c4734db7ae9fc5fd8ac89c2ba1d46c1d092ec93472cab920bbb552782a4bc006

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
170s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wand-Setup.exe
Size 169KB
Sample260527-pc7e5acy7k
SHA256 c4734db7ae9fc5fd8ac89c2ba1d46c1d092ec93472cab920bbb552782a4bc006
MD5 cded54501727573b813e100b598db7df
SHA1 c60a09a061e7af0dfea69267e7de5b74bab459b0
SHA512 21e54a6a909dd42df134088d0d707cb8ffd5d8a84512079f81adcd11dcab25ab76dc80b03fe2bc63efb4ede259ef3bbee3bd4b3aab2765d8c2c3007b6b643b39
SSDEEP 1536:lJJLxy9zyuQycljyaYeNl6amgLMbtYcR/8t/QiT0FN1E3ry9zyuQyNVEn7:5Lx45QyUyhaEtHZn20FbE3r45QyEn
TLSH
T1A104ADD4F7F905EEE6BB8DB24C310DB016B7BC8205D5DC4A2A84B0B986637541436BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery spyware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
59	3284	Wand-Setup.exe
109	3584	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Wand.exe

Executes dropped EXE 15 IoCs

pid	Process
2632	Wand-12.26.1.exe
6036	Wand-12.26.1.exe
4332	Update.exe
5292	Update.exe
5416	Squirrel.exe
5372	Wand.exe
5328	Wand.exe
4952	Wand.exe
1312	Wand.exe
3640	Wand.exe
2856	Wand.exe
4748	Wand.exe
5516	Update.exe
3636	WandAuxiliaryService.exe
5732	Wand.exe

Loads dropped DLL 19 IoCs

pid	Process
5372	Wand.exe
5372	Wand.exe
5372	Wand.exe
5328	Wand.exe
5328	Wand.exe
5328	Wand.exe
4952	Wand.exe
1312	Wand.exe
1312	Wand.exe
1312	Wand.exe
3640	Wand.exe
2856	Wand.exe
4748	Wand.exe
3640	Wand.exe
3640	Wand.exe
3640	Wand.exe
3640	Wand.exe
3640	Wand.exe
5732	Wand.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping956_1094626158\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping956_1052215369\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping956_1052215369\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wand-12.26.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wand-12.26.1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3584	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Wand.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "35"	Wand-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	Wand-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com	Wand-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com	Wand-Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1"	Wand-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	Wand-Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "35"	Wand-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com	Wand-Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "35"	Wand-Setup.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243576088432624"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wemod\shell\open\command	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{85385587-CCEF-4FAE-AEA5-5EF941A7D7F8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wand	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wand\shell\open\command	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wand\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.26.1\\Wand.exe\" \"%1\""	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wemod\shell	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wand\URL Protocol	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wand\shell	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wemod\shell\open	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wemod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.26.1\\Wand.exe\" \"%1\""	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wemod\ = "URL:wemod"	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wemod	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wemod\URL Protocol	Wand.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{BC7A03B3-C6B2-4B10-83B2-866B4B2E8EF3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wand\ = "URL:wand"	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\wand\shell\open	Wand.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5292	Update.exe
5292	Update.exe
5292	Update.exe
5292	Update.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3284	Wand-Setup.exe
Token: SeDebugPrivilege	5292	Update.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeDebugPrivilege	5516	Update.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe
Token: SeCreatePagefilePrivilege	1312	Wand.exe
Token: SeShutdownPrivilege	1312	Wand.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3284	Wand-Setup.exe
3284	Wand-Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 956	3284	Wand-Setup.exe	106
PID 956 wrote to memory of 1788	956	msedge.exe	107
PID 956 wrote to memory of 3584	956	msedge.exe	108
PID 956 wrote to memory of 4864	956	msedge.exe	109
PID 956 wrote to memory of 4864	956	msedge.exe	109
PID 956 wrote to memory of 4864	956	msedge.exe	109
PID 956 wrote to memory of 2244	956	msedge.exe	111
PID 956 wrote to memory of 2244	956	msedge.exe	111
PID 956 wrote to memory of 3864	956	msedge.exe	112
PID 956 wrote to memory of 3864	956	msedge.exe	112
PID 956 wrote to memory of 880	956	msedge.exe	113
PID 956 wrote to memory of 3864	956	msedge.exe	112
PID 956 wrote to memory of 880	956	msedge.exe	113
PID 956 wrote to memory of 880	956	msedge.exe	113
PID 956 wrote to memory of 3960	956	msedge.exe	114
PID 956 wrote to memory of 3364	956	msedge.exe	115
PID 956 wrote to memory of 3960	956	msedge.exe	114
PID 956 wrote to memory of 3960	956	msedge.exe	114
PID 956 wrote to memory of 3364	956	msedge.exe	115
PID 956 wrote to memory of 3364	956	msedge.exe	115
PID 956 wrote to memory of 3992	956	msedge.exe	120
PID 956 wrote to memory of 3992	956	msedge.exe	120
PID 956 wrote to memory of 4876	956	msedge.exe	121
PID 956 wrote to memory of 4876	956	msedge.exe	121
PID 956 wrote to memory of 980	956	msedge.exe	123
PID 956 wrote to memory of 1900	956	msedge.exe	122
PID 956 wrote to memory of 980	956	msedge.exe	123
PID 956 wrote to memory of 1900	956	msedge.exe	122
PID 956 wrote to memory of 4724	956	msedge.exe	125
PID 956 wrote to memory of 4756	956	msedge.exe	126
PID 956 wrote to memory of 1620	956	msedge.exe	127
PID 956 wrote to memory of 4756	956	msedge.exe	126
PID 956 wrote to memory of 1620	956	msedge.exe	127
PID 956 wrote to memory of 1620	956	msedge.exe	127
PID 956 wrote to memory of 5244	956	msedge.exe	128
PID 956 wrote to memory of 5244	956	msedge.exe	128
PID 956 wrote to memory of 5316	956	msedge.exe	129
PID 956 wrote to memory of 5316	956	msedge.exe	129
PID 956 wrote to memory of 5708	956	msedge.exe	130
PID 956 wrote to memory of 5708	956	msedge.exe	130
PID 956 wrote to memory of 5468	956	msedge.exe	131
PID 956 wrote to memory of 5468	956	msedge.exe	131
PID 956 wrote to memory of 5516	956	msedge.exe	132
PID 956 wrote to memory of 5516	956	msedge.exe	132
PID 956 wrote to memory of 6080	956	msedge.exe	134
PID 956 wrote to memory of 6080	956	msedge.exe	134
PID 956 wrote to memory of 6080	956	msedge.exe	134
PID 956 wrote to memory of 5356	956	msedge.exe	136
PID 956 wrote to memory of 5364	956	msedge.exe	137
PID 956 wrote to memory of 5372	956	msedge.exe	138
PID 956 wrote to memory of 3544	956	msedge.exe	141
PID 956 wrote to memory of 2632	956	msedge.exe	142
PID 956 wrote to memory of 5928	956	msedge.exe	144
PID 956 wrote to memory of 5928	956	msedge.exe	144
PID 956 wrote to memory of 6036	956	msedge.exe	147
PID 6036 wrote to memory of 4332	6036	Wand-12.26.1.exe	148
PID 2632 wrote to memory of 5292	2632	Wand-12.26.1.exe	150
PID 5292 wrote to memory of 5416	5292	Update.exe	153
PID 5292 wrote to memory of 5372	5292	Update.exe	154
PID 5292 wrote to memory of 5328	5292	Update.exe	158
PID 5328 wrote to memory of 4952	5328	Wand.exe	159
PID 4952 wrote to memory of 1312	4952	Wand.exe	160
PID 1312 wrote to memory of 3640	1312	Wand.exe	162
PID 1312 wrote to memory of 3640	1312	Wand.exe	162

C:\Users\Admin\AppData\Local\Temp\Wand-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Wand-Setup.exe"
1⤵
- Downloads MZ/PE file
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.wemod.com/client/download
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e8,0x7ffbb3f2c188,0x7ffbb3f2c194,0x7ffbb3f2c1a0
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,5330537356886113018,995759430967909990,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,12513348875387358262,14909625729545910911,262144 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,2546567319864641843,16552767509369986109,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:8
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11192147489483430507,13288796459775850439,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,546886561931931336,11668133862631041579,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,4042161171125623958,10352686927166510454,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,825729488701202511,5283936989315331793,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,1623510869533332493,8909354087969273338,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,16510283570820646221,9499055313766005063,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,2518612452669526979,6100408257516251177,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,10854959468408148622,17050185357642940975,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14762987162424667620,7173459859856229201,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14762987162424667620,7173459859856229201,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,4358753493843210454,10738424402942067441,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6344,i,2072153268363014885,4163094783657652260,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,6045584359686558975,4838222447897779309,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,6954584667820546916,7162666937025188490,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,6176584439989485381,3999683391913818191,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,9114209144749080971,15606501961694659655,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,9803582424904536907,14382094732224216932,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6588,i,14185953715083596719,9751387993197150045,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,10594581759514911701,6584251116597211720,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,7805487321631282115,16038186241020616867,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,10396569887197728154,5374491948029446372,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,16878799127421952084,7125960760766964858,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
    3⤵
    PID:3544
- - C:\Users\Admin\Downloads\Wand-12.26.1.exe
    "C:\Users\Admin\Downloads\Wand-12.26.1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5292
    - - C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Squirrel.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        5⤵
        Executes dropped EXE
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe" --squirrel-install 12.26.1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe" --squirrel-firstrun
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe" --type=relauncher --no-sandbox --- "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1872,i,10674209377255067952,2869636271008213924,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --field-trial-handle=2296,i,10674209377255067952,2869636271008213924,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2492,i,10674209377255067952,2869636271008213924,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:1
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
        
        C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe Wand\Support_1779884081058_Out
        9⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Wand\Update.exe
        
        C:\Users\Admin\AppData\Local\Wand\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.19041
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.26.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4876,i,10674209377255067952,2869636271008213924,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wand.com/oauth/authorize?response_type=code&client_id=infinity&redirect_uri=wemod%3A%2F%2Foauth&code_challenge=CVAXLSLRsgpBzML8_jwFB11A1UkdouG9TJNTgYG4gVo&code_challenge_method=S256&state=L2BmvdtWing6GUCwEcEpHHRiLsfWG9eIcqz8EE_7_CY&provider=google
        8⤵
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://wand.com/oauth/authorize?response_type=code&client_id=infinity&redirect_uri=wemod%3A%2F%2Foauth&code_challenge=CVAXLSLRsgpBzML8_jwFB11A1UkdouG9TJNTgYG4gVo&code_challenge_method=S256&state=L2BmvdtWing6GUCwEcEpHHRiLsfWG9eIcqz8EE_7_CY&provider=google
        9⤵
        
        PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14570764145162513295,16192890023710403560,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:5928
- - C:\Users\Admin\Downloads\Wand-12.26.1.exe
    "C:\Users\Admin\Downloads\Wand-12.26.1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      4⤵
      Executes dropped EXE
      PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,1201046650884474242,7276505524037104459,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4260,i,3876197178588267252,2279636899000630058,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12015133866827015685,11019647855865751222,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5372,i,13299380217701942956,15797939051843908272,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=1832,i,6858700768065086536,8517679890121091810,2097152 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,7746185092590331130,6397545010543778568,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,1831936041144835516,4312297079778534135,524288 --field-trial-handle=2296,i,18367810620023820614,16139380224034589345,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
    3⤵
    - Modifies registry class
    PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping956_1052215369\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping956_1094626158\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 41400d7f1c30efcce7823b6858e5505c487de073da2aac9c6463ed903709104e
MD5 6a7fce5ca80365dc1b1caa3643b71f0c
SHA1 a0c42a07ad6166bfe3a972b085686445d68d86d8
SHA512 13d29502a4fc2cd142300aea4af64a0b20d1fb42c4d0ebe0ae1503806ec2d2dc771a820dd7866e9aa0d4d0967b1562ded3c7c7eba6c3f8bb7ffdb55ed92e230a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T145B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9c7f53bb7f47324e773dc8209de0171e01f576e519c0d152b637061e4cbf2c61
MD5 042dac63e59a4b699442551eb0d72e80
SHA1 aa3afaa5a23494ad88bb14b327437cfd3ee2036e
SHA512 a511042ec53a0bc05fec3dea929e93e974a2c5a843beb466f1bd1324787a689bd033b631fb67634473084177e5f4836ffbae0c5833f1755181c9c895f5050b8a
TLSH
T1C2D02374FE1198E2D13A717B151943051FCC4873111311A85B282C2CCCF58C6C8D1E96
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 348c6aa92121a8f0b50ce9cf2c4dd8032844dffd672a35e5f31bedb0b3ab4d75
MD5 238ea4464d48b7ddf903d08a298a3163
SHA1 c126da624bfc0d252ea8bb42301a7a6e6cf12109
SHA512 a03bc0a449ebad99c7bb4e09dde2ca7eb25867886ee02e4e1f0500516e5ea6cb81aed99655874b490a8edbad83dbf8cc81b7e1adc65a1d4b9397b978f2612fc5
TLSH
T1487127340E4900A1FF200A33D4D50239BC72AAEFF61E2E56234D6675E60634A139C55B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2c58b10f207a6d836e60c543518a2c1a4480b5fd1ff0b7117d8119efacc32b82
MD5 c18cd6a18ca3d415dbc1e884b0547eb7
SHA1 020911910b365bbeca30b4518410ed8e69878fb3
SHA512 3dca957581ca2578e8ddbee4a027cb3af71e84c2e51893c5c9249866f74dc519c13ca136c20763e31b2d12289add0a600514195345d786faea0a2042ae4f8f94
TLSH
T1427119340E094091FF200A73E4D50639BCB2A6EFF65F2E56236C66B5F61734A13AC55A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591a83.TMP
Size 3KB
SHA256 db8d56d7a5e42b3f4c0e6d7f831aa45095aee2dbc122af39f155467faac07801
MD5 7be16df3266dd96050519175e55cfa14
SHA1 98a52bd8078d000829ad26da232c19eda39497c0
SHA512 6746f31e27752ef29402a05ba1a8f1a62a56377af255ba8b772c3ba87e3abe11154a393065f9c522855de31007caa702925133bab7ad88132f09459447d6feef
TLSH
T1CE7127340E0900A1FF200A33D4D50239BC72AAEFF61E2E56234D6675EA0234A139C55B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 09b1436ccdfe3159046597d6cbf52620303ef79a97742376220021628b99c194
MD5 1555ae5913e4af0474708293cc738acc
SHA1 a4aba0aa174bb34bf9cc9de1f01d627c01f30b35
SHA512 6f12d1b4825249bd416b8d58856252a27ac7d2075b9641c3688b933f4d52845f179a70ec6f63d29fef73ffdb5df08833f11f7ed2641ff5ef2511509d446afa92
SSDEEP 96:DmHOB7CzBWP1awIS0MdGgJsJrJZ0BLJI2w:DmuB7C9W9atS0IG+ClZQFIj
TLSH
T11E917EF7C3E8862DC91156F4AB15AE1FCE1E0514932C3D6AC9E4AF1B93E2871E101A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7702efac3c0583172c131f935c4ded4e78447a148c9afc4a05b079b963c58dc8
MD5 fc9cd1a87bc79ef876bec6c2ec037f77
SHA1 6685303df8b6d64eb7a8e7dfaf95b8735a86ef59
SHA512 a247c0f212d02daa6f0b604a9e9fc3a068e7a3fdc4634c7df2b48b87f494a60d0dcedd4655425fa2eedbff721ed22679031a838aa6d2f980f2fa0e3f66cdf05f
TLSH
T1F9517FF3C7E8862DC91156F0BA14AE2BCE5D0914932C3D5AC9E4EF0B97E24B1D241A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d7d8cbb2ef9d68830af7ff6683b7efc86b5b0b9500744548cb611f2c782de987
MD5 fc86c6d3518298901e0f2a30891e074f
SHA1 f4c2eaacb2b032470e7d80977d35ffb683168b71
SHA512 2503119b3291a03cbea2218c9a9b2edad732bd2fec859ac2a4b72ea1d25d4e620d89d7e03a30460257e1a10d248dcf00d83aeb43617eb1c4d770d630e7a66c0d
SSDEEP 192:sxZNRSyM/jK1Ml8Mz//f7sU4+QTqiZvM/QTVpIdpJHW6+WNGYvbjZFIg4J:sxZNQL//f7sJ+PkElJHbGKjc
TLSH
T12352F812AA349977CCCBD20DBA55BF53D6F9546392840D489AFCCB1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd871e3a49a60e80741a814be562120d2a1d273da6e27309c68eb4bac603bdf7
MD5 603a4139d361416eeb44ea2d7da36b83
SHA1 2e5f2bfba4dee2585ebbb4673203c252c5b76c04
SHA512 4e8d3e62b074c95d1309e12fd0e4af74cd71b0a04cca13db9113b7292c00512c56b3f8808fb95dd677031155d22d755a0c1ff7076c45eb42ceb50260f9359a5b
SSDEEP 192:sxZNRSyM/jK1Ml8dm//f7soWpV14+QT/iZvM/BVVpIdpr/+HW6+WNKj9J/YPCjO2:sxZNQR//f7soWv++ykE4yHbW/xqO
TLSH
T10B62D616BA38597BCCD6D21DFA55BF53D6F9146292940E449AFC8B1C01E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c644dae2eb356d1fc97f6f296eb6631c8b96101f62d99a892fb07e064f1a0a40
MD5 607807fb7a31f5ff1c113b8e5afeda12
SHA1 e3be459bf45852d53d25b944077dafdf7bac6882
SHA512 6d70379cb02466bb30186a5194df6d26bfa9b8585d67fbe3694c176e32be152ffe9114b851f29ed0969d3ab4975d7e5a3f4c13b5d900da86b3008c5c56119e07
SSDEEP 192:sxZNRSyM/jK1Ml8Mj//f7sH4+QT/iZvM/QTVpIdpLHW6+WNGYvXjZFIg5lYJ:sxZNQb//f7sY+ykElLHbGMj4
TLSH
T13152E816AA385977CCDBD20DBA45BF53D6F8546392940E449AFCCB1C05E7ADC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3c3362c732e12e8d1fe0f124f92b24af2af24d94aecda5c969734d39acbda4b5
MD5 972c789d375a6168f6cd95e8fa7c4dcd
SHA1 b4752da4e21a9cbf72db5f294efdfb8ca5ea661e
SHA512 801ebac61c7ded556a7a9ec0b9c093763bca305504ff72962e3ae98ea1748d059629039b39f26ba77ebc15b6640a0a7bb815cd6bc18435455cef931c5fe96f42
SSDEEP 192:sxZNRSyM/jK1Ml8Mm//f7sH4+QT/iZvM/QTVpIdpJHW6+WNGYvXjZFIg5lYJ:sxZNQu//f7sY+ykElJHbG0j4
TLSH
T1B152E712AA385977CCDBE20DBA45BF53D6F9546392940D44AAFCCB1C05E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1b162810d7538d4de22f6d631016d826848197b1f478cc169636d9df3f18a39b
MD5 eaa8d1f031750f9adf4ca0af56a78d68
SHA1 be09feb4e0b0fb7f348258389f50b8cd30fb7aaf
SHA512 6abf88c61b95d2f840bfc4dca68045667d3012e661de7e47203413c00e9e59b6bfc948f8dc805211bd95f10c45ba299d375eaa5139d74235c655af4552853dcd
SSDEEP 768:TvseJCL7pLuLXhxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZT8cLly0pporoP:TvseJCdEXhxWvhfynu1jaUT8cL88pTP
TLSH
T18EF2EB3B680CCB7E4F844E9CED2A7F9A6EE801CB56D8899447F9880C02C76EB15175D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d82c15328616ad3485c4221e7a3e47e67d43d788b0d64ec6e09c9544559e0121
MD5 7fbb0a4621203752a10154350532516b
SHA1 87ed5b124f3ff76c3583f869c218cb1007aa3060
SHA512 eb952b77ecb60643d9a78e150d45dc89e592dc8ecc8defef48dfba329e15abcd10f52180c2c0baf0567dd65d128a6723d931c7aa0f42357928d5103d78367c81
SSDEEP 96:KYH+KggmiAgK1KyODKKkU2yesKLiVs/4MCV:49vnJhHM
TLSH
T1EDC1B812713F02023C7F354CB2A6A6375E4135A3355868AF7FB810A55E6AE216DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c25c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c25c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ca0ef8bae20b9d181d1bd15db535117c818b50db2d38f436e249eed7c68ba331
MD5 8074569e7369a1fd4b89e77ecd1ae773
SHA1 21038fc157517736263b19b794321b5e9830c07a
SHA512 d604d15f43bf284460ba98551173301f0b5b31586737f721b203c965a408a378a25ba1bf1c776bfe8dba0c010964e333bf66e629768c12be549a293dd4856a0c
SSDEEP 192:uu4TSNWMsnMwy8Hrnb91MsNRLQWjVM7FbbQmiU1Ypcr4MTW0+FdLuhpFd3EZe8zB:nOtNnNnb9+sNRLI7hNAc01dyZdUtl/N
TLSH
T18A625D316D396C67A9E7B255F04B37531FB460BB99C42E54EAED5F0D01C729C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 db9a56f57f579a3a655ba870dd1b7b156b39ad0c5605a47a4512a000fdf06fbc
MD5 f7b4a432107365c752b72b7c76c01d07
SHA1 ebe3e219fc20440d7ec5457e11569b8a247ce5b3
SHA512 9ba1f4be5c3fee628c861588d047f563721ebdd50e2cf62973997e13f03e48327cdddee63477f699d911719f8fe1ad56b9f8f10354f59e70262198bf38e37020
SSDEEP 192:uu/XTSNWMsnMwy8Hrnb91MsNRCQWjVM7FbbQmiU1Ypcr4MTW0+FdLuhpFd3EZe8t:n/DtNnNnb9+sNRCI7hNAc01dyZdUtl/N
TLSH
T10E624C716C396C67A9E7B255F04B37531FB460BB99C42E50EAED9F0D01C729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0d52cb83f196980d919be5938913c938571bc95bcdc3df736daa038f2efd98b4
MD5 4910dba662e6fdd277738ffaccd2b4e5
SHA1 6b4f22962ae8372befc7389f9859c1e361baa4cd
SHA512 606556b3982811708884dbd34457c0cd85a3177da02ec9c31a2d546eebd61665efbcec689685fda6a776cb3f45664230d06cd12be451169c54ffe8deb34e2e25
SSDEEP 384:nnziFYtNnNnb9pLsNj8TUNTUlIluI7h6Ac05Dfc5dyZdUvl/N:eFYjZbPqwgPsz5kUvl/N
TLSH
T15FA2F772E865DA6BBDF7A781F20A76879FE011A789C85DD4EAD95E0C00C32DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 504d88e780ff5aaa7e3fc94818201d6cfc57ae18a6fdff276b703b9f059f363e
MD5 b2afbbf12039f9f6d47cf3a8257e2934
SHA1 96184ca01614185538d51d3af9ce8c23b6f6ba16
SHA512 7db52db8139dda95c8467bcb18c1f3dc1b7d5528d37dc11c21bdef975ab62b69226f96784d4c910be3ac3ee194d77a10313a0aa42ee9a523c86b39b9e7d9e627
SSDEEP 384:nnziFitNnNnb9pLsNo8TUNTUlIluI7hcBl25ift5dyZdU2ad2v57SBbc/k59rkck:eFijZbPLwgPIl75kU2a+ZSP59lu/N
TLSH
T143C20A71D8A4CDEBA8E2E7C5A206F6466EE40173888C599CE6F87E6D308F5FC1706C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4193a50b60b7d56be170a0368b9d38c8aab4b2fb6c756bc9099bbedde1d84969
MD5 df38cf5936ace04239cf480920095e44
SHA1 9c9af47fb55d834a6864143e8d5587016874ec08
SHA512 fd6cacf1902c7a25fbd1638d686b3e137749bc87ac07319f92f824637fb0d4ee73906008c62f348927686f9c0c748ce1758261d52eda7d59c00d884efa7556cd
SSDEEP 192:lON06vMtPQmiUyleThTW0+FdLuc847EbLU/u:lON06UtRfTudy+ILU/u
TLSH
T1BD020935AC786CABAAA3AD45F48A37171FE4507BE6D05B50EAE82F1D00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 73c26858047de530b4c21ea01d1cb4d8c4f70399556bc1b4171e2cbd206e5ec6
MD5 2e8ece4aa55befc2fec7fdb30194d316
SHA1 cd209aedb4780d1e2347fc6b71b2c2cbd4313c9f
SHA512 2f76316103205e2d22745dfdaf5e044838d80719db71a509a168f73bbba7a7f1265902b370644fde604f3a5ca3d114de057be63771ef02d21c7dd1d7cc377997
SSDEEP 192:uu/XTSNWMsnMwy8Hrnb914sNRCQWjVM7FbkQmiU1Ypcr4MTW0+FdLuhpFd3EZe8t:n/DtNnNnb9SsNRCI7h0Ac01dyZdUtl/N
TLSH
T19D624C716D396C67A9E7B255F04B37531FB460BB99C42E50E6ED5F0D01C729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7ecd1228d98952814eea565640657dad848a6663e4e88c964241cefe20fa7a90
MD5 b881fe551908dbd87a4a3a7627be1b43
SHA1 1c0601832cd3a6b145fc4b8a6f41f336c885a0ed
SHA512 543d0c7c0d3952e074430e61b77ad830bd9c31ddd13d1565256843af0bfcca3da829673a4830314d938e3fc2811d5e13beb2767d061c2ea1b04a0f8eea0afaef
SSDEEP 192:lONs6vMNPQmiUy3eUhTW0+FdLuhpFd3EZo80I4r/vYU/u:lONs6UNRPUudyZdUDlU/u
TLSH
T1C5121971A879AC676993B145F08A33971EA420BBDDC49F50FAE85F0C00C779C270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 92e7ed788119cf8c562023440291b469c81cb6b3a313c635c69f842a570f803a
MD5 2b53d143278baea9ddd0b1193130d235
SHA1 81eadd3bcd99931b3b247c08b1417411288c71b5
SHA512 fd3a08ef2558efacd949e1916e8fb0fbdd9e0da26f65a86923a6bdffeb2c5642250eb1cd84e2a40b1c7f4a28fc0c5e6232dcb02b9736132ebbd7898d58b1f73c
TLSH
T14B412958A6EA0108B7776F5A9FF6A86D487B7C372F0AD45D00110E4F4963E41C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 77B
SHA256 be72813fbfd4cd330bd7d162a6818d55c6c46acf2a8854725a6ec37ec8e196ad
MD5 1fb6f4e8b04be5b91feabfc345b2eb94
SHA1 ec4110454d0e71eb3ba66f7ff6e9ccacbe897e31
SHA512 750e1a8d94b6b76c002c1e8eb8a3a6739da851267df4e785c9be377298e1a66a5ea709a0936abdde3d0e3fa169fb9d741f71b3a9bb41ba5f74ca4f34417fe12f
TLSH
T1CFA012744981306C4C460B03044491115D00315B13E1504E189BC501242124A1211C40
MD5 SHA1 SHA512 TLSH

Submit Download

Squirrel-Install.log

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Squirrel-Install.log
Size 4KB
SHA256 d0d8e0b4c94aa540408eca0ecb415ce87c9ceb5c2ee6589db48520d489f6d3cb
MD5 a5c12ee12bf7e39884b1250a6021dccb
SHA1 10be925e0845543dd023aa809493995d050a47eb
SHA512 87596da669c4c42ff8761ed8113ce115e2f83a41ec00e5ab284da31d9ac786e37bdd22fdeca27147c7431eb51f4b1a63535c90a3aa7fd96f513ea1125598c5f8
SSDEEP 96:Cesxh9E6OX2qMjdAjAYAtAM/q5E6OX2qMjdAjAYAtAN:C9KXTMjdUJAT/wKXTMjdUJAm
TLSH
T1DEA13F6983EAC1B320C344A75E7680C1D9F3D70C2570BA85F1E4841AB7E306E87AF796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 a7329d187fdebcda23cb0bcb24f49c5b33ac7b1cdba713db32765f28fdd9a52b
MD5 d47ea88518236801f66e24c23cce6ed1
SHA1 e3f76803e7aba7041f2f55080f25a655ac382154
SHA512 36bc197311c2111beb3eda86dfa36f02c24b6ac8d09b0d4ae221a6cba8213172898ec5b29ea6c22b3d4c4619bc471690c9333a0cb072627cb0854b1c25f7d706
SSDEEP 24576:ewRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYsD:VRZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T1B5956B12E7E88F3FE56E27B6F471105907F3E5866362F78B6A0C61B92A833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 43B
SHA256 71d66e87a9561f8cc70f06a466a5f75a77aa9cb55e8795e0539c514eff7cf7d3
MD5 16a098a0d6be1295817825c888a8f03c
SHA1 609b1472e8db8411ee1d8c8240c7a17c2b01eecc
SHA512 6fd899b855845b173295a321488fea2a8bd2081f9afdcee77720df88baf3bdfd761b159123e4343e5aba51d4cf0c8b3c00fa41dc9f3d87a2ff3153d9ee4e8245
MD5 SHA1 SHA512

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 38KB
SHA256 6c9c2af113518416fe5ce94f6e415bd65b18ac1d9fe5f77660a94456c5a7d420
MD5 1d5992317607e5d531cb677a3c873059
SHA1 534210ebbc824f19949683bcd32281ec90b0129f
SHA512 6711816fb473255ea6ad78353f3795fa7808fb99a8d91241dc9fcd33eef125bca4bc05dcfbc1211141109ff8ac5f26152c89475f0df29fe81fe5d5e2a25e07a8
SSDEEP 768:2bZUR9ewbyFBpbqCyAE8QUcWDXpKPnpETPRkmHRY7xLO6WsGeQu:Dy9zyuQycl
TLSH
T192036CE8EAEA15EEC1B7CCB28E320CF07173AC4285DAEC5365899439D293619547364F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c9d7ecb-b625-487a-bd93-e4844ae3eb5e.tmp

Path C:\Users\Admin\AppData\Local\Temp\2c9d7ecb-b625-487a-bd93-e4844ae3eb5e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5d951a5c-e537-4857-9e99-89f23bef8faf.tmp

Path C:\Users\Admin\AppData\Local\Temp\5d951a5c-e537-4857-9e99-89f23bef8faf.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

118f16a4-eb85-47b4-8a68-60aa9e060645.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir956_375519214\118f16a4-eb85-47b4-8a68-60aa9e060645.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir956_491767576\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wand.exe

Path C:\Users\Admin\AppData\Local\Wand\Wand.exe
Size 670KB
SHA256 1e02db1d6d207ea08ba34206696c352867f5b19fc8e6d06e47986c0fa0cfc79d
MD5 9d872e545f5204b1d41865224eb4b03b
SHA1 8719ca9fdc8ea08b4df42e31a82ad6e28761f684
SHA512 3cf79c856d0ffc2eccb06a985d35b43a30d20fa63ac8d79b9ca89963c2b9ede66d8acabe3876b0a0bc850911fb6ed5054a0aae5d3e218cf82338fc19be1d5204
SSDEEP 6144:zZzvhs2Z4n1E7g34XtVYAOfTdo5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rjFXU:zJ+2Z4nShVY5e5KgHUizA1CGpXU
TLSH
T156E48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\ffmpeg.dll
Size 2.9MB
SHA256 84003518c123c56521608e7d872adaeaaa683ffc5844e4b13934721c11c375f9
MD5 b3a6ab1c60c2e9bab3adeede8db8fa62
SHA1 518307c48e72f22cd52bceebed4f99bac028db55
SHA512 4a8843e892677d57c0c3e8b5d2bd7ebe014b2b2ec1d16b03235ebcabf5e84ab2fd82c573e0788358a9126f7a3a19403c126476c780fb891fbc8df80f0b9b1fa6
SSDEEP 49152:GCDRsXoLyeG81NYxzi93BBJkBOA/7ZGddK6BflLQjbIXPuKM5SDz:G1VeGnx6rJkRbImKUSf
TLSH
T1A4D5AE03F6DA50DDD029D470979F9213F671384A8F1166EF26A05A202F67FD86E3E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\icudtl.dat
Size 10.0MB
SHA256 9192f5453665fcfde180f1283f2fbccc477f4daa0081e3903ec02d9242721860
MD5 08096770ed3f7020e3214762629daee9
SHA1 744d66d96d317976a83233adec0f50ca452fe82d
SHA512 534ffc6bbc95dc969fdfeec7f28f23aad30b65a98437db6fcba69a58e585e6e48876882e544f370cb6d6cea008e9eba3667cd8afe589038990cc791c2272a581
SSDEEP 196608:gSPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y8A:g+wkpHiXUxY/iJ53IWhlVjEeIjA
TLSH
T157B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar
Size 45.8MB
SHA256 8313371cafdc565c0f3310c989b027e5975285cea29e2350291cb980f7652027
MD5 7b49e84a23918a8484efafa9548f5f24
SHA1 7da9f30537d9611a446d8532f75b8c0c0688089a
SHA512 f94965579e70408d6dfc87ea14b7d5664a4ab276f39144605264f246ec31470b05660f59fd77f66b19b27631dfbcb2ffeb7a8e229c10ae8e9c4559e3bd0ef636
SSDEEP 393216:3mpp81umtzSRe/34LP6igwUzAbHCfpR+ZcN7lgFsD96U:3m0YZz3gwmgZovJ1
TLSH
T127B7D01DE2B46D7615AA10A620463227B13410A7BF613CECB78CC5AC4FCE98E6177B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

capture_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar.unpacked\static\unpacked\capture\capture_addon.node
Size 353KB
SHA256 2c17b441ef9892bbdbb5c229ce0198746ced6a42118e61e49b69147c86524ec3
MD5 b257aab603be7e231276fd9d1501e6ef
SHA1 5b22c0ff56f81ee9c3deb53a47b12b2e3f40dbd1
SHA512 f92770cbea3b652515b46c66c40a4f5c45e231dafa4d18327d225d276370e404f1a492aaa2123f75596205bb17fb476594c921862af1c8db65a505e6e8d038de
SSDEEP 6144:qBwUknKeSUreO0nj4BPxQUx+zKt26wEGnwAp/j+1:qBwUKKeSFOgjkPxYz02XwA81
TLSH
T114747B1AB7A404B8E477D23C89674A05E7B27C4A0760E7CF23A4435A6F33BE1993E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar.unpacked\static\unpacked\icon.ico
Size 409KB
SHA256 1a90e62ec52c31681af31d9cb4790c8a3af4b72bd8de3a0e937802965a23a38b
MD5 06aa52a7fa25dfc51e7c846172d985f2
SHA1 10adb45e32e5a4831154e5e17425ba3f911bc325
SHA512 b7f3c9c000a8a4af76cf619908177bd29a98a69825e2f711705cdb810bb8c8f4c29ec8c409855ca1d1354dc52c72f4c72100dea24727980d4b8ecd1e4a4ed3a8
SSDEEP 6144:t5Ker1PJVHjMYimBSfN/yw+Aw1ECD45rO:t5KgHaizA1CG
TLSH
T14E947DD5FEE521ECC0BB9C7A4C325D3169738C4698C1EE92588779BC419316A2D332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overlay_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\resources\app.asar.unpacked\static\unpacked\overlay\overlay_addon.node
Size 582KB
SHA256 a17999325b9dfde943b1f3ad3380d683d33a5066860a225da40457f725accfde
MD5 018096035fd5bcefc657364901ae11b8
SHA1 3bb9f95223d6a9c4b319d8cd19a385bdd66b39e4
SHA512 c9f765347e12312abc9a7ea0e3eb30490e7738213caecd86bbc2d531418a956af7934b563b56a2bac658b936cef3ad03d4c7f5daa6061ba431d34bab46a45069
SSDEEP 6144:tj9PTt5UmkURgTbVCyea/tTleN/yH5f2QAHzqKZb3LwXBE3Pkio0pKG42zNKz8gj:t1UmZok+ILcfiPp
TLSH
T1AEC47F2AB6A80379E167D178C9534512EBB278561370A6CF03A15A9B2F277E14B3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\squirrel.exe
Size 1.9MB
SHA256 0cc4a268c01d81174c70394e02835418c64206bf554715590c962ee3a0517c61
MD5 04fd6438fbc7b895a5b8244845be2175
SHA1 ad7a10c6cd2342b5ef04897093b8b3732e5a973c
SHA512 dc842ed00cf9eebf5586e86a08af5b2db416bfa26af34ba25252948e8827a1f5624ba1c765eb96ff8339a201ab4489f176620673cc43aa435d16464405a78d34
SSDEEP 24576:jwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYs2:URZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T1DB956B12E7E88F6FE56E27B6F471105907F3E5866362F78B6A0C61B92B833108D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Wand\app-12.26.1\v8_context_snapshot.bin
Size 677KB
SHA256 4e7a4fd38636f6589a78934e2e3ed8a3698d154665cb3d2a9032b809c9ff1711
MD5 2ccf0037aa83899319d86189f1adf085
SHA1 c8ee1dde65817ccfcc70a3b9e883a90de9e3989b
SHA512 02562a99b5c7fcd83f1ad1758ebad5ffce1cfa8a295a371bee1b95f34f69b74973875a76b3885ead49b7d4d1bb10e954606b0d7081437c69b1eb1f3b16f0860f
SSDEEP 6144:zes4hmb1aXFI1QZtXWO0GZkF8zFylLKR24mCGaG9vzhAJBb4bsgvHc47ACl8dUQ4:ze1hmbI19JA9oCLho4YKvUiFjrD
TLSH
T1C1E470A7FB4ADB23C7C85DB59DE6E6553D75B0CEAF4E812B71080B3D74322A40A0918D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

init.json

Path C:\Users\Admin\AppData\Roaming\Wand\App\init.json
Size 52B
SHA256 2726b0fd300c0d95e21df038af3bbee2d4cb41fd3e68a5f66e0c0408b0cbeb92
MD5 0f7ac79c5f3c1924823f8c042a78ee3e
SHA1 a771710c8335940f1f1cefdb38f8cd970e5d25f2
SHA512 0def76b79086a3a824b000da0bd5bf5dddf75f37cd819438dca41bb3425852e56572389268343121663189727fdd950cd3d0b80da713dac857e1b73c9a2ea05e
TLSH
T1EF9002C42D47207757D1024618D1203568586050C99C04205C66596105D27195243793
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Wand\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 2a9b2d39e8756083686a327afae530b7918200a960aa33bc0327a666e52375a7
MD5 42ba315ca8d511b5bf9c580029c7f401
SHA1 a1219e15bc24bdafe3bb7299c2387b3944b122e8
SHA512 103ce3be1e21651291f17604364a91748bfe84831da41c5c48d5fb6f595891d729159ed8eb48f2ba8c9b3de984ade14c6b6e664b31d6b3c4ed6767267d8ffc1b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Wand\DawnGraphiteCache\index
Size 256KB
SHA256 0705696550a4e1d126496a67ae3a98b67bfc6a1aec4fd5e1d2bbc48cebee474e
MD5 5eaee69c08970ab085f333212724ca71
SHA1 8cad4cf840201e6744377aa4d579ec245b6a66af
SHA512 b64d4e27aec1ad7a87a612412f5687b8f31e2d15d12d389793661a18ac9856ceb7b33e1c263ef9678e3231300b9d54cdb386acfb9098e16dae419b73c27f3828
SSDEEP 3:LstlNllkll/lMo:LsX3lEtM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 924B
SHA256 8c29143ce2698549b58ede36b0ce4c33e045d41e06de0e2348fb1737532de2b6
MD5 b9da57a82ceed870d38dcac35d2d5022
SHA1 a5d1b7d3ff269c80526fdeea3f5e3f82ea8cd5ca
SHA512 f4d37fa4e4172e3e9f2a0a69641f64363b220d203077a9a66f87207061c9152e4bcbb82821a4d5ba91a23e37ec0b066ec8e0423a9a87d8b3eaab40b12dc0109b
TLSH
T1831159D7C7E8067E8A2613F42E247927C2BE0908175CBC828CD5DF4F4BE54B2429169D
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Wand\Network\TransportSecurity
Size 189B
SHA256 f5f3ce23b87c83c9ab83145052b4fca9d4948ccc2cb1c85aec552968691cc30a
MD5 11bcb6676c38fd4a5a52fe13e575efea
SHA1 349f9b0bf1ed90e263f0c858d3e0fb6fae3e505b
SHA512 ecc95df221cca40df1770b0cef596720eb3ba2465d67557734cf9a929262305d212eaae27b3c2cac53332d0bd656ac11e45e171930a6f378c7a3676792b4554d
TLSH
T15DC0221EC729F8B2207C8932A80968427B36D435508088D0EE62802DA2C10F5030A011
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a706e.TMP

Path C:\Users\Admin\AppData\Roaming\Wand\Network\TransportSecurity~RFe5a706e.TMP
Size 189B
SHA256 13161c9e6b7a8330b5339e613ff8c6cbf2ffef8231fe9a1b436399e534d7c75c
MD5 1e39dcd65fb984964aa2594261e59784
SHA1 2f1fc423ec7c2846e125c73d843874d8b3a66e96
SHA512 43bcb39278d5418c146d8f4006be5059f38dfe8e4fb08657f193328a55dd2fcc71070e084b4dcae4cc9911142bb0674e9e415ca8351d45952dcb3bf74c98e773
TLSH
T127C02257C73BF4F2207C813B28005204AB3AF47512A008D0D996A22D62C10F5230A011
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\Network Persistent State
Size 3KB
SHA256 31a31eea275c6d4ec79753bb81bc64fcd1a4681415c6d46c26508a173b7c1ab6
MD5 2e551b63a1ac685cfedea4e17e6bb8ac
SHA1 d36ad9e06d6f9cea6fa4e60b130fd8927426b9e7
SHA512 a7ed49e9497505ce32d897d45375e3aee7dd90c42eb450d0d49ee2adade19268cf6949769d1b6377f5006410947cc89e3002abe9e19e8bd42c251d0565fa1384
TLSH
T1836189D7C7E8463E896263F52F247A27C0BE0A1863683C4788C9DF4E97E5872938159D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 72b735e8236452f2db4649ef65ab103a2700e540b42ad5bb6fbdaf1c96939290
MD5 945efcca413f8c117165f790549b9a78
SHA1 96a1086a8f9cccca43e79949f5cb6495adbfa145
SHA512 d249d13d956412009f23ea2c5085666f86a4f22424062da4c45ff2714d9f6bb69003b00ae424971d045cb09f871b684f35cca7c1147e460acd0364ef5835764d
TLSH
T19DA0023903404A65E00522F0145509BA23B05DF5410B770147A146D7AD903604113140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7c17.TMP

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7c17.TMP
Size 48B
SHA256 03cb6b80f949a7451fab19c46b647c2ab934ad72e67e7b0dc476f6672af455ed
MD5 df054783c0bf2add8fb0ef550bc3836c
SHA1 1c47541927edb7bca6e297f67e992498300e23cc
SHA512 710d5202a333e76184c067d2cf6b00d69c5f1fe33d5d1fd9c3d2517944d6ba1720370c16fa2ea89d1f8e39f359d35287391ae92aa203ffbcbe759f77f797836f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

memory/3284-1-0x00007FFBDC6D0000-0x00007FFBDC77D000-memory.dmp

Download

memory/3284-441-0x0000025D640D0000-0x0000025D64827000-memory.dmp

Download

memory/3284-33-0x0000025D640D0000-0x0000025D64827000-memory.dmp

Download

memory/3284-26-0x00007FFBDC6D0000-0x00007FFBDC77D000-memory.dmp

Download

memory/3284-18-0x000002656ADC0000-0x000002656B566000-memory.dmp

Download

memory/3284-0-0x0000025D498B0000-0x0000025D498DE000-memory.dmp

Download

memory/3636-1039-0x000001635E860000-0x000001635E882000-memory.dmp

Download

memory/3636-1038-0x000001635CA20000-0x000001635CB34000-memory.dmp

Download

memory/4332-622-0x00000000001D0000-0x00000000003A6000-memory.dmp

Download

memory/4332-632-0x00000000206E0000-0x0000000020718000-memory.dmp

Download

memory/4332-633-0x000000001FA50000-0x000000001FA5E000-memory.dmp

Download

memory/5292-956-0x0000000000B00000-0x0000000000B20000-memory.dmp

Download

memory/5416-894-0x0000000000780000-0x0000000000960000-memory.dmp

Download

memory/5516-1037-0x000000001C310000-0x000000001C838000-memory.dmp

Download

memory/5732-1147-0x00000280016D0000-0x000002800177D000-memory.dmp

Download

memory/5732-1099-0x00007FFBDACF0000-0x00007FFBDACF1000-memory.dmp

Download

memory/5732-1098-0x00007FFBDC6D0000-0x00007FFBDC6D1000-memory.dmp

Download