01ce8ca0ed3ab43fa9b5a164a9f86f2d2a4f08b95c773212d2ea66bd417e4718

Analysis

user interaction
yes
max time kernel
49s
max time network
28s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Icon Changer V 1.1.exe
Size 648KB
Sample261113-t96mbax18l
SHA256 01ce8ca0ed3ab43fa9b5a164a9f86f2d2a4f08b95c773212d2ea66bd417e4718
MD5 96ebe818009d8a4e21f4b7d94044eda9
SHA1 fddad5b12e3cfe2a71a152a78a99b2bfe57c3dfd
SHA512 3cfd3a759963da551b143a90e9aa5331f1c49f8fd14086c8083d447ef10e53018592c98f5fbeaf50f0687745d9fb40fb8f1af044589abc5931a96825957bb23e
SSDEEP 12288:EODDJ//HqjDaDL/UY6xj9ZJ//HqjDaDL/UY6xj:SDa5OjWDa5Oj
TLSH
T105E49DD2F6881217C538613A418FDB635367CFBDA611CA0371E5BD9B3F5B2032A2265B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Colors	Icon Changer V 1.1.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	Icon Changer V 1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f00aba36ff8d270c74f9c99fcbf05467f3a0000	Icon Changer V 1.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Videos"	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\NodeSlot = "5"	Icon Changer V 1.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Icon Changer V 1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Icon Changer V 1.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Icon Changer V 1.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Icon Changer V 1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\MRUListEx = 00000000ffffffff	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000020000000300000000000000ffffffff	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\0\MRUListEx = ffffffff	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Icon Changer V 1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4 = 14001f0005398e082303024b98265d99428e115f0000	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Icon Changer V 1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0200000004000000010000000300000000000000ffffffff	Icon Changer V 1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Icon Changer V 1.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\NotificationData	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Icon Changer V 1.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Icon Changer V 1.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5	Icon Changer V 1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Icon Changer V 1.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Icon Changer V 1.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Icon Changer V 1.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3336	Icon Changer V 1.1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3336	Icon Changer V 1.1.exe
3336	Icon Changer V 1.1.exe

C:\Users\Admin\AppData\Local\Temp\Icon Changer V 1.1.exe
"C:\Users\Admin\AppData\Local\Temp\Icon Changer V 1.1.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3336-0-0x00007FFCAE4CA000-0x00007FFCAE4CB000-memory.dmp

Download

memory/3336-1-0x000000001BCB0000-0x000000001BD56000-memory.dmp

Download

memory/3336-3-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-2-0x000000001C280000-0x000000001C74E000-memory.dmp

Download

memory/3336-4-0x000000001C7F0000-0x000000001C88C000-memory.dmp

Download

memory/3336-5-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-6-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-7-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-9-0x000000001C9E0000-0x000000001CA2C000-memory.dmp

Download

memory/3336-8-0x00000000013C0000-0x00000000013C8000-memory.dmp

Download

memory/3336-10-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-11-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-13-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-12-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-14-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-15-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-16-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-17-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-18-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-19-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-20-0x00007FFCAE4CA000-0x00007FFCAE4CB000-memory.dmp

Download

memory/3336-21-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-22-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-23-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-24-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-25-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

memory/3336-26-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads