1eb1056655168a7c4ed81a07425f5f80c28c7f4448552923de1cfbd23188a4c7

Analysis

user interaction
yes
max time kernel
206s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AdBlock360Setup.exe
Size 736KB
Sample260724-rmh7dssbne
SHA256 1eb1056655168a7c4ed81a07425f5f80c28c7f4448552923de1cfbd23188a4c7
MD5 45c31bae4ec866546631dc8c2a72b248
SHA1 db58be0fb00f9b83f1ebba508ff046aec8d66265
SHA512 cdfd7b734378c394f826f673a9ace1d31740dcd2703e9ef3f12565df1abd411bf1f456c46bb751b935c6809f59d8ef313f7e3de1ffb132152e874460ec125307
SSDEEP 12288:fEoX5Mw6IOEXkSY4Cr23ph0lhSMXli3B1du5qSg:fE+MgOEUSHCS5h0lhSMXlkBXuYz
TLSH
T1C2F48C15F7B440F9E0A6C275896A497AFB727C8743A8974B03B0665E1F376980E3E331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	2872	MsiExec.exe
18	108	rundll32.exe
20	1840	rundll32.exe
21	4820	rundll32.exe
23	4664	rundll32.exe
27	1376	rundll32.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\AdBlock360nf.sys	msiexec.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdBlock360 = "\"C:\\Program Files\\AdBlock360\\AdBlock360.exe\" --launch=autostart"	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\AdBlock360\AdBlock360.nf.api.dll	msiexec.exe
File created	C:\Program Files\AdBlock360\AdBlock360.pf.dll	msiexec.exe
File created	C:\Program Files\AdBlock360\AdBlock360Updater.exe	msiexec.exe
File created	C:\Program Files\AdBlock360\appicon.png	msiexec.exe
File created	C:\Program Files\AdBlock360\crashpad_wer.dll	msiexec.exe
File created	C:\Program Files\AdBlock360\sentry.dll	msiexec.exe
File created	C:\Program Files\AdBlock360\write_test.tmp	MsiExec.exe
File created	C:\Program Files\AdBlock360\AdBlock360.Core.dll	msiexec.exe
File created	C:\Program Files\AdBlock360\AdBlock360.exe	msiexec.exe
File created	C:\Program Files\AdBlock360\AdBlock360Svc.exe	msiexec.exe
File created	C:\Program Files\AdBlock360\crashpad_handler.exe	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\SharpVectors.Css.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\AdBlock360.Setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA49703C111C4D7AB89BCC8320947A1212\SharpVectors.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\AdBlock360.Setup.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\SharpVectors.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA334FAE5AB246C2FA12C5EF50F0A0C27E\SharpVectors.Runtime.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA49703C111C4D7AB89BCC8320947A1212\SharpVectors.Converters.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8AF6CAD4734B30B87ABEFE414FBE1292\SharpVectors.Core.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF5A1AFBD54184145D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA22F10072C5468D4837623CCBC51761B1\SharpVectors.Converters.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA22F10072C5468D4837623CCBC51761B1\SharpVectors.Runtime.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF31A347DCE410F18DEE75CCED56E9B56\AdBlock360.Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA49703C111C4D7AB89BCC8320947A1212\AdBlock360.Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA22F10072C5468D4837623CCBC51761B1\AdBlock360.Setup.pdb	rundll32.exe
File created	C:\Windows\Installer\SourceHash{EF9E6FB4-9CD8-4B97-B226-6965F7A44633}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAF31A347DCE410F18DEE75CCED56E9B56\SharpVectors.Runtime.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF31A347DCE410F18DEE75CCED56E9B56\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\{EF9E6FB4-9CD8-4B97-B226-6965F7A44633}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA49703C111C4D7AB89BCC8320947A1212\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\SharpVectors.Model.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA22F10072C5468D4837623CCBC51761B1\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\AdBlock360.Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF31A347DCE410F18DEE75CCED56E9B56\AdBlock360.Setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA49703C111C4D7AB89BCC8320947A1212\SharpVectors.Model.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39257E4B5249C5EBD95923E8E37AE46D\AdBlock360.Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39257E4B5249C5EBD95923E8E37AE46D\AdBlock360.Setup.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8AF6CAD4734B30B87ABEFE414FBE1292\SharpVectors.Model.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\AdBlock360.Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA22F10072C5468D4837623CCBC51761B1\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF31A347DCE410F18DEE75CCED56E9B56\SharpVectors.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF31A347DCE410F18DEE75CCED56E9B56\SharpVectors.Rendering.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39257E4B5249C5EBD95923E8E37AE46D\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA22F10072C5468D4837623CCBC51761B1\SharpVectors.Rendering.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\SharpVectors.Rendering.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA334FAE5AB246C2FA12C5EF50F0A0C27E\SharpVectors.Dom.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8AF6CAD4734B30B87ABEFE414FBE1292\SharpVectors.Converters.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Rendering.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\SharpVectors.Model.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF31A347DCE410F18DEE75CCED56E9B56\SharpVectors.Converters.Wpf.dll	rundll32.exe
File created	C:\Windows\Installer\{EF9E6FB4-9CD8-4B97-B226-6965F7A44633}\IconFile1_AdBlock360Logo.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39257E4B5249C5EBD95923E8E37AE46D\SharpVectors.Css.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39257E4B5249C5EBD95923E8E37AE46D\SharpVectors.Model.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39257E4B5249C5EBD95923E8E37AE46D\SharpVectors.Runtime.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA334FAE5AB246C2FA12C5EF50F0A0C27E\SharpVectors.Model.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA334FAE5AB246C2FA12C5EF50F0A0C27E\SharpVectors.Rendering.Wpf.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8AF6CAD4734B30B87ABEFE414FBE1292\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\AdBlock360.Setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5C5D838F0D4430B954A0AF9F933055E9\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3EB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA334FAE5AB246C2FA12C5EF50F0A0C27E\AdBlock360.Setup.pdb	rundll32.exe

Executes dropped EXE 3 IoCs

pid	Process
2896	AdBlock360.exe
5860	AdBlock360Svc.exe
5644	AdBlock360nf.sys

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4100	sc.exe

Loads dropped DLL 24 IoCs

pid	Process
2872	MsiExec.exe
1520	MsiExec.exe
1856	rundll32.exe
1520	MsiExec.exe
5772	rundll32.exe
1520	MsiExec.exe
108	rundll32.exe
1520	MsiExec.exe
2696	rundll32.exe
3228	MsiExec.exe
3252	rundll32.exe
3228	MsiExec.exe
1840	rundll32.exe
3228	MsiExec.exe
4820	rundll32.exe
3228	MsiExec.exe
6124	rundll32.exe
3228	MsiExec.exe
4664	rundll32.exe
5860	AdBlock360Svc.exe
5860	AdBlock360Svc.exe
5860	AdBlock360Svc.exe
3228	MsiExec.exe
1376	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4BF6E9FE8DC979B42B6296567F4A6433	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AdBlock360\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\AdBlock360\DisplayName = "AdBlock360"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\AdBlock360\IconUri = "C:\\Program Files\\AdBlock360\\appicon.png"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\AdBlock360\IconBackgroundColor = "FFDDDDDD"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\ProductIcon = "C:\\Windows\\Installer\\{EF9E6FB4-9CD8-4B97-B226-6965F7A44633}\\app_icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\475BB96D335E232499B07AAFFB49254E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\PackageName = "AdBlock360-Setup_4.2.2.0008.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D69BB574-E533-4232-990B-A7FABF9452E4\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AdBlock360	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	taskmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\475BB96D335E232499B07AAFFB49254E\4BF6E9FE8DC979B42B6296567F4A6433	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\Version = "67239938"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4BF6E9FE8DC979B42B6296567F4A6433	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\AdBlock360	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\475BB96D335E232499B07AAFFB49254E	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\ = "URL: AdBlock360 Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdBlock360\shell\open\command\ = "\"C:\\Program Files\\AdBlock360\\AdBlock360.exe\" --launch=\"custom\" --custom-protocol=\"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\D69BB574-E533-4232-990B-A7FABF9452E4\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppUserModelId\AdBlock360	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4BF6E9FE8DC979B42B6296567F4A6433\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\ProductName = "AdBlock360"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BF6E9FE8DC979B42B6296567F4A6433\PackageCode = "FC37A7F3B2C9B2E489EE42221DDC97EB"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
108	rundll32.exe
108	rundll32.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4488	msiexec.exe
Token: SeSecurityPrivilege	1416	msiexec.exe
Token: SeCreateTokenPrivilege	4488	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4488	msiexec.exe
Token: SeLockMemoryPrivilege	4488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4488	msiexec.exe
Token: SeMachineAccountPrivilege	4488	msiexec.exe
Token: SeTcbPrivilege	4488	msiexec.exe
Token: SeSecurityPrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeLoadDriverPrivilege	4488	msiexec.exe
Token: SeSystemProfilePrivilege	4488	msiexec.exe
Token: SeSystemtimePrivilege	4488	msiexec.exe
Token: SeProfSingleProcessPrivilege	4488	msiexec.exe
Token: SeIncBasePriorityPrivilege	4488	msiexec.exe
Token: SeCreatePagefilePrivilege	4488	msiexec.exe
Token: SeCreatePermanentPrivilege	4488	msiexec.exe
Token: SeBackupPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeShutdownPrivilege	4488	msiexec.exe
Token: SeDebugPrivilege	4488	msiexec.exe
Token: SeAuditPrivilege	4488	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4488	msiexec.exe
Token: SeChangeNotifyPrivilege	4488	msiexec.exe
Token: SeRemoteShutdownPrivilege	4488	msiexec.exe
Token: SeUndockPrivilege	4488	msiexec.exe
Token: SeSyncAgentPrivilege	4488	msiexec.exe
Token: SeEnableDelegationPrivilege	4488	msiexec.exe
Token: SeManageVolumePrivilege	4488	msiexec.exe
Token: SeImpersonatePrivilege	4488	msiexec.exe
Token: SeCreateGlobalPrivilege	4488	msiexec.exe
Token: SeCreateTokenPrivilege	4488	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4488	msiexec.exe
Token: SeLockMemoryPrivilege	4488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4488	msiexec.exe
Token: SeMachineAccountPrivilege	4488	msiexec.exe
Token: SeTcbPrivilege	4488	msiexec.exe
Token: SeSecurityPrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeLoadDriverPrivilege	4488	msiexec.exe
Token: SeSystemProfilePrivilege	4488	msiexec.exe
Token: SeSystemtimePrivilege	4488	msiexec.exe
Token: SeProfSingleProcessPrivilege	4488	msiexec.exe
Token: SeIncBasePriorityPrivilege	4488	msiexec.exe
Token: SeCreatePagefilePrivilege	4488	msiexec.exe
Token: SeCreatePermanentPrivilege	4488	msiexec.exe
Token: SeBackupPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeShutdownPrivilege	4488	msiexec.exe
Token: SeDebugPrivilege	4488	msiexec.exe
Token: SeAuditPrivilege	4488	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4488	msiexec.exe
Token: SeChangeNotifyPrivilege	4488	msiexec.exe
Token: SeRemoteShutdownPrivilege	4488	msiexec.exe
Token: SeUndockPrivilege	4488	msiexec.exe
Token: SeSyncAgentPrivilege	4488	msiexec.exe
Token: SeEnableDelegationPrivilege	4488	msiexec.exe
Token: SeManageVolumePrivilege	4488	msiexec.exe
Token: SeImpersonatePrivilege	4488	msiexec.exe
Token: SeCreateGlobalPrivilege	4488	msiexec.exe
Token: SeCreateTokenPrivilege	4488	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4488	msiexec.exe
Token: SeLockMemoryPrivilege	4488	msiexec.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
4488	msiexec.exe
4488	msiexec.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe
1196	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4488	msiexec.exe
1416	msiexec.exe
2872	MsiExec.exe
1520	MsiExec.exe
3228	MsiExec.exe
1196	taskmgr.exe
1196	taskmgr.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4488	4552	AdBlock360Setup.exe	89
PID 1416 wrote to memory of 2872	1416	msiexec.exe	91
PID 1416 wrote to memory of 5928	1416	msiexec.exe	97
PID 1416 wrote to memory of 1520	1416	msiexec.exe	99
PID 1520 wrote to memory of 1856	1520	MsiExec.exe	100
PID 1520 wrote to memory of 5772	1520	MsiExec.exe	101
PID 1520 wrote to memory of 108	1520	MsiExec.exe	102
PID 1520 wrote to memory of 2696	1520	MsiExec.exe	103
PID 1416 wrote to memory of 3228	1416	msiexec.exe	105
PID 3228 wrote to memory of 3252	3228	MsiExec.exe	106
PID 3228 wrote to memory of 1840	3228	MsiExec.exe	107
PID 3228 wrote to memory of 4820	3228	MsiExec.exe	108
PID 3228 wrote to memory of 6124	3228	MsiExec.exe	110
PID 3228 wrote to memory of 4664	3228	MsiExec.exe	112
PID 4664 wrote to memory of 5860	4664	rundll32.exe	113
PID 3228 wrote to memory of 1376	3228	MsiExec.exe	117
PID 1376 wrote to memory of 4100	1376	rundll32.exe	118
PID 1376 wrote to memory of 4556	1376	rundll32.exe	120
PID 1376 wrote to memory of 5840	1376	rundll32.exe	122
PID 1376 wrote to memory of 2224	1376	rundll32.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\AdBlock360Setup.exe
"C:\Users\Admin\AppData\Local\Temp\AdBlock360Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SYSTEM32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\D69BB574-E533-4232-990B-A7FABF9452E4\AdBlock360-Setup_4.2.2.0008.msi" /L*V "C:\Users\Admin\AppData\Local\Temp\AdBlock360-Installer.log"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4488

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AB5616B246161A93793F39ED11665238 U
  2⤵
  - Badlisted process makes network request
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2872
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5928
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F17478B747EB07F8AD9D6DEA39AD5F63
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB37.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240848218 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1856
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1625.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240851078 11 AdBlock360.Setup!AdBlock360.Setup.CustomActions.SetOriginalUserInfo
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:5772
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1E44.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240852625 17 AdBlock360.Setup!AdBlock360.Setup.CustomActions.SetInitialData
    3⤵
    - Badlisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:108
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI276D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240854968 52 AdBlock360.Setup!AdBlock360.Setup.CustomActions.ShutdownApp
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:2696
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B8E75F6AF9D16A58E59D5D5F524B9549 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3886.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240859562 68 AdBlock360.Setup!AdBlock360.Setup.CustomActions.StopServiceWithRetry
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:3252
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3EB1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240860953 84 AdBlock360.Setup!AdBlock360.Setup.CustomActions.UninstallDriver
    3⤵
    - Badlisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    PID:1840
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI46D0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240863140 110 AdBlock360.Setup!AdBlock360.Setup.CustomActions.UninstallService
    3⤵
    - Badlisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    PID:4820
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5345.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240866625 136 AdBlock360.Setup!AdBlock360.Setup.CustomActions.UninstallOldApp
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:6124
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI67A9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240871406 157 AdBlock360.Setup!AdBlock360.Setup.CustomActions.InstallDriver
    3⤵
    - Badlisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Program Files\AdBlock360\AdBlock360Svc.exe
      "C:\Program Files\AdBlock360\AdBlock360Svc.exe" -dr
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5860
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7D35.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240877000 182 AdBlock360.Setup!AdBlock360.Setup.CustomActions.OnRollback
    3⤵
    - Badlisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" delete "AdBlock360nf"
      4⤵
      Launches sc.exe
      PID:4100
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /F /TN "AdBlock360Updater"
      4⤵
      PID:4556
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /F /TN "AdBlock360Recovery"
      4⤵
      PID:5840
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /F /TN "AdBlock360RecoveryLauncher"
      4⤵
      PID:2224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3392

C:\Program Files\AdBlock360\AdBlock360.exe
"C:\Program Files\AdBlock360\AdBlock360.exe" --launch=autostart
1⤵
- Executes dropped EXE
PID:2896

C:\Windows\system32\drivers\AdBlock360nf.sys
system32\drivers\adblock360nf.sys
1⤵
- Executes dropped EXE
PID:5644

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

AdBlock360.exe

Path C:\Program Files\AdBlock360\AdBlock360.exe
Size 20.3MB
SHA256 88e9fdee345d0caad39855103111b2ad3d3d57f957e48b6b0de3214d8c9489dd
MD5 f2ba4cd9a602e54ee8d8ed3311583833
SHA1 6533935eb1d9924a6e4c33f5bf1ee4b24386a646
SHA512 642b45163985753b49ae3452423c80f97043c9f79d2b5a4dd9da14af84372f206655bbfba2fbadc63aea97eed87135bd7f053bcb78b62d0857501f64d8588bae
SSDEEP 98304:2/2mC/I6OQ2asUKUMg3la9/eAFYfMfzEeKV44Bp2JuKm5HKx2cW:2/XQ/sUKeVkeASfMfgeKPXw2
TLSH
T1E3274A07E5F340D4C1A9D174C52A517A7A2138CE5B291FC7AA78A22E2F727C87F76360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360.nf.api.dll

Path C:\Program Files\AdBlock360\AdBlock360.nf.api.dll
Size 223KB
SHA256 5c6c20d74a1ef61909db042d9a95e8fb328a0ed14542fb0c0458366162bae136
MD5 3347e7cf4d9bb9dce689afa0975dcfef
SHA1 60eefd263161af89dbcf107dd8db5a1f8db30aa6
SHA512 d5f29db5d70c45f189f50926ad064167b9a4c2a05480f119a6d04fe1debf0c48ff0582a098b142a0780cef50ec3168b45caa006100d98715d5fc7e8e17e363a9
SSDEEP 3072:Hg8SzVfoewYyRCiBx12NYTR5o5Hbg7Z8HwvolKHrIOm9PRxc:rSREYJECCUbg7Zol7/vq
TLSH
T1C2247C1A73A404EAEC7B8138CD939A46E67238190B60EBDB07A08375AF3F7D1553E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360.pf.dll

Path C:\Program Files\AdBlock360\AdBlock360.pf.dll
Size 6.1MB
SHA256 29c620a07c32b760470375d2f61b0fcee0a86ac558364484141cf3789b53a61d
MD5 bd18678adb59712194f86c84b62580ba
SHA1 0a7a73dae4a7046421c8f38678f63c6e2dc3d787
SHA512 ec57e9428de8137dfcc3f928b163e12a63c55d31a3e70961649b65aadf829c5d8b46c5bf5e8ea4edf705bb72feacdcd125d08b1f23c9b8a38ad35bcd9989badc
SSDEEP 98304:IXOM2kM2Q/TJka67H/ZPnuu0+V+JY4soEwN:IXOM1Mf/TJkkzSa7soEM
TLSH
T1ED569D6AE6BC00A9D87AC57CC2836237E771746553B053CB5A548AFA0F63BE0673E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360Svc.exe

Path C:\Program Files\AdBlock360\AdBlock360Svc.exe
Size 1.0MB
SHA256 5520bcc272b0820883a67f65b6ee8526062db5c506309d677cba117bca555005
MD5 af7901e4fe3214c4a3c5021073bb9aa3
SHA1 f59354472e75272a34b7c83ed833d5e7de3a0867
SHA512 371f565336d7a12f986a54dd83adc1a026d7ffd6f27e97b318b99fbdb9a05d34fbe8ad225a153024f995957cdd55405d3804154e5b7efff56d932b1246643a1f
SSDEEP 12288:9B/zMi/XN6Iq5g6qFVE6ffHgIQgOB9jSBAi0hjPJ8PKzYRZnz3qpH:bLMiVPq+n/3HncB9jSBAvjPKCcLnzWH
TLSH
T149256D1DA3E801E8E1B6D5B5CDA64427FBB1784B07319ADF03A0965A1F236F05E7D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Program Files\AdBlock360\sentry.dll
Size 682KB
SHA256 ac970dab6ed30f60ec53339e74872a99d5e2f29263c70bf90943fccc7ef5ac29
MD5 1e08a59ff697d0c30bc5b86237b3edaf
SHA1 b3a4e0eb6b0a10f5ccdbead3279845eeeee5c73c
SHA512 51743052eacec6578222d547ac000d47b29f375b34140ef4d0074a39d515985d739c97b1c79e5de2315adec97d20b78c7ec103a67bcd839887f6d182396df320
SSDEEP 12288:xrRnSiJYyekKuUfDyrsaCR0XICjwat3XQ:xrRRJYn/dryr9CnCcat3XQ
TLSH
T1A8E46C6977A401B9D17BC279C9834527DBB2780607B1A7CF03A047966F2B7E48B3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

privacy.config.json

Path C:\ProgramData\AdBlock360\Config\privacy.config.json
Size 86B
SHA256 83120467a5baa477503d1f02dafe1d6b31fdbf863c6d4eb03e9827f538507d48
MD5 50dde604d502a35e09e51fe0aba56396
SHA1 46374d1d9b48e76e76ebe5ab8bc2171d8b15adb0
SHA512 3f208c6c869479ea424d1482b798c4ae91990f7978011ff531b1a4478f3b2365649789449d7230d0d22597c12c8478525f70d4d52e77fee6fdb1ba5777dc1add
TLSH
T1DBA012040249817CC887530433632F9C8C3500312C151D10308E020B883CBD31501713
MD5 SHA1 SHA512 TLSH

Submit Download

AdBlock360Svc-01.log

Path C:\ProgramData\AdBlock360\Logs\AdBlock360Svc-01.log
Size 168B
SHA256 7050a6579d8ddb521b82b5fb92eca07c003e2f452e22a01f1d1f9e738925e7c7
MD5 98327b39bad20cf88f873f3178bd2d66
SHA1 9ed21ed3b45026378b7a75354e75e93ced8ea651
SHA512 51c3a1d8b56426664ab74bc8ee5f651967701c93ef26bc9bb5b981d3dcff1ce3e8eca8bc1068bb3a5ec0f45b7116920761eebd92fba728e4157e668143e59e62
TLSH
T1A3C012D0C47849D326216081BD0605B94D96B499427B51A0E2E8C1844A5A959DDD8415
MD5 SHA1 SHA512 TLSH

Submit Download

UI-01.log

Path C:\ProgramData\AdBlock360\Logs\UI-01.log
Size 362B
SHA256 65f528e023deeeab5f3aec0d0871698602e3c4e15dff3e467cef566fdc48a408
MD5 a74649acce950e53420455a82a7d46f2
SHA1 29371a3ac79095e840a683b2119201dad6aad6cb
SHA512 2fc3eb85388aa0b9bdf2f2a06a00be5c5a08d39fd1f830382ebbab76316af00b1cba55441fcac1f9e85bf6a53a34f6dbe0e99da0e1a2355703b4aefcafa543f7
TLSH
T132E0619581F902D01F4374459D07228C135859E750E3E29463FC815016EBC9FEB9A117
MD5 SHA1 SHA512 TLSH

Submit Download

AdBlock360-Installer.log

Path C:\Users\Admin\AppData\Local\Temp\AdBlock360-Installer.log
Size 27KB
SHA256 24211ae27b60a67678b7ee03e756dbe49d08a4fe41c806a063779f694f00437d
MD5 6a0df1a9c790031fc75fc5f6d2e0ab00
SHA1 5fa25ce1398d0a258372aebfa8ca4c7cb3635e33
SHA512 b5b1036a11d311143b4e115e304c0c5d4ff2cb56e8d0b7e4f8197645c90409334ea6c0b39cd92d90843cdf2d5184a2f90930bc0616e82be7f23c7bbf37f5c387
SSDEEP 768:n63OCq1sJgDItmV/zFHFCJxtRa3Md/Wa/GfKX2/iLW8SnGYK8RFVlS6S5S1bYXl6:QbA32hYiy9D28bInfQXvGLRMhoF1MVN3
TLSH
T1EAC2052A3BF41149B3B7E747EEF344229A77F91A6935D90D10C2820905A3D06B96C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360-Setup_4.2.2.0008.msi

Path C:\Users\Admin\AppData\Local\Temp\D69BB574-E533-4232-990B-A7FABF9452E4\AdBlock360-Setup_4.2.2.0008.msi
Size 31.7MB
SHA256 7511f5730714772d5e9b911eb58dec3e649d496cf0fbb77d94f949acb52da9e4
MD5 967ebd0077f59b913c3497108f713baf
SHA1 953207882eb63f02145225bb6f9f67e629154c5d
SHA512 ca9e84ef192590bd6e588847a5ef65b6b9a0c9253d28b94c04cbce76f401ca4ab85c4430f050555160876506ead45f461db6d128723d1e843b818c70d4c1083d
SSDEEP 393216:EnDdtw3CY7tulztymh9vtfHSbHiiV8ANAxiPHN1FdOA0PWf1DYC+y+dZl6+tlyLz:EnDgAy0dtfiH9j5NBOpWf2pNILmgYy
TLSH
T16A772207FEB48AE5D8214931497E07FD7D2368C306AC819625B0632FDBE66DC46B66F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedUI.config

Path C:\Users\Admin\AppData\Local\Temp\MSI2541\EmbeddedUI.config
Size 980B
SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
MD5 c9c40af1656f8531eaa647caceb1e436
SHA1 907837497508de13d5a7e60697fc9d050e327e19
SHA512 0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7
TLSH
T1E2111C2C85E4F92B9A325A533A208896EFB0A1B2A174510CB09FBA170F720CE8257325
MD5 SHA1 SHA512 TLSH

Submit Download

WixSharp.UI.CA.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI2541\WixSharp.UI.CA.dll
Size 2.9MB
SHA256 a837b5adeb091b6378bb6ccc0aff668443adfa553a46464c2181cb4c35485428
MD5 bdab98c59e94023cbcea914f89658631
SHA1 047add21ba0367a878f482137866c0c5a7d4a883
SHA512 7c4389af5d9e342b07d5d0aa83da19bccd28bc94176709530c8689758dfde6e3f81f124f46cd8a29d7472faf3bc97f82ec6baf383a3ccde2f958d9354021f52e
SSDEEP 49152:azE27FKHGyoSJkVU4zKCfbeOIAC6xmA/KZRfHIm2t1up5LABGHP76B:8hhyoSIzIAC6xLS8FtEP0BGHD0
TLSH
T16DE5334677B50D62ECBA5235D5278A056AB1BC020B30F7DF03A0966AEF3F7D48936712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1625.tmp

Path C:\Windows\Installer\MSI1625.tmp
Size 2.9MB
SHA256 0a988ebd50c3200d7927dd6c8dd156c33587ef7a80ff38da3d6089a0d9443a24
MD5 f4eaae7e87e04344b55448224a0131f7
SHA1 4e96d39f75419e4b10b1710aab202c7fe3137d2a
SHA512 7e23de91b51c16a2405d2f89d71fd54dd1439211106303047c6609e4edb85e0ecea77aff15bb5f77823d598027223630500676fb8e767156ea768a90ba727ba1
SSDEEP 49152:sf08NFKV/uGCsoLSHlLRWsda1QQd8CbKBIvdCFYmRKjbSsYT:f8zamXL4l1eQQdvKbYk8YT
TLSH
T1A7E5335467F80476FCB3843A8E26868BE572FD011B31D69F1750131AEE7B7E09A72722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB37.tmp

Path C:\Windows\Installer\MSIB37.tmp
Size 2.9MB
SHA256 7783c832f58ec13be0cf437499b1ca1c4838b3e53a4688f3953a6f2045c7adf2
MD5 a1080d4baab11348915ea5df974c6428
SHA1 e719d6f96614adcc28dac77c87f0a0949ce28135
SHA512 82b470e7bdb146559dcf40d87949e3c9250b68c2b63aebd2e6f32898b25592b0b29ecafbfce2c3349701ee1ed1392049785aac994a51dc5a341a91401b6159b2
SSDEEP 49152:8CQp0Av4nvqC9Tm/C71IV79qA0wpp/XtRs3LglBSuW/HdyRjYJKXuG2romh2jJ:Ov2QC5U0S/XwslLWlLzGEh8J
TLSH
T185E5234537B80EB9FCBB52378972061096737C529B20DFDF1390455AEE2BB91E039B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360.Setup.exe

Path C:\Windows\Installer\SFXCA19F38154634BC10A62D051EDD6BC38EA\AdBlock360.Setup.exe
Size 3.8MB
SHA256 26e9d69d5eba1e1dce1d2bee8b8ae652f1a556b72988b9adfaa7af986a0500dc
MD5 51c61ea43f385c9bfe7071bcc27f8b8a
SHA1 567dcf456eb19997f3f3be68975c99e6e2d1c8d5
SHA512 79c2b750322eecfeadefaf99019ca3d9591bd548ecbb47c80d43d94571483e64a201082337d4f08ae0a51bcb23d05d86783aea648b2449d51fd5a4cea67be96b
SSDEEP 49152:CEfq2+bbRsl5fblb3oy9OXKcDOEOrAaZC0:RN0CuzZS
TLSH
T1F6061804E6F4E595EABA5A35683C05BCBE33A8C3149DC61935B8477F1B6278C48723B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360.Setup.pdb

Path C:\Windows\Installer\SFXCA334FAE5AB246C2FA12C5EF50F0A0C27E\AdBlock360.Setup.pdb
Size 83KB
SHA256 4c465cdd4696a4e82ca9fd38bac55928800a9d8ac044ab1c162575802b3943c6
MD5 9bfb9f168b1052b7f346c5c1848ccd4b
SHA1 92eb45a66380448abf92fdc51ab3f795912611e0
SHA512 41e54e0858065fb270311bae144099661d630226877506386a63db0fdd3d3ba07a5f3f0ffe77cca3ac96c228c6a347b89533621b329e4ebca1cd43fbd04257b6
SSDEEP 1536:sqnj5ksT0YV2W6jQJWEpXEpprtgldL3VoSzJ1kG83/VC0oweY7zIQopxrG:HnusTKWyhEJEpJtsFaSzJSNC0FREQR
TLSH
T120839D5BEBC8990AEA62697A463302517731F25C9142CF47729EF374E4973084AA37DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360.Setup.Core.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\AdBlock360.Setup.Core.dll
Size 53KB
SHA256 d89e160f694ee5798204f201924be3470e9273c927fbe345f3f9eb35e01b5008
MD5 477aa7513b13eea62cd3b15f4b75d76b
SHA1 871fdbaf2d3f50a1cda760f82fe7a61c97c5c649
SHA512 21501210e34b4c037ec1d4e7bfb13a2a4ab0dfca12963776a715801512a5d254d921b9fafaab4b27248458a8b0ed7d11084319caf2e782e1097401990e55b56a
SSDEEP 768:qdTqBcfAVSXIaypNjv/JRs+E6YhiM8w8Rtnyea7MwYiNH5ALXX/:qdTKc4VRpxJRs+MD8w8Rp3WMw7qX/
TLSH
T116335C416BF84114F6FE6F74BCB086298A72B9871D32D78E1684415F1A727C4AF607B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpVectors.Converters.Wpf.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Converters.Wpf.dll
Size 154KB
SHA256 8754ec79375e0f11370b8fa59eac5c16aa6324f09961b07020fd357836f5457e
MD5 abf11d30cfbbbb4a3f3506f602b931e4
SHA1 52b57ae0f60bdea701c1c3ade866e716e26853e3
SHA512 42aca6646170f4c9171cef09b0f7c607f936c5f520e8bf67c5cb2d76cf5a789150d06e1b454f01a18d2652c4f4fb734637282062fa0034dd1a5b2067228d5b3b
SSDEEP 3072:zga3ecshorHjfeN2TxFZy0cuAMC8f4T8TGsvCR:898ScxFZy0cuAHDR
TLSH
T127F36C5523BC8F0BD66F4BB9F8301A680B70D253E593EB995D91B4EC0CA33919B017A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpVectors.Core.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Core.dll
Size 193KB
SHA256 8f9b3f1bb7af71834a2118551cee01a6a8636be2dd550f6b0ec9842d7a494ef1
MD5 18c7ea0ce609dc0f99e8718889db49b0
SHA1 671c5a95325ce42815002392a8054c1567245e95
SHA512 0b4662cab8a86a0b05f08376cbd5ebc78a49eb4699821a26e2076b7484be99d6c82cb163f74cd774cfdf9b9e73bc43c0e7d9b68e74e74910f8756061318d3093
SSDEEP 6144:3NChoPhvagKvoLpJxgW2M9QNo7ZEHM05mts:37vfuSHo
TLSH
T10D14F72A63ACC13AEDEB0A3CBC70683C2B7DF706294EDB6F19545C2D5867F914054A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpVectors.Css.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Css.dll
Size 102KB
SHA256 ebf68199b71da9c2fd7e4f267f347d16e37cfe0e9625485af99d50ae80edb141
MD5 809a065c888244c3d100aabe6ef5cafd
SHA1 1e4f6290af922f0668baeec75dd4f0ffced4f1ca
SHA512 c717f98e6a790de301031d7e930a42faa9b32080f7ad5dcc1fe89125e3d3ccd4c0c84cee93010ae4d3c6064b55954cf7bfebfd39f52ca7ff8885f4ac52330868
SSDEEP 3072:wmwgEiGSdwjS4wavi1fZnaXPPicpT9bS0wL:EyfPJ
TLSH
T1EBA318297BA96D15E7FEC638B8B040098BB6BA9A2D33DF5D1DCC51D81A337444A10F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpVectors.Dom.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Dom.dll
Size 43KB
SHA256 411ebdbe60a93f8dc76c8d0c105af3a0583943c062fc0003174e5ea98adce6bf
MD5 87aa2245fe917240fd935f64062f41f5
SHA1 87e07fd6b286c498337ff240f44e388ef97ac72a
SHA512 5b06c2f5786e2d2e0dbfc62bd23b104d41f3b3a2b678f794ba43e625561471466c255e61189a431cd69e398f60d6ff6f297978f7204a4c3aef59f84c5429f62d
SSDEEP 768:wf2MnttCqTihbi1CVMCdCmgdh7kCWIGd+kAZnt0MsGSzawpD446kkQwdHWSUIBAk:wf2KCqd/NWIGxAZOXb0PBAnW7X
TLSH
T12113385C07AC2A3AE7AE0238AEE2120107B1E59F78B3D7575FA8D3353D107892E51397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpVectors.Model.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Model.dll
Size 1.0MB
SHA256 3cbb3df40c05bf2938655aa6e49e71569ea6498ee8506eefb497921fefede902
MD5 cdf390edece2cb5736cb5cc6432fd634
SHA1 2feff43994b99fa54f9381c250cacfa0657f770f
SHA512 a215eb5fc0377e45a7ebae9ddaafaf8fd3248e0317979d47bc96364f518715003658ccfe2aaeb26c3ac37cda55cca118207627e3b89e9eb9ca1c9d54f28f72fd
SSDEEP 24576:S/b3TsyZ3OXKcDu/oG/epqwV1jnQxZdlCG3pFb6KtXX2nrfSNT6v2q6wv:gb3oy9OXKcDOET
TLSH
T1EC35C6016AE93522F6FB6E7A68750814EE31FC572829DA2D31DC415F2F73B1488633A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpVectors.Rendering.Wpf.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Rendering.Wpf.dll
Size 244KB
SHA256 2b4c95468c71bf996be8d58cd3f2f1461e8c5dd33abc9c6f3bd2425f70a8a42f
MD5 dd6ac27d67751b663eb712bfc2451e05
SHA1 a60ab9b71857ceac0851a03af25780626dc83018
SHA512 86bee31cda51b5a9881f51a32cbeafc688c6df2dfdd490d2f939ce0bfe272b1ed21bf60e6ebee2a9d188b0f90fd3e177ecb73ef9e6459943196076055e5b4f5e
SSDEEP 6144:Efg+58E7EmembtrAr/GLkS8GpnKjtrd38KwjMCUCH:EfggbtrAr/Gx/4jtOgCDH
TLSH
T15D347C1867A88F29DE9F827DF43814184BB09703D29EEB898D9065FD1DE7380D7493A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpVectors.Runtime.Wpf.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\SharpVectors.Runtime.Wpf.dll
Size 81KB
SHA256 e08bb419340e7e5fb65009635ca9b92f32b40da2679aced2a55e031937691fa6
MD5 77b1f53b10568c4d65843178ad87a115
SHA1 e6cdac712248ba94f2bd5da7a010a320a18025e7
SHA512 0ebb86b0896f61b9bcfe3fd5afd664991102fc5b97b4c2b7fc331f285fa2154a2556bf2f11feaaaf7982a069bacc669ee0f0bf246f3b14fc1040e7b93fae2094
SSDEEP 1536:2TsgahY5BkfbMUmAx2NjgG9Ya6brKkiYdxhg8JL97b:h3h6Uj299YHrPxh/Jh/
TLSH
T183838C6D67788D1BCFCF4ABAB4611B105B30E6872253D78A3CC491EC6AD73920A513E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.UI.WPF.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\WixSharp.UI.WPF.dll
Size 75KB
SHA256 f16e6194310b54d08ffa0eb3c85cacf2f3c3c3b7b397a0e3c05303abf2228e50
MD5 f54950c828625929f67163133bd98adb
SHA1 3a9aa27f7ef8eb3165b060984f3da24a2fb6b366
SHA512 9d3b34a82516107ee414aa63939774425983aa8ed8c5c254f64413cf0ad0c7e3b285da39c82b90ae56003ef78f0b3e05aae022de74d697ec11fe52afb42423cc
SSDEEP 1536:5aiAWpI5su+h+I3i8KR7GXSiJWE999mGAEvKADEmKXIemNEmcwa+ymygnmybUmym:5ai2s3h+I3i8KR7CSTEf9mGAEg/h+Geh
TLSH
T1CA736D157D6C863BCADB4B72A47252919F72DB866701CB8E58ECA0DCDC123439B123B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.UI.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\WixSharp.UI.dll
Size 710KB
SHA256 70a8673832df85ef76e6dfcf4f49f453c63111d4ab558f3d9cf9bfcf3f43510d
MD5 1c6be9c242b9399ba8b4cce1dd4f7b82
SHA1 39a8a110a92e06f28af3270fb53caafdc982c011
SHA512 fe7b0a8c2ccf78f9115d1c7b7697b8f5068e18ab97880239a6ba93f2bca9f718ccdbdd6152c7fe0beeacc9e62273b2a279add34c15138f0cb200572de43e8fde
SSDEEP 12288:rVIM4+neTk04KMnSuOlK7QLggsdZvm45tWstQ7XG5sft7IFNeie6tty8X:xIKuk04tSjKBZvm45t5Q7WWFM2stty2
TLSH
T16DF4D0097BEC5E29E4778670B4A001590335C19BC737EAFAF88505AA06DA731C6B3F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Mba.Core.dll

Path C:\Windows\Installer\SFXCABBB21869EA4FC99AB07647C44B22246A\WixToolset.Mba.Core.dll
Size 165KB
SHA256 e9002b2aa130d682df9242c479e20ac54b7a9b00c11ed75738ec9b12648a78e8
MD5 1e43e0952b5cc4c73245acad8114ee63
SHA1 c2b3b179555ba569ebfd9ddabd776d3151ea114e
SHA512 2e283305c038e36d4c9b0db00f20df88624b51dd7345f43eb992fd1671ce67c9a63067445ed90d88ff6276a608f2ea2ef8bfe7c0bda5e1043786df024a71b7ef
SSDEEP 1536:t/L6YAFEWyoWhoDYszYG7FW1o5oaOfZVYTA/hy2H/No818ywNDPQ0mTpy0pfVaBu:1qzYZ685Vo818ywNzQ0OpPunsBYAPxxf
TLSH
T1E1F3E629039CACBDC68A0F3DA0D1847586B4EB1D58D2E3A69A01FBF73523F941D135B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.dll

Path C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\WixSharp.dll
Size 674KB
SHA256 230e841abef84b6d8d15c6ed7998bcd7bc899860d086afbcd90aa9dd7a334802
MD5 80bf07d0e562ff03501099ded2f7e9de
SHA1 67a2fd3ab2521c5c0b3869999291a364973b5f8c
SHA512 45e9bb13e588499db105f1a6e488005df8ce8df476f59d3be417c58c3353f8694a22a9e8ca6277d93336be660c53247dc3cef22a585683c312964e0703da2e3a
SSDEEP 12288:USW6w7FOkdJs/fNf+BloJVhKdTNtT3f3zWzbIQQC3phEkDGR1JuARz8vjtWHONuN:a6w7FBDdacVpun/FJn4yR1YjP
TLSH
T169E45B0163E88A27E6BF1F38E47151150677FC16AE31E79F499894AD4FA3740DC20BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCACC9A4BC12D4EB20A365F642C06D1ECE8\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 bcc548e72b190d8f39dcb19538444e2576617a21caba6adcb4116511e1d2ddee
MD5 b82b13d16e7f3d3607026f61b7295224
SHA1 d17b76907ea442b6cc5a79361a8fcec91075e20d
SHA512 be8c0b8b585fc77693e7481ca5d3f57a8b213c1190782fd4700676af9c0b671523c1a4fa58f15947a14c1ff6d4cda65d7353c6ba848a3a247dfcda864869e93f
SSDEEP 3072:QLxw5Btsb/b3xYxGI65OdtHMzBTx8j69UgoTqdzjDCnfKlRUjW01KyIEjZpjWja9:QLWkzBuGI0b8j6jomdCJjeU
TLSH
T1E4149D2953FC473ECEFE8778E2654252D7B2E1E67103D71A9C8281A62163384B792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IconFile1_AdBlock360Logo.ico

Path C:\Windows\Installer\{EF9E6FB4-9CD8-4B97-B226-6965F7A44633}\IconFile1_AdBlock360Logo.ico
Size 360KB
SHA256 783defcbd21f145a0f7d869ee945237557da6c7d97e76b46d83d4974ca8d8463
MD5 2f2f45af3cc0699f371dd207f7173bbf
SHA1 0fc42fffa6de6388bed4065200532d17ff3cf737
SHA512 668ee3894613093315050c7a50ef659f41c18390cfa44c6a11ac8e2c29a7747f93abf0f5ae95c555830edb93597eddc52b336c9cf5f3b899d6c59eab9a73ea2b
SSDEEP 768:tF1Ae+20p5HchzDU2Ft1DBFVm06nC1kHBe/9Oo9QiBTy/AgiYpVQvSjFf5hqV:nMjHq+C1pOo9QiBTy/AVYpaMxhqV
TLSH
T11F746748DB3CD5CAE2A9ED7969BD49FE7E2B60D742EE054029B0133FAB514CD40B80B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdBlock360nf.sys

Path C:\Windows\System32\drivers\AdBlock360nf.sys
Size 105KB
SHA256 0a3f93ee4edb384ed0378d402d3cfa280f20fcf91d99a71d128ceb6cb07386bf
MD5 ec9b5c97addc28191d1467acc8c7babd
SHA1 2f6349d7df121120e243bd9596a39e6c7e7a52f9
SHA512 3f7a498606f7230e804ec136fa1a30b8427ba01cd10fd4b6ab681230c78035ca36dfd7fd3b8c7fe17c1e602b5cce65da5cc880b49536344355ad4922f127ab06
SSDEEP 1536:L+CKwF8Eajnd1d14uCAXXqXC8SshZZYN5D5qVKf6+CRZsULuJwjz:qCPFVahbbqXCtsviN5dMjTtLd
TLSH
T127B33A6763A410D8D5BB81BCC6A69907EBB2B00527216FDF03B086425F33BD96E3D395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b45f70724672e24cbbcb5415eaa6e6eaebbf9c6306954bb4dc71581ef0afce62
MD5 a162243630d0b1bb12e1c501c2d96fe6
SHA1 43b3d8a9d59882e72c4a5fe568703ac3f58cd3e7
SHA512 2378ede73c72ceb8526ea8f7a2558834635c0d149a915febc8ba3912a1f15059d9ab0c6e62c29c209b13b30c7caa0d0c1e5e5083ab195fd0ce7b6a5157206714
SSDEEP 24576:2Fo3DMPndoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGu0:wHA
TLSH
T1E457B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2a6ee770-399d-4dbc-b3b4-cfa513e51de9}_OnDiskSnapshotProp

Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2a6ee770-399d-4dbc-b3b4-cfa513e51de9}_OnDiskSnapshotProp
Size 6KB
SHA256 dd72491f7cadb1e8af17860442abed93db4b840957018533f8d2fdf3c3f1a6e2
MD5 afb89d480e901ef076e7181128391608
SHA1 4ec630e753852b87c97ff09abbb964a304ee7d7d
SHA512 47952ded7632a6160622d024905624b09f60747d66cc6c082e61deba14e33391224779ddf302c6e544c0f05986fd3d77db48b4333f3a1eba020476bde7438960
SSDEEP 96:FJaZlevc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Ta2b++uVm
TLSH
T1DDD187185AF54711E2B3AB3129F18557A837B911FF33CB8E0198238E6671A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-463-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1196-462-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1196-461-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1196-460-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1196-464-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1196-453-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1196-455-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1196-459-0x000001FB4EB20000-0x000001FB4EB21000-memory.dmp

Download

memory/1416-74-0x000001B713290000-0x000001B713C34000-memory.dmp

Download

memory/2872-50-0x0000027042340000-0x000002704236A000-memory.dmp

Download

memory/2872-28-0x000002703BC90000-0x000002703BD3C000-memory.dmp

Download

memory/2872-42-0x000002703E340000-0x000002703E36C000-memory.dmp

Download

memory/2872-46-0x000002703E370000-0x000002703E378000-memory.dmp

Download

memory/2872-54-0x0000027042370000-0x0000027042388000-memory.dmp

Download

memory/2872-38-0x000002703C180000-0x000002703C192000-memory.dmp

Download

memory/2872-36-0x000002703BDF0000-0x000002703BDFE000-memory.dmp

Download

memory/2872-32-0x00000270239B0000-0x00000270239C6000-memory.dmp

Download

memory/2872-30-0x000002703C210000-0x000002703C5D8000-memory.dmp

Download

memory/2872-45-0x000002703C770000-0x000002703C778000-memory.dmp

Download

memory/2872-56-0x0000027041900000-0x0000027041940000-memory.dmp

Download

memory/2872-43-0x000002703E430000-0x000002703E4EA000-memory.dmp

Download

memory/2872-26-0x0000027023A80000-0x0000027023B36000-memory.dmp

Download

memory/2872-24-0x0000027023610000-0x0000027023644000-memory.dmp

Download

memory/2872-58-0x0000027041860000-0x000002704186E000-memory.dmp

Download

memory/2872-60-0x0000027042600000-0x000002704270C000-memory.dmp

Download

memory/2872-62-0x00000270418E0000-0x00000270418FE000-memory.dmp

Download

memory/2872-52-0x00000270423B0000-0x00000270423E4000-memory.dmp

Download

memory/2872-48-0x0000027042300000-0x000002704233E000-memory.dmp

Download

memory/2872-44-0x000002703E310000-0x000002703E32C000-memory.dmp

Download

memory/2896-343-0x00007FF71FE70000-0x00007FF721317000-memory.dmp

Download

memory/5644-390-0x00007FF7DCAE0000-0x00007FF7DCAFD000-memory.dmp

Download