344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a

Resubmissions

03-07-2024 11:08

240703-m8zn2szbng 10

03-07-2024 11:04

240703-m6ldmszapg 8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

1.5MB
MD5

c822ab5332b11c9185765b157d0b6e17
SHA1

7fe909d73a24ddd87171896079cceb8b03663ad4
SHA256

344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
SHA512

a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d
SSDEEP

24576:9viinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pbs81ind2:EinbT3ipTD0anywJAaD/3U2pb7indT

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
125	raw.githubusercontent.com
124	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644783079673913"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
2900	chrome.exe
2900	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	WaveInstaller.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3228	3688	chrome.exe	87
PID 3688 wrote to memory of 3228	3688	chrome.exe	87
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 3056	3688	chrome.exe	88
PID 3688 wrote to memory of 4840	3688	chrome.exe	89
PID 3688 wrote to memory of 4840	3688	chrome.exe	89
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90
PID 3688 wrote to memory of 4664	3688	chrome.exe	90

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa3ecab58,0x7fffa3ecab68,0x7fffa3ecab78
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3508 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3860 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4360 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4960 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4724 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:1
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2992 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3176 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 --field-trial-handle=1936,i,17720655786869607872,4451429774860976763,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2136

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1364
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\51dd3dea-4b72-4931-b06d-3f2a1d987fb8.tmp

Filesize
270KB

MD5
86afe420767b8cb7cab09a5d7ce5fc9c

SHA1
e96d9f63de0f24b27ae7b594192e61c3b7475e2f

SHA256
4cd6cb8041a2bc78b06786fb612e5cead43f8b2e96d3eb60b9226b34ac5d51ac

SHA512
d183de59a927a8f3172dafb6ee6f15dbefc3cb846a0a832c0f10ea1426e6396539f8b60320f72d1f587a279f8b87ab1237c2c228e8bc9a0eda47c45a1e580826

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2377353e0efe3f7dc19a86b9c99b1ed9

SHA1
06c2e0c765fb0c696fdc544fdd0555d1962da9b4

SHA256
a64f0ff18eee55d3e1580c9fd6db90b6aaf37af272580286b786fe73263a175a

SHA512
b08c160de7d1ab5a443bd62be26a1902b58e7eefa6cfce6df6aef20763743586a08e79d8272373b602591ec8c3de2f067ebcced35a9660431008bfbb510ef0cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
9d4d7f5e959849b30982e3b809b009e8

SHA1
1c22b9a1f2a4324b2a3f8f3cb2ba23c195542104

SHA256
fecd80cfbc1b9473a3d264a02377efe7ea0aa10168507ce4b540b6bccedd0191

SHA512
f592d9cd2c6a74aae0d1abd7d0da7feafa87be686946516106b34ce6cf90aa99ae6af770eafdcb0a6a63ed31d467b8641a2df303c3b86150d9f5398882807737

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
4364fe54a908f1d7358d2ea1294d947a

SHA1
8c5b9f0a81b19f286885cb70dd4d68809c6061c2

SHA256
02f48653a7ddd9483bf2ed1fafb3dd3ab8d0bf2ca8091ed4d224560a39f6ab00

SHA512
23f80d560a58c8a1150196644d87b24c82cbb4e33cfac1f85944d9c4ef1594ce3fcd04ccb3805a96ca678b86a58a5a0b3136702d455ba3b07b4cc233c0a84348

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
41d638bb82606975f6d11675fc0ab6e6

SHA1
85516a7ec4019425e57ebf230280893c25ab269e

SHA256
0127570e02f007c849584a1c916e3c00cbf84b00cdae96f761ed5bb3803be624

SHA512
66409b117ca25b94f58209a2ebcd8442d69ffc220e58ff171288f7fa9050c121e15f47e53ba3f023227e74bd3d629dc184c5d396a57b66e91785e34290db1bb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
58a5b79dcd2a676a54fed114b0010152

SHA1
2249186b8c67c59b3cb4bed6303bd07d9fac56d4

SHA256
277ca7b3c1d7e09ec51b0e741afa803db189b9abf130d6fe1a2470bcd7ecdbb4

SHA512
fd84cc315006bce4b4fb684a131f5a4725c7e4dcdc25b8bd1559f869928d107ccfdcbcfd1e8a83b931e43f70162468ef60f7f275a8fff003e0a52d8e801a2499

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2e7aaedc56e1ca5caf02af6bd3e082dc

SHA1
7a247e7b466e9695f21840c525a25861194fb46a

SHA256
ce3120a9949a7696953dc85ad706407c350c40ffb02aef5ab83e964e14e9736a

SHA512
034c7e749a4a85e85d4acd5d907fcd3d8e3e870f30ccff4a705cf94527b73ba354719f8310cdd2b00a3747b922a4a61f725f0d555a86ed11ad4a99fc8a7a45a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
359b47ba0d1acd0fd5e55cbdee3ed2f7

SHA1
4b2201b6b0bb2f21399d38bd28664376986ea5b7

SHA256
6289f53a2fc9ece0b69bc79d3003616c4df99beb5f510e852be03bb73c891d86

SHA512
573fc31215b92497a40fc93030911f1ae810abbeed508f61b8a587b6f8021731e04934164695bd117e1ecaea7452e3025d07ff72706abc3f0cd3e48681e25073

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d66089b287c0900e99b47a36cb1ab2e8

SHA1
3acb16ad6818ecd9053a41d5ae873c15d3a12c59

SHA256
191b7e9678a9fd885d4b575e7577bbc787e9b8812d01037f34bc68b991de6548

SHA512
3e54a3e772662c22783dee79d968e50b8df034a6d8eacdef8b4c466ec7482f1cbe268c3ffb449eda51be0edb8770de3b82895a192585cb9dafd4a236e1a7a74c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
7bcf4eb902228a7edb894601326077c4

SHA1
79e54c1717bf4a89c33f59800d12afb483dc9253

SHA256
71b34199afdcb03ed52344a7f02729c14f95dc12e9c68efcc012b9e290e33547

SHA512
682963ebe8949a61323dc55c3aef2a3a47c593bbccf5d6cfcb0d36b4d6e2b451e09eed784f623d3982708bbad67257b8448705ca507a5ac90523ae6df55f838e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
94KB

MD5
0682afdb7233343795f10753449601d3

SHA1
87054788dea625a15c076f4d6c8f59889947a313

SHA256
79af3e0c266312e5567cc3fd2069784bfb78048ada35072a75ed165766b5fe1c

SHA512
b1a34512dbb89549260ae1c3c11fb3f9d0a17bbf1d73981d12e7069efc077610a8440c4032ad698bb2c3dc0ccfd697ee52ca33d11ea6c88e2073c461436b598d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe582eeb.TMP

Filesize
88KB

MD5
16b03a2abb8cf0fc705b2845ca168e31

SHA1
aa5d9d721cb3dedcc271c8aef00ab1ae84b3ced7

SHA256
1908905ebb5035e556a829a2cbda147bef42357222e31d48baf4aff7b0ce8829

SHA512
4e411bb9260825f80b7fc2dd359078f4702fb57642fed23ff91623c52f3bfe12ed03589cf41f471aeca0482fcbf9157a33cecd735a9c367b7d99eff20c641c0e

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe

Filesize
939KB

MD5
258a9cae6024c91784bbd8aa5379e86f

SHA1
fe1a808ba23053413359a78d5ec096b2cd540dd5

SHA256
3881840473ec5286189d2fc8e85f0f26a2532890055d1653da9580aa31b2d0e5

SHA512
b621ef432b430d2df0443fa0ebdd59dc7de6b32375c2fc83e8474838843c4abcf4a35f2b5f80e78911fc52336d71812ca9fbc9919314ea3b59bd26036a4ea5a5

Download Submit
C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master.zip.crdownload

Filesize
3.3MB

MD5
017f199a7a5f1e090e10bbd3e9c885ca

SHA1
4e545b77d1be2445b2f0163ab2d6f2f01ec4ca05

SHA256
761e037ee186880d5f7d1f112b839818056f160a9ba60c7fb8d23d926ac0621f

SHA512
76215a26588204247027dcfdab4ea583443b2b2873ff92ad7dd5e9a9037c77d20ab4e471b8dd83e642d8481f53dbc0f83f993548dc7d151dead48dc29c1fdc22

Download Submit
memory/4464-5-0x000000000A2A0000-0x000000000A2AE000-memory.dmp

Filesize
56KB

Download
memory/4464-389-0x0000000006220000-0x00000000062B6000-memory.dmp

Filesize
600KB

Download
memory/4464-3-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4464-45-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/4464-64-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4464-0-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/4464-2-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4464-4-0x000000000A2C0000-0x000000000A2F8000-memory.dmp

Filesize
224KB

Download
memory/4464-390-0x0000000001860000-0x0000000001886000-memory.dmp

Filesize
152KB

Download
memory/4464-391-0x00000000018B0000-0x00000000018B8000-memory.dmp

Filesize
32KB

Download
memory/4464-393-0x0000000006530000-0x00000000065A2000-memory.dmp

Filesize
456KB

Download
memory/4464-394-0x00000000019D0000-0x00000000019DA000-memory.dmp

Filesize
40KB

Download
memory/4464-395-0x00000000019E0000-0x00000000019EA000-memory.dmp

Filesize
40KB

Download
memory/4464-56-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4464-1-0x0000000000EC0000-0x0000000001052000-memory.dmp

Filesize
1.6MB

Download