d100d0996ede2f262a42ed33da788299c4f6867d866d0fc3b4221a527f0207f1

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
627s
max time network
630s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WeMod Hotline Miami 2 Wrong Number Setup.exe
Size 155KB
Sample260419-vb39zact8t
SHA256 d100d0996ede2f262a42ed33da788299c4f6867d866d0fc3b4221a527f0207f1
MD5 06a524532bad657f77d9f1c606fd5084
SHA1 9899d56297972c57a2102f4558db1c0dd94fa3c9
SHA512 d0c59dc5588ae6790445a7c3e7bce38b89d17e3b67a69297b3076aa2606489150c518f3f7da3c352f1be60b5efc609f4ad01023f155af697b7065a495ffa9a9d
SSDEEP 3072:w0x45QyUyhaEtHZeO/deV4ILlCI+40OHHBpF:145rUwaEtHUx4SF
TLSH
T17DF3AED9E3E815BEE6BB8DBA4C351DB005B7AC421CD5ED5A1D8070A84A33354243BB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
67	5088	WeMod Hotline Miami 2 Wrong Number Setup.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WeMod Hotline Miami 2 Wrong Number Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Update.exe

Executes dropped EXE 13 IoCs

pid	Process
2528	WeMod-Setup-639122147717339616.exe
3412	Update.exe
3056	Squirrel.exe
4708	Wand.exe
3068	Update.exe
4760	Wand.exe
888	Wand.exe
808	Wand.exe
4028	Wand.exe
2380	Update.exe
5068	WandAuxiliaryService.exe
4936	Wand.exe
5448	Wand.exe

Loads dropped DLL 17 IoCs

pid	Process
4708	Wand.exe
4708	Wand.exe
4708	Wand.exe
4760	Wand.exe
4760	Wand.exe
4760	Wand.exe
888	Wand.exe
808	Wand.exe
4028	Wand.exe
888	Wand.exe
888	Wand.exe
888	Wand.exe
888	Wand.exe
888	Wand.exe
4936	Wand.exe
5448	Wand.exe
5448	Wand.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WeMod-Setup-639122147717339616.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5320	msedge.exe
6592	msedge.exe
4788	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Wand.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "35"	WeMod Hotline Miami 2 Wrong Number Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com	WeMod Hotline Miami 2 Wrong Number Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "35"	WeMod Hotline Miami 2 Wrong Number Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com	WeMod Hotline Miami 2 Wrong Number Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	WeMod Hotline Miami 2 Wrong Number Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "35"	WeMod Hotline Miami 2 Wrong Number Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	WeMod Hotline Miami 2 Wrong Number Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com	WeMod Hotline Miami 2 Wrong Number Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1"	WeMod Hotline Miami 2 Wrong Number Setup.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210916574205709"	chrome.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wemod\shell	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wand\ = "URL:wand"	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wand\shell\open	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wemod\URL Protocol	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wemod\ = "URL:wemod"	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wemod	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wemod\shell\open	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wemod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.20.0\\Wand.exe\" \"%1\""	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wand	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wand\shell\open\command	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wand\shell	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wand\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.20.0\\Wand.exe\" \"%1\""	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wand\URL Protocol	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\wemod\shell\open\command	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
3412	Update.exe
3412	Update.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
5448	Wand.exe
5448	Wand.exe
6064	chrome.exe
6064	chrome.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe
6628	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
5864	msedge.exe
4580	chrome.exe
4580	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	WeMod Hotline Miami 2 Wrong Number Setup.exe
Token: SeDebugPrivilege	1320	taskmgr.exe
Token: SeSystemProfilePrivilege	1320	taskmgr.exe
Token: SeCreateGlobalPrivilege	1320	taskmgr.exe
Token: SeDebugPrivilege	3412	Update.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeDebugPrivilege	2380	Update.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: 33	1320	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1320	taskmgr.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe
Token: SeShutdownPrivilege	4760	Wand.exe
Token: SeCreatePagefilePrivilege	4760	Wand.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5088	WeMod Hotline Miami 2 Wrong Number Setup.exe
5088	WeMod Hotline Miami 2 Wrong Number Setup.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 2528	5088	WeMod Hotline Miami 2 Wrong Number Setup.exe	98
PID 2528 wrote to memory of 3412	2528	WeMod-Setup-639122147717339616.exe	99
PID 3412 wrote to memory of 3056	3412	Update.exe	101
PID 3412 wrote to memory of 4708	3412	Update.exe	102
PID 5088 wrote to memory of 3068	5088	WeMod Hotline Miami 2 Wrong Number Setup.exe	103
PID 3068 wrote to memory of 4760	3068	Update.exe	105
PID 4760 wrote to memory of 888	4760	Wand.exe	106
PID 4760 wrote to memory of 888	4760	Wand.exe	106
PID 4760 wrote to memory of 808	4760	Wand.exe	107
PID 4760 wrote to memory of 4028	4760	Wand.exe	108
PID 4760 wrote to memory of 2380	4760	Wand.exe	109
PID 4028 wrote to memory of 5068	4028	Wand.exe	110
PID 4760 wrote to memory of 4936	4760	Wand.exe	111
PID 4760 wrote to memory of 4936	4760	Wand.exe	111
PID 4580 wrote to memory of 3788	4580	chrome.exe	115
PID 4580 wrote to memory of 3752	4580	chrome.exe	116
PID 4580 wrote to memory of 4788	4580	chrome.exe	117
PID 4580 wrote to memory of 3752	4580	chrome.exe	116
PID 4580 wrote to memory of 688	4580	chrome.exe	118
PID 4580 wrote to memory of 688	4580	chrome.exe	118
PID 4580 wrote to memory of 3356	4580	chrome.exe	120
PID 4580 wrote to memory of 3356	4580	chrome.exe	120
PID 4580 wrote to memory of 1536	4580	chrome.exe	121
PID 4580 wrote to memory of 1536	4580	chrome.exe	121
PID 4580 wrote to memory of 3760	4580	chrome.exe	122
PID 4580 wrote to memory of 3760	4580	chrome.exe	122
PID 4580 wrote to memory of 1224	4580	chrome.exe	123
PID 4580 wrote to memory of 1224	4580	chrome.exe	123
PID 4580 wrote to memory of 4468	4580	chrome.exe	124
PID 4580 wrote to memory of 4468	4580	chrome.exe	124
PID 4580 wrote to memory of 2652	4580	chrome.exe	125
PID 4580 wrote to memory of 2652	4580	chrome.exe	125
PID 4580 wrote to memory of 3128	4580	chrome.exe	126
PID 5840 wrote to memory of 5864	5840	msedge.exe	141
PID 5864 wrote to memory of 5932	5864	msedge.exe	143
PID 5864 wrote to memory of 5336	5864	msedge.exe	146
PID 5864 wrote to memory of 5320	5864	msedge.exe	145
PID 5864 wrote to memory of 5336	5864	msedge.exe	146
PID 5864 wrote to memory of 5336	5864	msedge.exe	146
PID 5864 wrote to memory of 5344	5864	msedge.exe	147
PID 5864 wrote to memory of 5352	5864	msedge.exe	148
PID 5864 wrote to memory of 5344	5864	msedge.exe	147
PID 5864 wrote to memory of 5352	5864	msedge.exe	148
PID 5864 wrote to memory of 5352	5864	msedge.exe	148
PID 4580 wrote to memory of 7148	4580	chrome.exe	149
PID 4580 wrote to memory of 7156	4580	chrome.exe	150
PID 4580 wrote to memory of 7164	4580	chrome.exe	151
PID 6460 wrote to memory of 6512	6460	msedge.exe	154
PID 6460 wrote to memory of 6592	6460	msedge.exe	155
PID 6460 wrote to memory of 6612	6460	msedge.exe	156
PID 6460 wrote to memory of 6612	6460	msedge.exe	156
PID 6460 wrote to memory of 6612	6460	msedge.exe	156
PID 6460 wrote to memory of 6620	6460	msedge.exe	157
PID 6460 wrote to memory of 6620	6460	msedge.exe	157
PID 4580 wrote to memory of 6868	4580	chrome.exe	160
PID 4580 wrote to memory of 6868	4580	chrome.exe	160
PID 4580 wrote to memory of 6648	4580	chrome.exe	161
PID 4580 wrote to memory of 6648	4580	chrome.exe	161
PID 4760 wrote to memory of 5448	4760	Wand.exe	162
PID 4580 wrote to memory of 6064	4580	chrome.exe	163

C:\Users\Admin\AppData\Local\Temp\WeMod Hotline Miami 2 Wrong Number Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod Hotline Miami 2 Wrong Number Setup.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-639122147717339616.exe
  "C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-639122147717339616.exe" --silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silent
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Squirrel.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      4⤵
      Executes dropped EXE
      PID:3056
  - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe" --squirrel-install 12.20.0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4708
- C:\Users\Admin\AppData\Local\Wand\Update.exe
  "C:\Users\Admin\AppData\Local\Wand\Update.exe" --processStart "Wand.exe" --process-start-args "wemod://titles/6374?_inst=Y9GRDBmuwWAkgCOX"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe
    "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe" wemod://titles/6374?_inst=Y9GRDBmuwWAkgCOX
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1924,i,2200271700923034046,11780233962777006884,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:888
  - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --field-trial-handle=2184,i,2200271700923034046,11780233962777006884,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:808
  - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2460,i,2200271700923034046,11780233962777006884,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
        
        C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe Wand\Support_1776618011356_Out
        5⤵
        Executes dropped EXE
        
        PID:5068
  - - C:\Users\Admin\AppData\Local\Wand\Update.exe
      C:\Users\Admin\AppData\Local\Wand\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.19041
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=5008,i,2200271700923034046,11780233962777006884,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4936
  - - C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.20.0\Wand.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=6392,i,2200271700923034046,11780233962777006884,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5448

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe29cbc728,0x7ffe29cbc734,0x7ffe29cbc740
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,8300981719438770769,11299752921276134597,262144 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,17806019985304832369,1741174858278777225,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,15025201165703513326,4704488091837805106,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,10768861319098632188,12177309214307359757,2097152 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,8354618558783206585,6474091559190485075,2097152 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,2785477552754233484,5802002327600731619,2097152 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,1550368211651404151,9874298070027602475,2097152 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,8816118468558502351,3006625517487032492,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,12271016351112526051,9597281464476777372,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,17692195240768292061,16815097644637551026,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,1506671075979204289,8199039125210384777,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:7148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,2790425766279713017,3240578567590484827,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:7156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,3614880411564945695,11050055329092916968,524288 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4600,i,3113946334556384197,1994093078514143294,2097152 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:6868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3452,i,8654499888512371924,17672578022324912295,2097152 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5924,i,16657505393258219847,17529542383695213251,262144 --field-trial-handle=1876,i,11247644964609467832,5646716181624373588,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5c3f57a9h9d2fh43f0ha39bhc84ba4d1e342
1⤵
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5c3f57a9h9d2fh43f0ha39bhc84ba4d1e342 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2f0,0x7ffe1ea4c188,0x7ffe1ea4c194,0x7ffe1ea4c1a0
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,7806799588224174337,11220699730249514079,524288 --field-trial-handle=3044,i,11153048479761990034,18041724541758842742,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,17431584425928759307,1408757272926517393,262144 --field-trial-handle=3044,i,11153048479761990034,18041724541758842742,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:2
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,8870406582971326954,18387054363545721071,524288 --field-trial-handle=3044,i,11153048479761990034,18041724541758842742,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3120,i,17680937077176109410,1179220301953823131,2097152 --field-trial-handle=3044,i,11153048479761990034,18041724541758842742,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:2
    3⤵
    PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault90c481abhdccch4227h8928h1a4fb08ee5c2
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:6460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x188,0x27c,0x7ffe1ea4c188,0x7ffe1ea4c194,0x7ffe1ea4c1a0
  2⤵
  PID:6512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,14511430403822358020,7047896078852043606,524288 --field-trial-handle=2364,i,732330721726987837,3717606312733992526,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,7524903675153505434,8074754276651907439,262144 --field-trial-handle=2364,i,732330721726987837,3717606312733992526,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,1761557331581898121,14792666032296207949,524288 --field-trial-handle=2364,i,732330721726987837,3717606312733992526,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:6620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6308

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:6628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4713edae611a8c1c9cf90636b1e34f56967f29143241f611274e6b6e93d13d9c
MD5 0110c500b61867d0640cc361abe8d1bc
SHA1 5c309f7648d764d46fe7d8190712151ee4717d45
SHA512 1513741235fc9c9c8ec1d07f9a7bc5f762cfd3c84c61f6f5673b868d3927b5537d0f11cab1d28be7bda4568f2e8acaaec3e49cd2293543469c7f80a446881653
TLSH
T111E09BBAD825E83F09FD175960554787EB50236A2BC0894F3F3D960D8FB4736468689C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 100KB
SHA256 1612ba9b45896783e67ff0421120e16215cb84d6874c5a23d27ee0de058d057d
MD5 da02aa867f81f529a03fa6b85c99e40c
SHA1 ab54f2f268af090293cc65aaa10df8bc52301f1f
SHA512 eff2d27f780006d1b6072027887d97b0dc991100cf2bc485421cad9bd6a3d1b4127867782ad2210b7ccaeae09bdf92500774d8b5391a20db2306a0851e88bff3
SSDEEP 1536:RAoV3Pez7FqC6fVPqF32w4tYNVpBDRchoiNlSGcqpvBHcdLoW:2oVfezV69P22F+n/e2iltptW
TLSH
T1F5A3F07A3385FB87D2482B78C302441B6C737E19543ED984EDD694B284763A8BD71CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 c1269b0bca6261f349f5cde4f66eaac94ceb51d342b73ffac4c4c2b605d16ee2
MD5 1277eb093cba70a2673800acf6108ee0
SHA1 a7c87b70bcd197c13664b43d31476828048f9707
SHA512 f728922bb81b2919ad2d6f745e4496ad09c8ed8465798b63676d4f93be30e22506bfc87f9cc32054e8a166de9c08c9c1846350b974d8b748f9dd9039c7949bd9
TLSH
T1C411765D9936E416EBE739B474A208C0AB32CF10D2934F8237FDA23F4AC23A4000249C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 aba2a4f31b990b9466bb146f818f170eb7e745d3463efbf5495c104fca256db9
MD5 ab4282830d3503951d4dd1929ec75aa6
SHA1 e50b3d16ebf26d0913c3fc766413ab11f1e77dc0
SHA512 e7a9a8626b63abf13dea66873bdfe9135255a6c6b9006aa3388e63c482364af50993dbbbfe23ca9992794951a7c3be1fceabaa3d48546d803ec8d8ca52573707
SSDEEP 384:DhTlA5yBaWc7aIamB1v/OGWeZpTKVIQpmcIcJcR1hcqGym+ElD+ZkbY3x9Rd89go:KCLmKhzZWQ6e
TLSH
T12D72CBF783E4897DC91252F4EB182E1ACF6D0469031C3C7B89E4AE5753E6C72E29164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7f70a50564c2b2215a5050375145c453e7c6187cb93b298d7ca866960c198821
MD5 732aa24d0b8c81606b1f5d3258b6b154
SHA1 73cc7d9bffbc6ace354aa44e64c5e3885351791e
SHA512 25ef3cde4659877b15045c66164eab62b1dd6d00df397baa9f1aba037834251cb10006bcb72506fb38ff45fedfbc0fcc9f20748170e696e114ef50295d421a39
TLSH
T1DA819DF7C3E4C56D855156F8A7256F2FCE6D0A28031C3C66C8D4AE5B53E2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6bc54759c4215d2f766e90f5b97a3289adca4ce5c5a30d76efb487e1a4e95c66
MD5 390a72d5052a8a3c5e968dab11fc9a5a
SHA1 405c9fb56a42aaec75c3cbd690744834d501920c
SHA512 a1c101939a6dcdf94933f26b433ec7478d348805b1093bd6c3e4ed7bdd58105ab01bb505416c4962dfc5321f4c3b72a3164d78bed9313bd2a8ed71435b62f1ad
SSDEEP 192:9RwcBzjMsQtARcFkv7CMhgPRpffB1S93Hsb+WNyALdF4xReEoEkwLIZ2apAHJOVK:9RwmzjLQtA8Ax8XGxwdHaesrJaNe
TLSH
T1B652D62FB810693B9CE6D31AF921771BD7F6202561852E84EBFC8A2C15EB6CD611B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3440d9d3f0dfd6ef0d52849e95731ce5064aaafbd44257c5f52fd7d9a5749832
MD5 2e8f2ba87751e92bc1b161e163eba1f5
SHA1 dc6c9ef76cb042f777c2de8d789f7c6ed9a608a6
SHA512 02d74bca666d6f6dd1a4c4c45997f2685afbb32079b1af4cc3c9815fd9dbf7cb826762c68d560ddb68750a766ef66ff9e209af386fa4559066b2b79944a950fd
SSDEEP 192:9RHjMsQtARcqkv7CMpAPRp2u93Hsb+WNndF0noEkwLIZ2apAHJ8VyIsnAUgtaJ:9RHjLQtAxAxUXZxwr0lrJad8
TLSH
T1A342D62EFD14743B9CEAC31AFA217717D7F5202561852E84EAFC8A2C15EB6CD621B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 28826f0cdef3ba304b3f2b3abafc01aba7df61dccf62f0d5ef978e7efc6d3336
MD5 ece39cc1e7b51bd9c393e34e13903079
SHA1 536edc761fa274a58a1a8db52362f4dc9a311154
SHA512 3974703f390ea17fa4519eb465864e76f8158c48709f4f818444bc92c27d24c0b6c5c55f249fde0d4125eed2b0135189ec2f859ebc29269011e2b625083b6392
SSDEEP 192:9RYjMsQtARcFkv7CMhAPRp28M93Hsb+WNndF46m2ooEkwLIZ2apAHJsVyIsnAUge:9RYjLQtA8Ax8XYxwrk24rJaJe
TLSH
T1CF52D72EBC14793B9CEAD31AFA213717D7F5102561852E84EAFCCA2C15EB6CD621B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0f8bafe13f2245063e7829ef91c88ea252f22f7420ae9bf4119ce4092d0cf660
MD5 8638f663332aa64355c31396414aa3f7
SHA1 1f83c8a6d7c3e4c72ec058ead75e4cb6077818f6
SHA512 f8911ac4486f63268de2b318e9e2a8f7794476a0c0b79fca71cba4b2331eafa63ce7655141304429f162d3c16739ac02e9723d17586336a9287efe5f41708fa6
SSDEEP 192:9RbcBzjMsQtARcFkv7CMhgPRpffB1S93Hsb+WNyALdF4xReEoEkwLIZ2apAHJOVK:9RbmzjLQtA8Ax8XGxwdHaesrJaNe
TLSH
T1AE52D62FB810693B9CE6D31AF921771BD7F6202561852E84EBFC8A2C15EB6CD611B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cafe9b0e79915de734487b51ac7ccd81a948a173c45fdcb14ee0dd544032dc70
MD5 9c2a5de78f58fb178d78c3bdfdd67364
SHA1 db1783c730ef3496b34d05d77e0235f13e5d07e0
SHA512 e36d9b1661a1038f5b39a2156d35c697c603305e7c7ba957916862c24ee4ecfdb1fb7de44c13baaf5cb60644ddaf8c5ade75ad9853a66b68a99dc22249bd3193
SSDEEP 192:9RbcBzjXsQtARcFkv7CMhgPRpffB1S93Hsb+WNyALdF4xReEoEkwLIZ2apAHJOVK:9Rbmzj8QtA8Ax8XGxwdHaesrJaNe
TLSH
T15052D62FB810693B9CE6D31AF921771BD7F6202561852E84EBFC8A2C15EB7CD611B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 537517934b8bb43f84d4c9df3c56e09a7b84f5893f8d025fe9c6dac6222d5065
MD5 5854a15140b1122f4b03fe13a7a2afe2
SHA1 e806d4e54c78d9f1fcbd280d50c34e6abafcfc82
SHA512 d75aacd71eb89162421911a3278d4eef0b2b49e314012c4b321c849a88cc8b013866ff42d77750c8e1adc664622f540f39adc469c5d8c9433af718faceff3b9e
TLSH
T13CB0121080119945C44302B531C214CC32146F148705130153E8AD73E86A1F14015150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f7b05.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f7b05.TMP
Size 96B
SHA256 1ddc0c5a5d271844c28949dd8541f4bd182d2f34e911398a0387c6b6eb29c284
MD5 ef21a047a837b58d5c80d264c894ed7c
SHA1 b957f54f1df2c497d761f56231d0c42251197fa4
SHA512 9bd3d6957b6da81e2e849b31d94084cf0fb2c27e844d058cb7b9a1a1cfd7755f7f95be5ef3888691f5cd88b9c38a646c16836b1c271330ba97dbd89e2f3dc006
TLSH
T1F5B00295C21AA213C0C28BF42695ADD8B260EF76C703521292E11E77DC7967559391A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 087e18cafe7a835619fcc52ba7cc7a95229eabd8b32ecdf1b72e7c9d7c7e35f3
MD5 cf32cbafe59431ca800fa62ddc537255
SHA1 1c14eca5e402698cd7691db7348139c94bb51553
SHA512 9865f4f7cd020688176f23591f91d9641ee51221c64babe6f0a89b225ea783c6be0dc7453ea66e0f9aaab01d2adcdfa67a6f0fc28aa64696efcca95ad758bdde
TLSH
T112A0026509F08C19CD0112B112C105C03738B95B1306C60785911685C9B7B976907208
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 b6e57ccb72688621f2e32a8771122670c5b58a30b6b02532b9bb754c5f8b88a5
MD5 3a936f6742473478f630ca6523378e89
SHA1 fdf1ae6fe5a0ea75dbb47a71aeea584bb8660459
SHA512 12d4621644547535f5f012cacb88ba560cf13a0c52493656449f93775532c2d5eb4d41edf7feb02175fc5a3e021a28f1a5efa68030773baa3fe7254d47ab9b36
SSDEEP 3072:bdhcothHWNfF1sE1hE5i9v8qvaJFv3Qw/xLANk0mUW5GmRntSFCjEEN3:xhB2daE1Ki9v8KGvrOk0HOGm/SFyEEt
TLSH
T16C1413B6DE0746F3DA7D86D571A5250ECD20A7CEB07EA44837DC5B4DE0CA2841F62A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 23ba09dd1c5f44fd895f435b9810c57d14c950753e479939bdd1f116519cfab2
MD5 b553fca8a24e9e9e3bd6b505e6e6f34e
SHA1 560929155c35d711908edabf055d231b9426f79e
SHA512 9eb31fc999c366e08b149fdaf33069a55155e59c24d7c4e24ba8e95845505d5e2272088829e94d6bcd972294244e5bd37b565d6d6c72dae934965b32ee348d59
SSDEEP 3072:acothHWNfF1sE1hE5i9v8qvaJFv3Qw/xLANk0mUW5GmRntSFCjEEN3:aB2daE1Ki9v8KGvrOk0HOGm/SFyEEt
TLSH
T1631412B6DE0B46F3DA7E82D272B9150ECD1597CD707F645437E84B4EA0C628817A2A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 30c1006a1dfa454d7302f8a7aa6a8c692a7ecd516642faf0d58ada942a8a73ff
MD5 762c11ba75caac4cedd02c1ca0b24a62
SHA1 5392c397bcd6b493fc0989b1154e13c873336d37
SHA512 5ff91cab73c1028b9e272578fc7319e9d3233424e6314d87cbc28f3407b4cdcd36bb237b1b2ebeb6e3809fe272e23d5dc371390f8f7bc67b5f9d240bc1682d3b
SSDEEP 1536:ip/FcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aF3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1249312BA4E2646E7997D4A8276AD7808CE12534D705FA9CC326C638D61D02CC2F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 aeaad6653e218e4a91ee7798775a61191f8300f537e12af9ac6fcf959ab3aa64
MD5 67c56be00ad59831e29589e11546666b
SHA1 97f5970dfce77fd1ae14170ebc472f2d05299ce8
SHA512 ae81f6cbe688bd795487d4e89733fefdd4b458a60cc6c8b2c15d8652ce04c14391af19397879abb3116f316e4d0d9b344164b8e51357eaf8bff84fafe14fbfb5
SSDEEP 3072:RcothHWNfF1sE1hE5i9v8qvaJFv3Qw/xLANk0mUW5GmRntSFCjEEN3:RB2daE1Ki9v8KGvrOk0HOGm/SFyEEt
TLSH
T1231412B6DE0B46F3DA7E82D272B9150ECD1597CD707F645437E84B4EA0C62881762A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log
Size 2KB
SHA256 7384160e534526d57ad8c778c066871ad70548d86c92e79256898fa334833367
MD5 41a2e77a29628bbb8e45f0c1f25c3b29
SHA1 24d4948dd26c2d8c7e53b112529c4f6e6a9fcd92
SHA512 79ec5caf249b1c3be2357bc2968e62a0a1c709045950c2dd8895dc5c79cbedb0f1184e5da533c6dfb2dbfadd6bffbd32684cf703d424f6e4b8ecf93212d2355f
TLSH
T1A741D07222B1B1D88D173F52297C258463FF4328FA509F5CB568625EEA290175F231F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f8c1b340ba38aa372c6bec63176c6984d4718722119f30adbb616d91b3e1fecb
MD5 6c050a3d22f3301cbc26057ca9e2661f
SHA1 dc59cde13d4a30fcb79e4f92a46f8a266cc2e59c
SHA512 7abd397c2a04954ff20770595771ca0b6973ac66a576a77f39725a8fede827632e2e2524aa608953ddb8da1580334b56ab962bbf951cadac938541b380d776eb
SSDEEP 96:sa2j4iEDWaUIscOb9MrPdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjJ667gwUhgNr:sx0uaLsSrVrpMHW6+WNGYpxhgF
TLSH
T164F1B8566E28697B4CC7E11DBA367B43E2F5102175C5194CABFC8A5C049A7CD630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0da094770dc60a5d32e9fed302a7a1318255b4bed8922490a8abfe8af0c14f5f
MD5 8cfa19cd0531e2799bdef7ec46d8bb7b
SHA1 b0e78b9cd7f6c40ff09b5311bbf7d6f4df8785ba
SHA512 645a478cd7c197d088798fbf6eb33563cb758d94a2dcd159419c7f6e5d89c3163e51935ffa4782fd3e157ed29a208ba001233a794bde8084913735f79188db78
SSDEEP 96:sa2j4iEDWaUIscObDMrPdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjJ66736wUhgF:sx0uaLsorVrpMHW6+WNGYq6xhgF
TLSH
T19FF1B8566E28693B4CC7E11DFA36BB53D2F9102275C51A4CAAFC8A1C04D77CD630781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 6d928609770d0c734b40139413989e671d6b1a5dafe59ce15fb4fd0d0d94d3be
MD5 6d02b32542c7526ea7562727b9806206
SHA1 b580fc4a12c1a44f404190ff33bfa9847ea2e3bf
SHA512 e36ec9be39394c659beb758c90ffccb5fc35aed1543b6d4fc266a7418208303baa353d1c9a0db72d6090d09ee6d3f009c5913c479c6a2bb33c102f9b95bc6b71
SSDEEP 768:vVKvkLqWve+c+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzFLllnWBlroXU:vVKvkLqWve+c+u1jamFLfWBeXU
TLSH
T18CC2FB3B640CCB7E4FC05A9DDC5A6F972EA802C7A6648D4447FE994C02C77EA91274CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d492294caac6111fd74f5ea56adabb223c225bbcacdf89448293e45eabbbd9b3
MD5 44cc477260291d5f4eea9f6038f4b32d
SHA1 d870783cc2c05c41d7608c85b13fcaac74f5bee3
SHA512 b17fbc2ed5508146d09a2f1767c528900764dce8d0cab8f59aed292e5df0930901fbd06f023ea842f25d4f0f0d9dc83cfda2a6af6f1bf165dca09585b2e6c61c
SSDEEP 96:iqONkCQsjpfKTzDXcJRC5ih/cIPURHl8h4otop5OyDUBEPgpYvJKxCbTqNGL4exH:ZONS6IT0JZQmiUyNYOgibFk/HuFuS3U6
TLSH
T1CB02D975B86C6C7B8EE36E59B08B3B235FA4106FEA952F84D9E41B1C01D764C1703876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 057f99cc7a76214e9825e5aa606500fe367e7526b3652b3a18daefc2971f9c13
MD5 67b340c49c69a9215619db4897dff3f1
SHA1 85d53a48d753ae7aac43d1b41bb50a833b410379
SHA512 7873465e59be6eea73c92cb798620a9c8779f39f768229f5de6cf8c79dcd03335d2b399061861299e32bee6a3fde32d6c23d602b7b285869d705392147b86775
SSDEEP 192:uONO6IT02QmiUy4YlgibFk/HgMCh1KqbIU6:uONO6KUlgi+AMsEU6
TLSH
T1BE120AB4B469EC2B5ED3B855B0C737635EE420BBDE456F54D5E44B1C04C768C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8a2966f9a39100293a401ac75701a9cc4f2642f01f8e70327586e29ba104bf7f
MD5 b1e9435f5f223d7f478ce18643ec6a81
SHA1 f2ad8c971f98c0cb958bd09a82a2f13d01c3266b
SHA512 99f3d939d3be5b8390c7c1228122ff3beef53b2fc4bd4d13bfba5935597ad9be91dc21cec7ff7762bbfe01829d3cd2a3c7e748def183153c4cfdb602c5c58758
SSDEEP 192:zWsNf6IT0PLQmiUyoflgDbFk/HgMChku7qbIUO:zWsNf6X9LlgD+AMBujUO
TLSH
T168120975B869DC3B8DE7A465F08737635EE410BBDE456F54D5E84B1C04C728C2B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 26ff22fb893a8e021fd213966a094b85b5099f1be85b17c6eaa53111f7a0cbad
MD5 9e4706e9309796b0d11dd7f936ec23b2
SHA1 1854c390bcf5a99df28ab28805b3c19aca60b2c9
SHA512 942904c478e61ef5f15933c61e6bc77e9b9a8f7b54c1858d4f06217d683082f77a22ba54485f0268fc5240305f5d87a63327d385a8b7c08369b92462af402b92
SSDEEP 192:zWsNf6IT0PLQmiUyhflgDbFk/HgMChku7qbIUO:zWsNf6X9WlgD+AMBujUO
TLSH
T1D7120A75B869DC3B8DE7A465F08B37635EE420BBDE456F94D9E84B1C04C728C2B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4e09c29f918ca8f04dae952fdb3b04d2a64454548b856a81c4866b15176f9f4d
MD5 6570adb50591d91629740e3f07a1b2c9
SHA1 eefa242ff525505879ba81811218f766469fd302
SHA512 87de6f3627e99f92ae84429268179a23a337e9cb02e6321a3bcad79b4c2208dcc718dbefc35aa8863006de95f78416a1f35acd5c597724aa44761c0cebec1b8a
SSDEEP 192:zWsNkC6IT0PLQmiUyOflgDbFk/HgMC4FzqInUO:zWsNkC6X9VlgD+AM7nUO
TLSH
T1A312E875B868AC7B8EE3AD56B0873B235FE4117FEA852F94D9D40B1C05C728C2707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c786aa39-66e4-4d58-848f-2a5b04e9878f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c786aa39-66e4-4d58-848f-2a5b04e9878f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 77B
SHA256 e68ccef7ba060eb28e3fda30e18d0f29e1bea1141036effa018c7b4117c03469
MD5 a127ff4928c9cbff0246a6b344f78748
SHA1 7e8efac2a5582b6f249a093b55122b83b5e84102
SHA512 36442e45ad2848d7037a7469eb53207b6a5ed74ff3c996d9dbdb335685622855746c7ce2764ef739fa7962ccf8f8058a80da4c44d485b0b16dedcda7a2767b00
TLSH
T1E7A01208711033E846C60064408F82108A6D229481E150022DDB944014285545210D14
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 485f997ad7763b6682e7400c499ab5ff036dbbb7b8996e731a85951631f94aac
MD5 06d8eb59efdb6ec686348e2b454c7180
SHA1 2ba199b991a117c8068adebba757ac29dcdcd053
SHA512 c38b06c17d3aa1d8333d4eb5aa6343db40633282aafe1a7297f615d907406f457cafc040bc9da3cdaea65191a6a50e84e9119955bfaa57d718c3670f378919fe
SSDEEP 24576:zwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYsD:kRZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T131956B12E7E88F3FE56E27B6F471105907F3E5866362F78B6A0C61B92A833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wand.exe

Path C:\Users\Admin\AppData\Local\Wand\Wand.exe
Size 670KB
SHA256 26d1a00acdb35b17e758502dfa72a3297b6a5db337344ef0c0e5877210f8f429
MD5 fc381b6e19de9e3e8abd79553b523f73
SHA1 e1d086ab01018cd759aa692ee2d4881a1ded327c
SHA512 a2fa1ac0ffb9c40e07b36724db1025333464c1ec94c128809959d6353da1cfc5e5e63c3cd051cef76e086add814e2c40bae003e8530ab5498efd70f7365c4c86
SSDEEP 6144:CZzvhs2Z4n1E7g34XtVYAOfTdZ5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rj1XUP:CJ+2Z4nShVY5D5KgHUizA1CGZXUP
TLSH
T12BE48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\chrome_100_percent.pak
Size 143KB
SHA256 0b84b7680630dd51cb36a2fcdd7cc3b031636fe6b91f81772822be9e514132fe
MD5 001aa2a7d5dcaf2d0987804a37e21db9
SHA1 400b97656f6433112cc9ec5aa13e2057eddeb8d5
SHA512 d8563e9341933135abccf52404cc1dec78ad587acdf2eaad1e11f22c088b42f31669716f1df561a14b0894e73724a275c00bd03c9596d0ad7853210c38f1652d
SSDEEP 3072:Vz8JCGIdTwsWr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Vz81IdTOr8EC/T95K18Gb0OV8ld0Gec+
TLSH
T18CE3E0D3B3F4ED3DCB9706B7A2160071ECB346690691424B168AD8716A76B8CCDC83D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\chrome_200_percent.pak
Size 214KB
SHA256 8e2afd2ad5bd4f4edfe739ad503ff6896410d097665d40e99c56c440a8ebc36e
MD5 749e5ff4a826e7ffe8421634520b7e61
SHA1 b9fc33e5edeba42c07ec040f8df846c649839ff5
SHA512 7cb845267e9a4e41c576bee3f31e1b285bd8f0ddc24677f803b01384bcad4fd0e9ebedd5efaa2ec5e1432e2a8bd2b2fa49573c52e577827cfcf45ee2663a2325
SSDEEP 6144:7DQYajN6svyA6nIEb7r8EC/T9ugx5GMRejnbdZnVE6YoppO4:ofjN6svyA6F4B79a6edhVELoXO4
TLSH
T18724F1C7A3F89D3DD9630AB3622601F1ECB211390AB6550F17CBAC747959BC989C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\ffmpeg.dll
Size 2.9MB
SHA256 6a767e577c83955073040a593effdf7a0b34639cbc76187eb860453eb3f02286
MD5 1a381a73b52cc667a3aa719c2277d5a1
SHA1 396867788eca795e6ed66ffd948eeaba1520899b
SHA512 7cadc00f2e3529333b5649b8424a816d38bfe759b0150fd192a7d855a30a85998d8a01ec556e5d9054a44d4d594537fb35110a895045571f6efbfc4129cecaf1
SSDEEP 49152:fCDRsXoLyeG81NYxzi93BBJkBOA/7ZGddK6BflLQjbIXPuKM5SDz:f1VeGnx6rJkRbImKUSf
TLSH
T1C0D5AE03F6DA50DDD029D470979F9213F671384A8F1166EF26A05A202F67FD86E3E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\icudtl.dat
Size 10.0MB
SHA256 9192f5453665fcfde180f1283f2fbccc477f4daa0081e3903ec02d9242721860
MD5 08096770ed3f7020e3214762629daee9
SHA1 744d66d96d317976a83233adec0f50ca452fe82d
SHA512 534ffc6bbc95dc969fdfeec7f28f23aad30b65a98437db6fcba69a58e585e6e48876882e544f370cb6d6cea008e9eba3667cd8afe589038990cc791c2272a581
SSDEEP 196608:gSPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y8A:g+wkpHiXUxY/iJ53IWhlVjEeIjA
TLSH
T157B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\libEGL.dll
Size 491KB
SHA256 5bfc317ca0113c0fc953fa3b281e16138abdb75045de3cc5fa485379f12ea841
MD5 cabfeacd9dc84932629cb87b12bda78a
SHA1 77e9e5ffd607c5c57a12baf017397f8ef9528bd5
SHA512 fb1ccf1866410899cef6ec5ede0396ce8cf13d2eda0c53b3a75f5d570cf1b78ec87ee53a1040b4c4afb9ac4333aef32f47f02f02a4e597cb970aeaf7d62be5fa
SSDEEP 6144:u4f5otVuvlq6eQNwIL7tjqqjcb9A+fUS0dxjHV4v0KwWYxu:v5rzeQNbL7tjTwAhS0dxjHV4nk
TLSH
T19CB49E15B3E444A9E06AD1348A534642DF76B4920B69FBDF03E492392F77BF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\libGLESv2.dll
Size 7.7MB
SHA256 73a30185cc2834ba7ab4fddd3dacc5d6d4f88e3788c3b24481066c3c13053efe
MD5 50e59fb31c6daaa0cc85ccfcc4259c64
SHA1 074969f0e6c82a998ea16ddc054d72d86e6f4b71
SHA512 cb1c80e82bde0159bf35c982fce69c541ef396efeb0abdfd45adf1af97b06da8e692d912b8baa67c630abf3734a333d39478299db48407428e51ded6295a76b6
SSDEEP 98304:E0y/1sZBa+b8p6ZT+Phi1dy+nyEIGX4U:9i2aTA4l+34
TLSH
T1D1867C03F29540D9D00DE2B8CB5B9623FA3578850724B6CF269457252F67FE0AB7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\locales\en-US.pak
Size 489KB
SHA256 db534d724d2f9906804a239f8728d0c23dbb3419a51c1f4152c6384b5a0a9dec
MD5 b17cdd720ec87a737e1476bc9cc2418b
SHA1 1d268835c33c2ab971a2fb9920aa9a4c566a4920
SHA512 feb89bb787de05def26c5bafc16eacebf23c588ce1d9ef59a497231a5986b683c69707f4ec1d3e237f6483ad6ca2c2617e98d0d3086ad0595208852ee032b35b
SSDEEP 6144:bBLy2+0m1ZazYweDL8MP9eOQcDNfaY7hDHW5+7xEngnt/SOwB:xb9zY8MZQcDNq5IxXwB
TLSH
T132B43B1FF7441269069352A27F0995A2FF32D06CA36112563CBD812C33B7B6AC3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources.pak
Size 5.5MB
SHA256 232bc65eef7ac4dd0b6af8f0d405ce1252e7924708cba498f171e176c23584b3
MD5 5be05110d0a994a77234c71c1749980a
SHA1 e84f1810cc07c7b7c01ec20f8817d768f4e1738b
SHA512 6f8586e4e608b979f878196bd4278b4c404ad6fcc2eb5e746a23ebcd27e7d2111c3918a55448e251697d8147721e7e3577bd1178d61aa79ae85bdc20d909fe24
SSDEEP 98304:oZyJrhPOXD1V8Sug7bNlE8NVwrwrQqgvxJ5NG6fVMLuYHzpO1w1f:+OrhWXD16SxlE8NVwkrQqgvxXNpfVM6e
TLSH
T1C94633E5BB06983FC9489BBA016D8679056CC05E22E2B507844CF03979F957CDFC2A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar
Size 41.2MB
SHA256 d993c251029f375d1c64e14a57d334fe4d344c5e5cb1d6bf613df9968b68a3b8
MD5 b1d2501bf3c434963c983d2f38da9087
SHA1 6bb7e40a8dc7578345a517523c8e277bc7a3cadc
SHA512 5a4790b9b2e6df7a6caa8f741bd2a01176bc02f66c5307fc5abc3d45f8dcc30d6a63b7855b463f2e1ee69d92bf835a623857c3724eb210e00cbbe4aa02beff7f
SSDEEP 393216:GQdp81umtzSB/vOrQigcJPUzhbHN8pm+ZcN7lgFsD96H:GQ4ptgcJPHbZovJs
TLSH
T14A97D12DE2B06D76149B10B660463227B13450A7AF213CECB78CC5AC4FDE98E6177B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WandAuxiliaryService.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
Size 1.1MB
SHA256 eb1d159ccaad44d3f1427d8a7db3f6b3b892292af76277f7d0f7c450646abf5e
MD5 c8663a55223c65d6db7ed613cb965173
SHA1 8956abd4def77ac3370352927114be815aab7434
SHA512 1af03f467a11da24f940b7604f948e41b1fc689007f6f6c0b13b817adfd60938d0f52c100110068cfca9b378ede8956ef6e698f60b0b47f0d427afd1d830a09d
SSDEEP 12288:qMyKhirSmC/2YfQcalNQv9snvaGgr0duG5KgHZizm1CRQ:qMyKyhYfHEvaG40TUQYK
TLSH
T1063517C59AE495EFD1BF5B359DB01E344BBBAC01A6D1EF4A0444A6B80C53361A83633F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

capture_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar.unpacked\static\unpacked\capture\capture_addon.node
Size 353KB
SHA256 b23df24427868b875634422c9d4360029115be596cf07fa9fa0adb96d1c6661d
MD5 f19e8f6f9de54e00c18f08f98249284a
SHA1 8280463453791370998d9453a1ce985afa782226
SHA512 e8657a529e7f9b915c56624137b28f2c3ae686c67238b9beffefb7c7d36d16af94f3b1ecd7b43688cfb1af1f452308993b913d69dd6b7e50b6c4ed44e20c5699
SSDEEP 6144:qBwUknKeSUreO0nj4BPxQUx+zKt26wEGnwAp/j+1H:qBwUKKeSFOgjkPxYz02XwA81H
TLSH
T123747B1AB7A404B8E477D23C89674A05E7B27C4A0760E7CF23A4435A6F33BE1993E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar.unpacked\static\unpacked\icon.ico
Size 409KB
SHA256 1a90e62ec52c31681af31d9cb4790c8a3af4b72bd8de3a0e937802965a23a38b
MD5 06aa52a7fa25dfc51e7c846172d985f2
SHA1 10adb45e32e5a4831154e5e17425ba3f911bc325
SHA512 b7f3c9c000a8a4af76cf619908177bd29a98a69825e2f711705cdb810bb8c8f4c29ec8c409855ca1d1354dc52c72f4c72100dea24727980d4b8ecd1e4a4ed3a8
SSDEEP 6144:t5Ker1PJVHjMYimBSfN/yw+Aw1ECD45rO:t5KgHaizA1CG
TLSH
T14E947DD5FEE521ECC0BB9C7A4C325D3169738C4698C1EE92588779BC419316A2D332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overlay_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar.unpacked\static\unpacked\overlay\overlay_addon.node
Size 582KB
SHA256 4abe6233b9f26c34e844c56830342cbd2a4d1607dcc57d92ffe5f7351dae487a
MD5 0e89c5a2ffd7a0c2c4a8e20eb9252731
SHA1 774ab35e50e63c6d81483cc85a1792b6c1c9bcba
SHA512 6680f6186d97a90180127f823806d43c39466b08518d736b2888b4989153a0413ca92dd3a77e8cce6613db7f774ca306624f9a2b15a588e8e5a34fa42b7019bb
SSDEEP 6144:tj9PTt5UmkURgTbVCyea/tTleN/yH5f2QAHzqKZb3LwXBE3Pkio0pKG42zNKz8gj:t1UmZok+ILcfiPp
TLSH
T1C1C47F2AB6AC0379E167D178C9534512FBB278561370A6CF03A15A9B2F277E14B3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analytics-frame.js

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\resources\app.asar.unpacked\static\unpacked\preload\analytics-frame.js
Size 1KB
SHA256 c94031bd1997e73e46a37f101818183497f26a1d71d5316fb70088119220ea17
MD5 cad574a5e3b3f93ad3e7f4eaf594e4cc
SHA1 c2e25dd3848a4a1068e24439efe916aaca5e66e1
SHA512 1b632e1621857392dffc4fc23d99d61ca435dcdc7d80d684e321623054dd50f353f9333a1dc8d2ca7dbebe5f00020ab44b6deee2ab265a450c8d65806b1bbfeb
TLSH
T1C931CFE0AC821D9C33A70174B796371634273ED3CA0E91446B284DB76996ED00559FFE
MD5 SHA1 SHA512 TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\squirrel.exe
Size 1.9MB
SHA256 6629b5944c9c36f3766e7eb6f7f7db14effb1cd57c090e584dce8869d6382074
MD5 a177fc0bdc9dad43a1d5ab6102c4bccd
SHA1 b7ba0691d1b5a2526ebc7d0aa200f55e5431aa9e
SHA512 d9e9fdfd9e230a006533fb5188c2c765ffe88e676facb9439093ab1b8910a2b41cfb53e54d6212e347de219e16844ac7e0c5e4d38ca1d404bc26610380263cca
SSDEEP 24576:NwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYs2:eRZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T1F6956B12E7E88F6FE56E27B6F431105907F3E5866362F78B6A0C61B92B833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\v8_context_snapshot.bin
Size 677KB
SHA256 4e7a4fd38636f6589a78934e2e3ed8a3698d154665cb3d2a9032b809c9ff1711
MD5 2ccf0037aa83899319d86189f1adf085
SHA1 c8ee1dde65817ccfcc70a3b9e883a90de9e3989b
SHA512 02562a99b5c7fcd83f1ad1758ebad5ffce1cfa8a295a371bee1b95f34f69b74973875a76b3885ead49b7d4d1bb10e954606b0d7081437c69b1eb1f3b16f0860f
SSDEEP 6144:zes4hmb1aXFI1QZtXWO0GZkF8zFylLKR24mCGaG9vzhAJBb4bsgvHc47ACl8dUQ4:ze1hmbI19JA9oCLho4YKvUiFjrD
TLSH
T1C1E470A7FB4ADB23C7C85DB59DE6E6553D75B0CEAF4E812B71080B3D74322A40A0918D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\vk_swiftshader.dll
Size 5.3MB
SHA256 87e3f14cacd6a5ac081eee2916115beeb6e3935a76c5f5745b30f8a02d1611a8
MD5 9b5e06b45378c44533da283d3f88035e
SHA1 f0ac130dc00cf5d30580fa8cbbeefad3e2ff0c62
SHA512 833e3d354134051a422656eb3f33c0f4fc221670a816dddae219cfe68d32a4a7d023f2652adc34b74d1bd48e8e0fe7cac52ecb0ec091595e23365559690115be
SSDEEP 49152:30uXhQ0LQalKqSMV+yEYUjmaM4T7zTCYRyg/FXGTPUihc43RN2DJZhGR0jxl6rKd:9e0LB6oFQ6KBS0
TLSH
T16B462803F2858099F05DD579875FA623F672B8801B62B6DF52A01F192E77FE06B39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.20.0\vulkan-1.dll
Size 888KB
SHA256 b7a95e8e6c026e6e4628d174e98722cd8d1c4bfc69d4e1227a6c6a87ae3739bf
MD5 2d3c3676a5223de10a1fa92786d2a790
SHA1 43b3ef409c38683415cfcf5eb95768f8eace9c7e
SHA512 40730f51221821e0bcf6115753bf90bdf06fdbe770fe6d68f065b5819e369c1d33faa05f6e5f742ede9d6ad63fc461a040d298a1aa0e9db1182f6550e227999f
SSDEEP 24576:xAaFh6RdsHDUk61wGq6Z5W4DYsHF6g3P0zAk7vh:xx6R+HDUk62Gq6Z5W4DYsHF6g3P0zAkj
TLSH
T106156C23A6548569D87AC034D9C28B03C9F174922326B9CF02A85714BF6BFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

init.json

Path C:\Users\Admin\AppData\Roaming\Wand\App\init.json
Size 53B
SHA256 4eb0627ec3cf823f1278bbbf1482011ae59a398ff5f26b12112397d9b348059e
MD5 3b1c1907e8780d4f4144a87c26d27ba6
SHA1 da29794ffe400f94b2f57c64bdf494bc3ff1f70a
SHA512 ef55dd00ed7d0cbbf39c7f911fb4ce52a98f9d8778ceadf6ce94326f0cd1a6d8a8b09de147a3f8a2a644b33e66a25940a12d2f665086cda4a9eb26e6d673731a
TLSH
T1539002840666206397022A4F82C21565451D6420C05904A15DD60190455261A124F676
MD5 SHA1 SHA512 TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Roaming\Wand\Cache\Cache_Data\f_000003
Size 809KB
SHA256 1b488327428ab7a76bcc9152831a04075bf0a0d30e7d8c57a066204571f86305
MD5 0613e554e773dbedacca6120cfb04899
SHA1 6c0de6e0e5c9df6b85bba0353dd75b38f6179e0c
SHA512 7447e2f5b4baffc7935c4b66aeed9d3b09e082d63bd3a1b923ba6d04a5154ff7338988d6e9d066a5383bcf0ff6df141db5953b0a912fd9d0fa4d88e90e139476
SSDEEP 24576:Wh5jol3VPwg9yeBff3Qu9cSFwAWIVKI3mpX:itovPz9y+f3Qu9rFwYlc
TLSH
T1850523CFC7A5F026CD84D579E9F3FD4F2FE1349052992A054AA14A89C65172FE2C2076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Wand\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 347283612c901ce5d7c0b66d17570a68cf117246accaf4e1b4c1ff256697e300
MD5 07e283c686be18a902b53509c481c668
SHA1 ab77b9511e32634816dd70f743550884ce82644a
SHA512 355ddda83f97d42e8ba26b30f3b6f47bac78b00418fc3e1a64181d51b03978b4ee70611351a067b03338de8aa2990ef51184fb5fe460524008c0a82ccbe5d154
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 1KB
SHA256 73b95341156b9515e067cefbf202a973654ceee4537f52448adf0462195f81c0
MD5 9dc45221e7ab15a3bb5a8a6ce8c6d2b3
SHA1 540437a92174c9e94e7aa859b3e1ceb8671093f8
SHA512 0193fd365bf631a9f9ebb5fd40644a45823b44da821c28ab3e0cfc4b5e8eb2a96e3c53fcc7c0d5f26dc062aa880cfe4d800b1348586bd168e7ab44fbe080b1bb
TLSH
T1CC2145C7C3E8063D8A6623F42E247A23C2BE490C535C7C468DD5DF4F5BE64B1466169E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 2KB
SHA256 84542035c8e2ea8103f83ef9dc29982e219630a19dadd4add2876077118c31d3
MD5 4017a89099e2789d97589b55fb29d472
SHA1 f08ddc5d5bdd48268b3e89434c7d9c145cecb57d
SHA512 5899c8f536cd05dcc51d309596d9da468b697d8112f343b4160e97b55ec9343272072fa1c19410815ea14abc694e37d1b8acd4c407788847d04bfbf94a88272a
TLSH
T13A4168C7C3E8462D856623F12E243B23C1BE091C431C3C468EC6DF4F6BE6471466165D
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\Network Persistent State
Size 2KB
SHA256 9637b91e5d8e9122181e9b84d39d85a77477e146b0101fa2ceae76cee569bc32
MD5 f2b1231c4734f23c0e8bcedf3716f97a
SHA1 6078a64a43cef1f35e1e3655486254e3835f4ec9
SHA512 2ed32a5bcdaf95945c0ba7f4e958fabdd46db17775fb8b53dd7db952a52ff6d78547e9c80aa7497e20e00f65c615b0b4919e8de7cf8b0413c1c86a5ed67411c1
TLSH
T1A051ACDBC3E8463E84A267F52B207A23C1BE095C53687C46C9C8DF4EA7E1872965158E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5f30026c255c5415755bb073fa8b425bd4cb6a5d0fad0a6efc147c20faa493cb
MD5 cdd19529d81ef8c228964a3693db0a0a
SHA1 c3af05fe626802bca236ec33243b5c0910187483
SHA512 567fa623a7a46b3fc36cf18525392642780a58a00faf56add08cc7e084600f01d2c2a8fdf0f57d2fc3136982aa2d50f152cd479fb57703109a967d5a9cea5464
TLSH
T18AA0025142A18337D80D12F011751AC8236869354501632797A0C2AB9C9055D51AE440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ef933.TMP

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ef933.TMP
Size 48B
SHA256 960ef2c79005a83664da52ddb73b52fc954b038c97138db3940b813e4dec4794
MD5 17e68aa32fbf84981bd5b04f520ee74e
SHA1 655353bbfba0987c48d00cddecea969ebc5b88a9
SHA512 c2c6fe563992719b7c22d1b84a54a08acbb0e9ff0837ae9d96473cd266ce5ee83b7928247805a452f9dc275b7e1f505c400f2d5118dab1901cc7f0a5286a0240
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Wand\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

memory/1320-316-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-315-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-308-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-516-0x000001D0B2B20000-0x000001D0B2B8B000-memory.dmp

Download

memory/1320-307-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-306-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-312-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-313-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-318-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-317-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/1320-473-0x000001D0B2B20000-0x000001D0B2B8B000-memory.dmp

Download

memory/1320-314-0x000001D0B6F80000-0x000001D0B6F81000-memory.dmp

Download

memory/2380-501-0x000000001B8D0000-0x000000001B93B000-memory.dmp

Download

memory/2380-500-0x0000000000EC0000-0x0000000000ECC000-memory.dmp

Download

memory/2380-493-0x000000001BDE0000-0x000000001C308000-memory.dmp

Download

memory/3056-337-0x0000000000010000-0x00000000001F0000-memory.dmp

Download

memory/3056-383-0x0000000002350000-0x000000000235C000-memory.dmp

Download

memory/3068-394-0x00000000018E0000-0x00000000018EC000-memory.dmp

Download

memory/3412-133-0x0000000000BB0000-0x0000000000D86000-memory.dmp

Download

memory/3412-367-0x000000001C0B0000-0x000000001C0D0000-memory.dmp

Download

memory/3412-369-0x0000000001530000-0x000000000153C000-memory.dmp

Download

memory/3412-377-0x0000000001530000-0x000000000153C000-memory.dmp

Download

memory/3412-370-0x000000001C470000-0x000000001C4DB000-memory.dmp

Download

memory/3412-378-0x000000001C470000-0x000000001C4DB000-memory.dmp

Download

memory/4936-530-0x00007FFE4A8A0000-0x00007FFE4A8A1000-memory.dmp

Download

memory/4936-531-0x00007FFE4A2F0000-0x00007FFE4A2F1000-memory.dmp

Download

memory/5068-586-0x0000018A66280000-0x0000018A6628C000-memory.dmp

Download

memory/5068-496-0x0000018A65DC0000-0x0000018A65ED4000-memory.dmp

Download

memory/5068-1154-0x0000018A00830000-0x0000018A0089B000-memory.dmp

Download

memory/5068-822-0x0000018A00830000-0x0000018A0089B000-memory.dmp

Download

memory/5068-587-0x0000018A00830000-0x0000018A0089B000-memory.dmp

Download

memory/5068-497-0x0000018A662D0000-0x0000018A662F2000-memory.dmp

Download

memory/5088-115-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-35-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-120-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-305-0x00000177F16B0000-0x00000177F171B000-memory.dmp

Download

memory/5088-390-0x00000177F16B0000-0x00000177F171B000-memory.dmp

Download

memory/5088-79-0x00000177F16B0000-0x00000177F171B000-memory.dmp

Download

memory/5088-39-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-38-0x00000177F16B0000-0x00000177F171B000-memory.dmp

Download

memory/5088-37-0x00000177D5EB0000-0x00000177D5EBC000-memory.dmp

Download

memory/5088-36-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-117-0x00000177F16B0000-0x00000177F171B000-memory.dmp

Download

memory/5088-389-0x00000177D5EB0000-0x00000177D5EBC000-memory.dmp

Download

memory/5088-1-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-2-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-3-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5088-18-0x0000017FF5030000-0x0000017FF57D6000-memory.dmp

Download

memory/5088-0-0x00000177D4210000-0x00000177D423A000-memory.dmp

Download

memory/5088-34-0x00000177EE900000-0x00000177EE910000-memory.dmp

Download

memory/5448-1102-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1106-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1107-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1108-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1109-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1110-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1111-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1100-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/5448-1101-0x0000029A924E0000-0x0000029A924E1000-memory.dmp

Download

memory/6628-1340-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1341-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1339-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1343-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1348-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1347-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1346-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1345-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1344-0x000001B289DF0000-0x000001B289DF1000-memory.dmp

Download

memory/6628-1350-0x000001B2857D0000-0x000001B28583B000-memory.dmp

Download

memory/6628-1351-0x000001B2857D0000-0x000001B28583B000-memory.dmp

Download