hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/RAT/Adwind[.]exe

Analysis

max time kernel
150s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240319-en
resource tags

arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
submitted
23-03-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/RAT/Adwind.exe

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

32 raw.githubusercontent.com
33 raw.githubusercontent.com
34 raw.githubusercontent.com

flow	ioc
32	raw.githubusercontent.com
33	raw.githubusercontent.com
34	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133557070833810586"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3144 chrome.exe
3144 chrome.exe
1120 chrome.exe
1120 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3144 chrome.exe
3144 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

chrome.exe

pid process

3144 chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3144 wrote to memory of 228	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 228	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 716	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 5104	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 5104	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe
PID 3144 wrote to memory of 1996	3144	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/RAT/Adwind.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbca3f9758,0x7ffbca3f9768,0x7ffbca3f9778
2⤵
PID:228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:2
2⤵
PID:716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:1
2⤵
PID:2428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:1
2⤵
PID:4080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:4224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4916 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4852 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:2908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3776 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5368 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:8
2⤵
PID:2980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1840,i,621462791758447111,18064913436125608493,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
8d5c7b5e0cef81acab3ae0d5aab0b5a2

SHA1
b3a8d1d6af9417f64048876aa80854d7672bc43a

SHA256
87f838b8447b065b05979d778e484c76e0c3aa17d68def3fbdb49d76cb4355a0

SHA512
f580c5109c5fc4c28a41a9a53d3148420d42d568693303917f60a246109164baa8d189efc85a18317c9758708ab10f3e6b863dd99ac9598e3f7d57049adac267

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
987B

MD5
d897de3ed8f855c7fda29ba7792886a4

SHA1
0637ca7fba554e294e9ddeae71f2817185390120

SHA256
68531a19147c440623b64d5c2f1e087b3b67330ecf69f3d060c5058f8497dada

SHA512
ae779d04076333f5706e67b821dd857289fd9278f58d3d91271860015d3ed7fdf430b9fd0ea24bd8d8a418dfc0c4e4c964bbe3cef850793b1ceadbc6cb11837a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
987B

MD5
3537a36e3343f2e3809ca4421f1a7e07

SHA1
e534f439c78210c18ba86a1706f024103a25e786

SHA256
bb4ec04e4eb6483ad4c68aec8ceee915d42d0faaeed78d4ca94fcddeba35adb9

SHA512
a942d168910695723587e27f152e9686e1dee522d95c781e0fc794afae4c644a9bca718f4a5d7fd3ac39ab65ce494d32102b175463954a34726da433695318c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
6c5ba6c15570bc67439d5e0e2a97d878

SHA1
4c1fc61bdee287b9c836b346c43d0a0d1518a3b3

SHA256
2c6238e9a1199c6e992aad9488a504d654afbf97c91543d33cd5c97662365712

SHA512
17ace0eee8160b17cdd518a829799f93b415327cadc8aaff2e4c16884f5e2d1cc5cfd06b6dce013159f112d380bf2616d23fd538325f3e1fc370ed35ecc549c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
406f9b991593ada8465d80318c5e17e0

SHA1
578106abf82e53ef521f5a61cdfa93ebe10b1d91

SHA256
26e4f722e9b1d6670c940f94a874fbf7b7e17cc282713bba2df4fbf87caf2b03

SHA512
b21963c8753729076078250521089ef7179e1701fdb64e522d420976dc58de572400d5a22b8f3eb3ad3ab06603d3146b3a3834c21e69984172923127894ce895

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
00196538587421a905c55a66e26331b4

SHA1
ed3a84072e6ab8911ea900dabf420d8f6f789728

SHA256
ad96f25f2510cd227f5724c9bf49916d52974c187dc587f71b6ab906496f6fe1

SHA512
7652db7a3d950850aa14879bcbb62ffcc126785e5c257c8d9ee6bb99db34010604405b086861e93e077f5a6d001f33dbde14f9cb7db3a0d4897e2d59ea3bae18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
4821bf108568175a83c057c1aa166278

SHA1
12f49311fab3704adf021f0e6bfe6826cc94c5ee

SHA256
4adc912c8bd28bbc3ab7ebab7425964c7eb770018b64de4a6407f85cc687e582

SHA512
bb067226a3f2176bb020c49cbf4278b28eff680e0a11093eb406a2196f11dad3ef06e139b7710aa6b68b530e0016ccdf1460ac1f2e0fe9709a534ba36ded4275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
0186f3fee4017f7581901be3fd556a0c

SHA1
6f5baec6c5e12b1f57449be789765b5d19c548d3

SHA256
d50823cde00381f83f2f776a2b05f9c781c61e2c9f0084d5a48c8022a3d61b26

SHA512
ef16ff86ca5bc26252a378a09537821357cbea56daa3a4291b76b5bde7315f9e677d7f46e9d3dfa75a79f9ed9970756eb320f91060c575eaf2c7a75952521622

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
fd7257f1134afddc506f73e53aff1171

SHA1
e94f1ef3414908ffe9733101549718c2738fbed4

SHA256
b741369c2d52ef75ff31e63953b95953243454678ef172bad5c3aa3b0b5b302c

SHA512
b94e2eac144f2c8e66f203e23e2c873c3e7010946fe1b6af823f998d12f52ef1c574dbdd8b902995cf8f47b07768ba7062aa8aa150341a1b17e3f6f7edac92be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
264KB

MD5
28714f2fdd5058d6cabe725850e8240b

SHA1
da4219db7c78690df7450e1d13b2493b5083cb24

SHA256
c440e2b11102cd82796f8c710c7ed8ddabf9e0f3ca5b4c225cbfd2aec281d6bd

SHA512
046631d3aa7756827009175f081899f4e36404df2e724fcd5a5739d04098d7e9ce3ca9e0a3c7b1d729880572bde307cadf1a90aceddddeaceb502591a95370a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\Adwind.exe
Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
\??\pipe\crashpad_3144_UFRHLCRMFBFGNKDZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit