728	4780	AdblockInstaller.tmp	97
PID 4780 wrote to memory of 4728	4780	AdblockInstaller.tmp	97
PID 4780 wrote to memory of 3668	4780	AdblockInstaller.tmp	98
PID 4780 wrote to memory of 3668	4780	AdblockInstaller.tmp	98
PID 4728 wrote to memory of 2084	4728	Adblock.exe	100
PID 4728 wrote to memory of 2084	4728	Adblock.exe	100
PID 3668 wrote to memory of 2820	3668	cmd.exe	103
PID 3668 wrote to memory of 2820	3668	cmd.exe	103
PID 4780 wrote to memory of 3076	4780	AdblockInstaller.tmp	104
PID 4780 wrote to memory of 3076	4780	AdblockInstaller.tmp	104
PID 3076 wrote to memory of 1396	3076	cmd.exe	106
PID 3076 wrote to memory of 1396	3076	cmd.exe	106
PID 4780 wrote to memory of 1908	4780	AdblockInstaller.tmp	107
PID 4780 wrote to memory of 1908	4780	AdblockInstaller.tmp	107
PID 4780 wrote to memory of 1908	4780	AdblockInstaller.tmp	107
PID 4728 wrote to memory of 4704	4728	Adblock.exe	110
PID 4728 wrote to memory of 4704	4728	Adblock.exe	110
PID 4728 wrote to memory of 4560	4728	Adblock.exe	111
PID 4728 wrote to memory of 4560	4728	Adblock.exe	111
PID 4728 wrote to memory of 1788	4728	Adblock.exe	112
PID 4728 wrote to memory of 1788	4728	Adblock.exe	112
PID 4728 wrote to memory of 2412	4728	Adblock.exe	114
PID 4728 wrote to memory of 2412	4728	Adblock.exe	114
PID 4728 wrote to memory of 2412	4728	Adblock.exe	114
PID 2412 wrote to memory of 112	2412	AdblockInstaller.exe	118
PID 2412 wrote to memory of 112	2412	AdblockInstaller.exe	118
PID 2412 wrote to memory of 112	2412	AdblockInstaller.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe
  "C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Users\Admin\AppData\Local\Temp\sib9ED2.tmp\0\AdblockInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\sib9ED2.tmp\0\AdblockInstaller.exe" /pid=741
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\is-QDLIP.tmp\AdblockInstaller.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QDLIP.tmp\AdblockInstaller.tmp" /SL5="$8014C,15557677,792064,C:\Users\Admin\AppData\Local\Temp\sib9ED2.tmp\0\AdblockInstaller.exe" /pid=741
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4780
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Adblock.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Users\Admin\Programs\Adblock\Adblock.exe
        
        "C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=ccb8eda81733702057 --downloadDate=2022-12-17T04:04:11 --distId=marketator --pid=741
        5⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4728
      - C:\Users\Admin\Programs\Adblock\crashpad_handler.exe
        
        C:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.4.12&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\c5ca1433-2c70-4283-dd93-df875f7a787e.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\c5ca1433-2c70-4283-dd93-df875f7a787e.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\c5ca1433-2c70-4283-dd93-df875f7a787e.run\__sentry-breadcrumb2" --initial-client-data=0x40c,0x410,0x414,0x3e4,0x418,0x7ff67b65bdd0,0x7ff67b65bdf0,0x7ff67b65be08
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Windows\system32\netsh.exe
        
        C:\Windows\system32\netsh.exe firewall add allowedprogram "C:\Users\Admin\Programs\Adblock\DnsService.exe" AdBlockFast ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4704
      - C:\Users\Admin\Programs\Adblock\DnsService.exe
        
        C:\Users\Admin\Programs\Adblock\DnsService.exe -install
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4560
      - C:\Users\Admin\Programs\Adblock\DnsService.exe
        
        C:\Users\Admin\Programs\Adblock\DnsService.exe -start
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Update-5f88a254-e859-40c5-8068-0f17d2043e77\AdblockInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Update-5f88a254-e859-40c5-8068-0f17d2043e77\AdblockInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /UPDATE
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\is-012PB.tmp\AdblockInstaller.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-012PB.tmp\AdblockInstaller.tmp" /SL5="$70242,13644040,792064,C:\Users\Admin\AppData\Local\Temp\Update-5f88a254-e859-40c5-8068-0f17d2043e77\AdblockInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /UPDATE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:112
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3668
      - C:\Windows\system32\reg.exe
        
        reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f
        6⤵
        
        PID:2820
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3076
      - C:\Windows\system32\reg.exe
        
        reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f
        6⤵
        Modifies registry key
        
        PID:1396
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im MassiveEngine.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
- C:\Users\Admin\AppData\Local\Temp\Resource.exe
  "C:\Users\Admin\AppData\Local\Temp\Resource.exe"
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\Folder.exe
  "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\Folder.exe
    "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -h
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2880

C:\Users\Admin\Programs\Adblock\DnsService.exe
C:\Users\Admin\Programs\Adblock\DnsService.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Folder.exe

Filesize
135KB

MD5
0f2871fbf16bf9f5adc60785d8a71bd5

SHA1
3a5763edc969e9213d5cefaff6a6eb1e48132a91

SHA256
e4990a5113f348f96ac4b3d443bce8fec9f6a2c3ac70f749c86dd5b5052ab115

SHA512
82b0bc0b01eb9eef999a103ef447a25161a33445d90cd90c60e05b15f9668ff5c75335dc47e2829e4544bd7ee04a33955c83f378675531cf84110320226fad88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resource.exe

Filesize
3.5MB

MD5
10a8375392ad7ff460dbc07a627f9259

SHA1
96a5c4480a44840e4a7562afd31171f069fbc3e3

SHA256
96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46

SHA512
089f12390b182e83c775adb973275a0dff0c69c9ea6074c25638e7069ae28911fc060491fa34d6202dfa8400e718aa81dce65530f34e110aff17fbc86c07247a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe

Filesize
15.7MB

MD5
9af27765527617e9d75b5ee6b418c8d6

SHA1
0e5f46cf55abe0746e8ddf5d7980ad0a5475e8e7

SHA256
e92ee1bc7c053bfb6b65bfce216a97d3ba5fd4f09bf9fd4f530101a60bb19030

SHA512
033ae6fea1be872fbc028aa9519f558f425076b906330f6dfa2d63e9dba04bfb7efdb583cff87c16a5e4ec2c29736540b8552ec754422ee05ee97788b095bd13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update-5f88a254-e859-40c5-8068-0f17d2043e77\AdblockInstaller.exe

Filesize
13.8MB

MD5
ef6450ab524057924408dbe29991e99e

SHA1
f3b2ccec86f8a3543d5a35729b9d0138f4cc803f

SHA256
b00ec7b6171f98639b060f25e6a0df8b5fa3507af64484ea23a03234a74a87df

SHA512
e227b4c79b99a4d145a7e2cdf738157a873b09192d9563df8c248cecf832cf81a5c369ddd25091c99cb1745ad730623b05b1ed3e08db852589550a33a1db84da

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-012PB.tmp\AdblockInstaller.tmp

Filesize
3.0MB

MD5
f5fe7ed5e8dcd06dd915d9d1015f63f9

SHA1
d203b9224b103b3a4f85e10cd579684b58dc1ee8

SHA256
3aa610bcf011024a18ee86fa2a7fb78401472ab6159d78f609cdf46adebd3aa7

SHA512
0421e39424d0343a9c637d2f523a00191d2bac0facb84f140c6bc566e5861b2519922cd2f41622456fd2019dfc5a7f1afbc4708ea11dee90cdece471dcadcda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FJKFE.tmp\PEInjector.dll

Filesize
186KB

MD5
a4cf124b21795dfd382c12422fd901ca

SHA1
7e2832f3b8b8e06ae594558d81416e96a81d3898

SHA256
9e371a745ea2c92c4ba996772557f4a66545ed5186d02bb2e73e20dc79906ec7

SHA512
3ee82d438e4a01d543791a6a17d78e148a68796e5f57d7354da36da0755369091089466e57ee9b786e7e0305a4321c281e03aeb24f6eb4dd07e7408eb3763cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QDLIP.tmp\AdblockInstaller.tmp

Filesize
3.0MB

MD5
1228c03ba840482eac14e25b727f65b5

SHA1
eaa92be989ff71dc2b7cf090b2a8183a3c44e655

SHA256
a048ccbd5797616ed03ea8c13ddea2ec868e0ea22ecc6f475bf7e3ba42aa77b7

SHA512
77e874dc88b428c43a72ed8ab9e00e98872e9b47c4ad18f35019aa26c89de909448d5ec83a289ed87d8ddbea6e9515c5932973cf54ea3f535d7f2e11bc2318bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj9DF6.tmp\Sibuia.dll

Filesize
527KB

MD5
eb948284236e2d61eae0741280265983

SHA1
d5180db7f54de24c27489b221095871a52dc9156

SHA256
dbe5a7daf5bcff97f7c48f9b5476db3072cc85fbffd660adaff2e0455132d026

SHA512
6d8087022ee62acd823cfa871b8b3e3251e44f316769dc04e2ad169e9df6a836dba95c3b268716f2397d6c6a3624a9e50dbe0bc847f3c4f3ef8e09bff30f2d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\sib9ED2.tmp\0\AdblockInstaller.exe

Filesize
15.7MB

MD5
8d7db88f1fb9c7308f7368ae65e3f0ef

SHA1
5166ff1bb9b4b5d5f0ab460496cf7cc491f81f62

SHA256
5f81f8ee08a7460a3abd3aed1da137f2824bbdf804951477546a96300bd1e31f

SHA512
a620347b470c43f1d5d253a4899cbf89b1f9f631da35e5740d5134155e66a2c1756660ac9be21a6d9b5f830fa02461b3781db5c9cfe9d56b23e1454b198a7316

Download Submit
C:\Users\Admin\AppData\Local\Temp\sib9ED2.tmp\SibClr.dll

Filesize
51KB

MD5
928e680dea22c19febe9fc8e05d96472

SHA1
0a4a749ddfd220e2b646b878881575ff9352cf73

SHA256
8b6b56f670d59ff93a1c7e601468127fc21f02dde567b5c21a5d53594cdaef94

SHA512
5fbc72c3fa98dc2b5ad2ed556d2c6dc9279d4be3eb90ffd7fa2ada39cb976eba7cb34033e5786d1cb6137c64c869027002be2f2cad408acefd5c22006a1fef34

Download Submit
C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\settings.dat

Filesize
40B

MD5
50da08a682d04b60aa9d5414db34d08b

SHA1
3c8373b1c89b36da4d78a4d995aa0f0c58e9461f

SHA256
fe7dc2d84fb51f8f7737710404346ad038d28d7df9e831e6c71b6bd1c142e0ab

SHA512
b4929004e35bbdf87e3fcbb2d4ef62e58d30961219861d4ad703c7bbbc40b4b1a2918dbc3810823b840cc26a4d2f0b8a907658ce1e807a9138e83b583e35b2d3

Download Submit
C:\Users\Admin\Programs\Adblock\Adblock.exe

Filesize
5.4MB

MD5
c7119e2a05db13f4888321d28e215c07

SHA1
2040cf5a97a671e18aee7bbd78a9dce70235f8ab

SHA256
b10d464d5b329829a6ec5c5bca79d9e5e5614448bc8763cc51230a3b778b644b

SHA512
60cc31c7d054620ad2002f00d16e58728eb941ae9a8ad492d21207e916ce3e1cc4e16e9c130a084939d35ea6f2fbf9e2d5ad89f5dc31407c1e43c70a0974478a

Download Submit
C:\Users\Admin\Programs\Adblock\DnsService.exe

Filesize
3.0MB

MD5
97a08c6366f4589739209fdb43b4b3ec

SHA1
56b57f33d510de026207a8b37ea93db8447a11b8

SHA256
5d15b23e628be6147ea04df302b5a06ceb8420b3bfc41872e2f90b0511bc11b1

SHA512
d83e83d3c252622b13004c60bed56653c284462240553d12dfd22989fa2fdc34a06dc8b388f1fe2aded478542299356aaefc2e4691e8db396bcf7a9e65af94b1

Download Submit
C:\Users\Admin\Programs\Adblock\MassiveService.dll

Filesize
3.5MB

MD5
6bcbb964e1fe28513b22273f136a4b37

SHA1
fde4927b46bac2340f65fe2811c2307c798e2398

SHA256
10c027bdd8008ad62c7e3ab5abd92d2573bb9474a9ea8ffeb218b43a2efaab09

SHA512
6e587fda68bc9e9683f2bece39a5ff9357cccd12ea1e3669f8d7c675479b476f482de0e2fea20e7a0f4fec72abde7ec1b0beffa1eed79461abd006427d182fed

Download Submit
C:\Users\Admin\Programs\Adblock\MiningGpu.dll

Filesize
878KB

MD5
79cae1118a31818af31b388ee4808a1b

SHA1
9054393f36900ca638a6f58c31f6ed8b5e08ffb4

SHA256
8d8770fd885e0bb8a28fc96f31209f05d6b4db9b4036666bd5500d13b2faeb84

SHA512
0e320cba17c28bedc5bcd603c462bea62d658ca1aa6d8c954d1b68ae8597b8631ed20aa8754139702ae41d970458f681d4417c3caaa6e4e52a7dde4aeb6538dc

Download Submit
C:\Users\Admin\Programs\Adblock\SPCDNS.dll

Filesize
40KB

MD5
61e336dd16128398b546c70439c2bd3f

SHA1
4bb959d12c1184d64d439b3c21ffe8c4ad5ca5ae

SHA256
4f5160af8f4aa67f76613924280fb16da450c97eb657c871d9e42ec8a613acf1

SHA512
3506df990fdff07090d2f88a3aa56b8ea621dc412294b165dee532f7bbf40c4b00268f55a188e599df0d0d8151a644205104689716ebc78f40c83dab6a61a9e3

Download Submit
C:\Users\Admin\Programs\Adblock\SysGpuInfoEx.dll

Filesize
95KB

MD5
dc6723d0c1c83f6fa274d65d65a47962

SHA1
4f5147e4808ea4e7be6f6648f91089ed98ff3120

SHA256
2e27187fcd3e1216d20efab042151f4edbdc10d8cc3c2adf330c0b64ebb8cea0

SHA512
25464806174c060c4faaa23458f59d5f47d953232713238a7077f387fac97dd15dd8dcb34632131176341ae8e046d0320ed8ef87782322d623ed1f388a5e142d

Download Submit
C:\Users\Admin\Programs\Adblock\WinSparkle.dll

Filesize
2.3MB

MD5
e167dfd4bb292d7837f3c15bc8f6f7a1

SHA1
d56a8b15f1da113afda580f5b4271354bb8fa574

SHA256
1f64e24bb019f60755215e3ad1efd30926e1febe497f029a69b83cedcb0dac49

SHA512
cbd5da6ad4cd5682163b9035af56a0ca95773cd2902d7cbcef37a8c950d3a4b7df6b79864305e449dda47e48f1d4514c48da18fb2a99334269deeaf935947f35

Download Submit
C:\Users\Admin\Programs\Adblock\crashpad_handler.exe

Filesize
913KB

MD5
cd2e0167f2e1092816f04bc174c13364

SHA1
8015c003fdf94d5991902437d2e98ae2d7cbccf3

SHA256
bfb062608229199430bd5f729fde00147451c074775ee5bf0e2917f7b239df96

SHA512
2f64d56f2dd6ff3f4c334540338af223a9a05e50b58e988de112712fe429698393b0acc50ce61831e418b8d63e8029d47473777dc346135303b80ad753ccc4ab

Download Submit
C:\Users\Admin\Programs\Adblock\dns.conf

Filesize
73B

MD5
d9229b2bf6ea93565ebbeb81459025c1

SHA1
5b8af056d1a853b73ac94903edd1d6f167af8d22

SHA256
f975168980dc06d1f64400c045f73e13e4e68ab8f350aa23304924461cce1cb6

SHA512
ab8650d51b0606738001e70acb28f18a7b3a89445ba64f1264908e6d9cc6a94fa93d7b35377e817a5db98e8050c8c9942782ddccceb0c9795f3e05b5e9d4304c

Download Submit
C:\Users\Admin\Programs\Adblock\dnsService.txt

Filesize
1KB

MD5
3f8ef85d1b3ea16399b2c006b122925a

SHA1
0b2abdad9eea56e4cd216a545b463b014c11157b

SHA256
55ed23913912d658c0529e6014741d56bb27de2d5bfb5d2c6d61665c55acca59

SHA512
38bcc802b45d3c54aa22657b0a5f38fca1a7575a9c4d81b09d79b1196e439b5edf0408c90224bb07a825bd5b13a1ef371ff2dac8efac77c942faf92a7307223a

Download Submit
C:\Users\Admin\Programs\Adblock\domains\initial\adservers.conf

Filesize
1.0MB

MD5
c7183c7e129894d2634e14d86c2c9d94

SHA1
40a97a2d57daccd4ae455958be3f0c44aef12521

SHA256
1c288bd7a4bf7bf322f3c2949f65af3302019e93e7f92f211955a15c666a4a8b

SHA512
56a1add9de07eb49de8440f00772b211e382dc244a5cd9d5d4c7ae73cf56abdb2e76f3cdb1d81cc8d2cd0e21616844f20c9e24c9f3b21a46307c983a455b5e8b

Download Submit
C:\Users\Admin\Programs\Adblock\domains\initial\facebook.conf

Filesize
127KB

MD5
ba1435f50eb74c8a1ad64a75eb9d478b

SHA1
70ef49a54615637db396ddde8fb011bd62af1e4c

SHA256
5a718bc1916d74a426905484022551fa3ec4da678b0b1126f1d5cf674b42054d

SHA512
d73240e16152de66c5bd20a270528ac93d66d14e7458e753254767c37c7b292197e0fd1e3c4b4b44d91bf720c038d2df294b1ae1a5884dda45d4955b248fe9e5

Download Submit
C:\Users\Admin\Programs\Adblock\nvml.dll

Filesize
988KB

MD5
8b7acf836560a8e41423f1bb60a3b308

SHA1
3dbca75ddd19e447747865e227d456d7b0694281

SHA256
c2e049e90d23b692d1a01ca88d6d95c88b9c6d8cf0257314ae749c0c55906692

SHA512
49f75a2c9e18865a55fba824b777d0d418136a736d41db864af4d46571f5f285a60efb3aef24d129f50d2a23d3c78f6329545bc5b76c07073879de0cb19fb0cd

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
3a19121498aa4a500f33519964565b99

SHA1
a881fe7bce9804b653a087a073c97472ca27fc14

SHA256
e5c414ee59ffc5fe19bf968ecadd6271ffcd1fc22b51ef772dfcfe956579f9ec

SHA512
c70fdacebd725b43fe65f84cbf9d7ddf9e9c95919b58d772211b2aa9fc2f24639fb13080a8fb38a6688ffa95ca14d4855e882f8f92a346bae6c134db1cffafc9

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
bf5d067c2e0189b49536efaf81a28f90

SHA1
b8c917d8ec1c360e666a956b789edc247ed99eac

SHA256
b631670c5cc15bf98c8f5ee66aa4744884fe629cb1688b18e42bdf1fd6d3d8be

SHA512
4e22fa84d6dcc5c6f76048d247b745f6124ca3c4dd327958f551281afda8fecb2a45ee5f9db7bd81421c81962c7a1fa59c0bfd979f1858adb2304a680b423833

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
892B

MD5
4ec3dd5b6850cb4ee44eb7ebcf8feed6

SHA1
28643349eb3cce17948fbb37b1bdd29f25f4635d

SHA256
e923dcea74c962fb405b695297f4b23133b28bb3da2933c4b465e30e6357f676

SHA512
04c29d0a3c7f2b2cca2337d4ae65aa53adbd51fd0505d98b6f184286d9dafbc51e6e30d7d92b15753f74b5a0abd41421b6e570c39ca611ce9a8d3714b8f1cbe5

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
7bf1d52cd6ea9fb14ebdb280bc083357

SHA1
5d05116117fc498043ba4621cd613c18a8cca859

SHA256
2a69da131c0247c9e5402a4744ca69cc718d8770e69f3cd52191bf3a1dd949e5

SHA512
36bfc2bf861dda9f9f4715c2d1883c8deeeefa14b6b7603ae6b2ff96e70bb890f6d2dfbb4d606b93a8cc734a7ef95725b4c4eca12a429c3d783026ea7aa04591

Download Submit
memory/112-391-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/396-100-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/396-63-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2412-316-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2412-392-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3012-49-0x0000000140000000-0x0000000140619000-memory.dmp

Filesize
6.1MB

Download
memory/3196-56-0x0000000010B90000-0x0000000010BA2000-memory.dmp

Filesize
72KB

Download
memory/3196-57-0x0000000010BD0000-0x0000000010C8A000-memory.dmp

Filesize
744KB

Download
memory/4780-387-0x0000000000400000-0x0000000000709000-memory.dmp

Filesize
3.0MB

Download
memory/4780-137-0x0000000000400000-0x0000000000709000-memory.dmp

Filesize
3.0MB

Download