ff4693854f3587bbf170d3f10a60ff8281c0b60500af392712e0cb606fb03b6a

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WeMod PEAK Setup.exe
Size 155KB
Sample260722-rnewcsbj4x
SHA256 ff4693854f3587bbf170d3f10a60ff8281c0b60500af392712e0cb606fb03b6a
MD5 cbf2129d60881d9f1bdae10ed21ead3e
SHA1 7fc6646df52808a6bbf75c6b353e80f51c9487e4
SHA512 644d98c51ddc11e0425e6ca2a5f81afaf0972f6b1ed27cb844f6ae5f67a9c68e6cc4e0c867e07f406b8f2098ce5fd911a4bec6ce84b223bf5c3efc9687253b3a
SSDEEP 3072:w0x45QyUyhaEtHZeO/deV4ILlCI+40OHHBpF:145rUwaEtHUx4SF
TLSH
T157F3AED9E3E815BEE6BB8DBA4C351DB005B7AC421CD5ED5A1D8070A84A33354243BB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	5596	WeMod PEAK Setup.exe

Executes dropped EXE 12 IoCs

pid	Process
5768	WeMod-Setup-639203268306171317.exe
4100	Update.exe
1836	Squirrel.exe
108	Wand.exe
4388	Update.exe
1048	Wand.exe
4896	Wand.exe
2456	Wand.exe
2460	Wand.exe
4884	Update.exe
2112	WandAuxiliaryService.exe
3124	Wand.exe

Loads dropped DLL 12 IoCs

pid	Process
108	Wand.exe
108	Wand.exe
1048	Wand.exe
1048	Wand.exe
4896	Wand.exe
2460	Wand.exe
4896	Wand.exe
4896	Wand.exe
4896	Wand.exe
4896	Wand.exe
4896	Wand.exe
3124	Wand.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WeMod-Setup-639203268306171317.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5012	msedge.exe
264	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wand.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com	WeMod PEAK Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage	WeMod PEAK Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1"	WeMod PEAK Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	WeMod PEAK Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35"	WeMod PEAK Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com	WeMod PEAK Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "35"	WeMod PEAK Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "35"	WeMod PEAK Setup.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292037182472254"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wemod\ = "URL:wemod"	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wemod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.41.1\\Wand.exe\" \"%1\""	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wand\URL Protocol	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wand\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.41.1\\Wand.exe\" \"%1\""	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wemod	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wemod\URL Protocol	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wemod\shell	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wemod\shell\open	Wand.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{0F016E1D-E900-4AFA-82C1-DDCFEDBF42EB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wand\shell	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wand\shell\open	Wand.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{798006A4-DDFF-42A8-B65A-4838D33FF89A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{7F251C73-027B-4329-8ACA-5F7E2B3A1F08}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wand\shell\open\command	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wemod\shell\open\command	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wand	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\wand\ = "URL:wand"	Wand.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4100	Update.exe
4100	Update.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5596	WeMod PEAK Setup.exe
Token: SeDebugPrivilege	4100	Update.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeDebugPrivilege	4884	Update.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe
Token: SeCreatePagefilePrivilege	1048	Wand.exe
Token: SeShutdownPrivilege	1048	Wand.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe
5320	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5596	WeMod PEAK Setup.exe
5596	WeMod PEAK Setup.exe
5320	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 5768	5596	WeMod PEAK Setup.exe	91
PID 5768 wrote to memory of 4100	5768	WeMod-Setup-639203268306171317.exe	92
PID 4100 wrote to memory of 1836	4100	Update.exe	93
PID 4100 wrote to memory of 108	4100	Update.exe	94
PID 5596 wrote to memory of 4388	5596	WeMod PEAK Setup.exe	96
PID 4388 wrote to memory of 1048	4388	Update.exe	97
PID 1048 wrote to memory of 4896	1048	Wand.exe	98
PID 1048 wrote to memory of 4896	1048	Wand.exe	98
PID 1048 wrote to memory of 2456	1048	Wand.exe	99
PID 1048 wrote to memory of 2460	1048	Wand.exe	100
PID 1048 wrote to memory of 4884	1048	Wand.exe	101
PID 2460 wrote to memory of 2112	2460	Wand.exe	102
PID 1048 wrote to memory of 3124	1048	Wand.exe	103
PID 1048 wrote to memory of 3124	1048	Wand.exe	103
PID 1048 wrote to memory of 2884	1048	Wand.exe	105
PID 2884 wrote to memory of 3776	2884	msedge.exe	106
PID 2884 wrote to memory of 3408	2884	msedge.exe	107
PID 2884 wrote to memory of 5012	2884	msedge.exe	108
PID 2884 wrote to memory of 3408	2884	msedge.exe	107
PID 2884 wrote to memory of 3408	2884	msedge.exe	107
PID 2884 wrote to memory of 2360	2884	msedge.exe	109
PID 2884 wrote to memory of 2360	2884	msedge.exe	109
PID 2884 wrote to memory of 2788	2884	msedge.exe	110
PID 2884 wrote to memory of 2788	2884	msedge.exe	110
PID 2884 wrote to memory of 2788	2884	msedge.exe	110
PID 2884 wrote to memory of 5276	2884	msedge.exe	111
PID 2884 wrote to memory of 5276	2884	msedge.exe	111
PID 2884 wrote to memory of 5276	2884	msedge.exe	111
PID 2884 wrote to memory of 5796	2884	msedge.exe	113
PID 2884 wrote to memory of 5796	2884	msedge.exe	113
PID 2884 wrote to memory of 5796	2884	msedge.exe	113
PID 2884 wrote to memory of 3304	2884	msedge.exe	114
PID 2884 wrote to memory of 3304	2884	msedge.exe	114
PID 2884 wrote to memory of 3304	2884	msedge.exe	114
PID 2884 wrote to memory of 5296	2884	msedge.exe	115
PID 2884 wrote to memory of 5296	2884	msedge.exe	115
PID 2884 wrote to memory of 3976	2884	msedge.exe	117
PID 2884 wrote to memory of 3976	2884	msedge.exe	117
PID 2884 wrote to memory of 3976	2884	msedge.exe	117
PID 2884 wrote to memory of 1816	2884	msedge.exe	118
PID 2884 wrote to memory of 2372	2884	msedge.exe	119
PID 2884 wrote to memory of 1816	2884	msedge.exe	118
PID 2884 wrote to memory of 2372	2884	msedge.exe	119
PID 2884 wrote to memory of 576	2884	msedge.exe	121
PID 2884 wrote to memory of 4852	2884	msedge.exe	122
PID 2884 wrote to memory of 4852	2884	msedge.exe	122
PID 2884 wrote to memory of 5752	2884	msedge.exe	123
PID 2884 wrote to memory of 5752	2884	msedge.exe	123
PID 2884 wrote to memory of 5752	2884	msedge.exe	123
PID 2884 wrote to memory of 5032	2884	msedge.exe	128
PID 2884 wrote to memory of 2408	2884	msedge.exe	129
PID 2884 wrote to memory of 2408	2884	msedge.exe	129
PID 2884 wrote to memory of 3312	2884	msedge.exe	130
PID 2884 wrote to memory of 3312	2884	msedge.exe	130
PID 2884 wrote to memory of 260	2884	msedge.exe	132
PID 260 wrote to memory of 1388	260	msedge.exe	133
PID 260 wrote to memory of 264	260	msedge.exe	135
PID 260 wrote to memory of 5532	260	msedge.exe	137
PID 260 wrote to memory of 5532	260	msedge.exe	137
PID 260 wrote to memory of 2968	260	msedge.exe	136
PID 260 wrote to memory of 2968	260	msedge.exe	136
PID 260 wrote to memory of 2968	260	msedge.exe	136
PID 260 wrote to memory of 6108	260	msedge.exe	139
PID 260 wrote to memory of 2148	260	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\WeMod PEAK Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod PEAK Setup.exe"
1⤵
- Downloads MZ/PE file
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-639203268306171317.exe
  "C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-639203268306171317.exe" --silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silent
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Squirrel.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      4⤵
      Executes dropped EXE
      PID:1836
  - - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe" --squirrel-install 12.41.1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:108
- C:\Users\Admin\AppData\Local\Wand\Update.exe
  "C:\Users\Admin\AppData\Local\Wand\Update.exe" --processStart "Wand.exe" --process-start-args "wemod://titles/94845?_inst=W6I08Vmdod5z44Yr"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe
    "C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe" wemod://titles/94845?_inst=W6I08Vmdod5z44Yr
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1716,i,10070194558934252546,11812426088159547104,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1720,i,9343383671651964372,17707064691446407698,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1712 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4896
  - - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --field-trial-handle=1716,i,10070194558934252546,11812426088159547104,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1720,i,9343383671651964372,17707064691446407698,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2272 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:2456
  - - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784729427407105 --launch-time-ticks=663775209 --field-trial-handle=1716,i,10070194558934252546,11812426088159547104,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1720,i,9343383671651964372,17707064691446407698,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2972 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
        
        C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe Wand\Support_1784730099578_Out
        5⤵
        Executes dropped EXE
        
        PID:2112
  - - C:\Users\Admin\AppData\Local\Wand\Update.exe
      C:\Users\Admin\AppData\Local\Wand\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.26100
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4884
  - - C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.41.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1784729427407105 --launch-time-ticks=675788374 --field-trial-handle=1716,i,10070194558934252546,11812426088159547104,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1720,i,9343383671651964372,17707064691446407698,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wand.com/oauth/authorize?response_type=code&client_id=infinity&redirect_uri=wemod%3A%2F%2Foauth&code_challenge=BuBy2pBzfQ5MMrhZTd6snVhAubylbBD4PHdh-jxJpLw&code_challenge_method=S256&state=eZd9ddBHglVkwBiA39Lhs2FBAYbQMFJykUDyMT5DF9g&provider=google&installation_id=37c0d849-f0a7-4d63-a6fc-6151d835f65b
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffa3c72c188,0x7ffa3c72c194,0x7ffa3c72c1a0
        5⤵
        
        PID:3776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,4487266582978366701,2092162489808780694,262144 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:2
        5⤵
        
        PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,1370032853726632782,15767580310007635087,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,15220174850568071507,5563442352398376995,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
        5⤵
        
        PID:2360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,3931719024586634985,14732934548031601058,2097152 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
        5⤵
        
        PID:2788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,9341146533687888067,3656002074184804086,2097152 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4137268977450830387,10199575211678813119,2097152 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,16043300291875587782,3673784772677170956,2097152 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:9
        5⤵
        
        PID:3304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,3644668757563024201,13036402470437398127,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
        5⤵
        
        PID:5296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5420,i,15631962635659863760,186162746509379493,2097152 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,10792126229692684162,9321844827873165159,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,6064039119732882535,11864392867674281987,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
        5⤵
        
        PID:2372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,6139928958210793235,3127237877912149167,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
        5⤵
        
        PID:2956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,6139928958210793235,3127237877912149167,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
        5⤵
        
        PID:576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,2387022836265836189,6389945621740286185,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6600,i,600413125153445663,8155221586513952845,2097152 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,18021086205101835141,13839291674285737132,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,3946501352658337878,435501340088725804,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:12
        5⤵
        
        PID:2408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,16795219654271300728,2996883863630414912,524288 --field-trial-handle=2764,i,3431130349357503062,11900064269865510559,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:14
        5⤵
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffa3c72c188,0x7ffa3c72c194,0x7ffa3c72c1a0
        6⤵
        
        PID:1388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,12942824417065806516,12541875553815342343,524288 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,12969740262965765276,6718954806460275032,262144 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
        6⤵
        
        PID:2968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,15181937585748851025,18426347552147166454,524288 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:13
        6⤵
        
        PID:5532
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,17847326173885183240,7090816279887585496,524288 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
        6⤵
        
        PID:5644
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,17847326173885183240,7090816279887585496,524288 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
        6⤵
        
        PID:6108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,9925205716726461476,13319921336147168745,524288 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
        6⤵
        
        PID:2148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,17335605771910551505,4232032010335162568,524288 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
        6⤵
        
        PID:3984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,11215690362779602730,3039705832971523809,524288 --field-trial-handle=2232,i,549922802135188042,2614594101788498491,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
        6⤵
        
        PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5908

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a87a92f025345f8c270583853949b7d8aa150a66f154e562eaefc3bff45e841
MD5 559b66b7eb2596f44f0744ba3ba7dcda
SHA1 d682f4882759ce09b2b35b31924bf940d4689e52
SHA512 11b3a440eb4caf4053f9e7bf14f528499470f75260f04d9d9421ee9f4b7ffe026beadb29af8417073955f76830c84a18934b4a255f832c79fb728727d19d2465
TLSH
T15CD0A7A433B67516E7182575A5114310B25698523A6A9202D150850E5F3F4D246CB191
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72d4580e809de33efd04748d907810b866a390579423ae8e3640de275b38d840
MD5 aebc24173430592c716eb6c6765cfebd
SHA1 361f5fb8f51ebca0f8ebfdc1dff714489f27f00a
SHA512 0dfd878ef5ea5b01eca4ac65e496cb011011c9484f384cc6bf3d571c44526f18808aa6675e99549bbad182bbbfe5f926442527c24d0a23030ab11fd629399de0
TLSH
T123D02364B769F855CA093671D4714311B5515D70355BD15662D1400C6D3F5C3D6CE161
MD5 SHA1 SHA512 TLSH

Submit Download

6ba74591-d3ac-4cd9-88d8-a7e9f4525994.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ba74591-d3ac-4cd9-88d8-a7e9f4525994.tmp
Size 414B
SHA256 7833bcdb3470805282e3ebe83a048918d2497dc8b81c8b5b5cdded24ef91588b
MD5 33198a485661ae754461b8c78de0189a
SHA1 2047e7c44340086b62a421a703df1321962d73d9
SHA512 017c6905513915191301b2c016f4d17b5e1d1078b260f17f73ee8dbfe0f38e4c513c77f01bd29d435584747c96bdfc83bd99faa22be478d3f001726f08ac7a64
TLSH
T1F8E022BAC921EC3B08FD072CA1918746EB6213672750898F363C820C8FB563B06D682C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5692d57642472aa25c6ce97c80961cf1390639cd89d3e91bc5fd2c3ac07e77d8
MD5 d75a486e0035a9e66417ff67b4da4656
SHA1 24e486e1c2cf4b579f128ddb216b62d6c0f32582
SHA512 667ade57b7bc7e1a89e4738b904850146b07c6b316f048fffde31116d7647cd986e6716d2cd33f3f9f0ba7deb954a8e3704103cc62537e529ffd923b44c6cbf5
TLSH
T1A451965317B1C9D2DBA645F297D32BA9B2F5C4090E17AE31C2ACAC302542FE771C401B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 932048f71f8352cbb6bad0067c5f93a061609a56de2e03eb80965c33a103039b
MD5 5cf0d2ae8418b38322747ed0bdfda3e2
SHA1 861767a4fd95e7963e1d437db8fe89c85edfdd7d
SHA512 f074f42556c3a83d2190e9e6a90def656aa57451a55a3866bc9bc7c07e481015770150b75b6de2c8b0d2f470eba0aab37f74db746f2ba1252e66cd0236127f07
SSDEEP 48:YALlNd/OhLNnh4h6AsJJRsJqfo7CCCsZshzEs+tsBB70BCIsq2NssCKsRbZwEsJB:DnOHWgjfaZIzqet0BB27yZwNdfP02R
TLSH
T1D6915AF7C3E8C52D891156F4AB15AF1FCE1D0924832C3C6AC8D8AE2B93E2871E15165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1e0e4ef7538429cddc50ae68af388878f373defd1d06a7a98ecd11bc951e4a96
MD5 2e724a2bbbe7d0016a23f21324e6d933
SHA1 ff244da92f059f6703e48e970175f50cf3217539
SHA512 8c343bdf306d6595b700d6b4726ebcc3ed82bdd5fcc32a8b09e44a8b01ac732c54d92254354f1146ba8457f12a727e36555ba8e64df5b07f964fc07792108645
SSDEEP 192:sxRpRmCZ/f7sGOWpVqtcSZgDlzoA8pWvO/g6+WNmAHE/YgyCYrgVIgtJ:sxRpLZ/f7sbWvqtc02IR/5s/B93
TLSH
T15942B51B6928993B9CC7D21DFB25BF63D2F91132A1D16E48A6FC8A0C14E76DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 21bc58c9cb3736e64a3fdf6d4f4e5845f68c55d3505ae5fb53e59f8631480109
MD5 626d7a589c32993d51b5cf7d884c14a1
SHA1 f60878fe934250f86092789c76c93c7e4e601091
SHA512 5a71555c5dd18f597c2bbb0ebd489bf29b12dc0e3849e35dd584b4432b66ef21c8435439c56cb7eeddf5758a7da724db1309dc1b751e69b5a7eb261c6104609f
SSDEEP 192:sxRORmCZ/f7swUWpVqlASZgDlzoA8pWvO/g6+WNmAHE/YgHCYjGVIg9tKJ:sxROLZ/f7swUWvqlA02IR/5s/Cf9tG
TLSH
T1C452A61BA928993B9CC7D21DFB167F63D3F91132A1916E48A6FC8A0C14E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5f46a46bdf4e9ca2fde9df7d487db9ffc7d68e2b0074f0251a06eeb731f950ec
MD5 dfef8ecace7611e8ba983a13f77f3ca5
SHA1 065bf7d6db664b4679491a243235277204240932
SHA512 62c5a1269c37fea9b0709da81c15a4f062af09ead85cb9ccb79cdb7527f6b6b613fc2c5bfa20567d44843511bae80c75b7faf329475c3e3b67776cb488939c32
SSDEEP 192:sxRpRmCZ/f7sVWpVqlUSZgDlzoA8pWvO/g6+WNmAHE/YgyCYjGVIgtJ:sxRpLZ/f7sVWvqlU02IR/5s/Bf3
TLSH
T11342B51B6928993B9CC7D21DFB25BF63D2F91133A1D16E48A6FC8A0C14E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1d7700770559f6d62b23c9b860b1247f77eacbd466daf0956f11c5648a56981a
MD5 8abaa595fa18930980ac4c39ed7f55d3
SHA1 ce36dcd7abbefb4403d62c5b73cf7acefeb4d6bc
SHA512 82471e9a571c730007d834974b6306b1496f686cef183455ab5323936f0c9bfe79eb6b77ff2452787068f1342a0ff7168f7ce5a9cc32ab6ae45da57e23ec2b0b
SSDEEP 192:sxRORmCZ/f7swUWpVqlUSZgDlzoA8pWvO/g6+WNmAHE/YgyCYjGVIgtJ:sxROLZ/f7swUWvqlU02IR/5s/Bf3
TLSH
T1CB42C51B6928993B9CC7D21DFB15BF63D2F91133A1D16E48A6FC8A0C04E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4e62186724a65bcbd2e34ea7c1b8bc7e29fab157ff4087c2648e0afbeb10dc0c
MD5 c06f6845f946e5f5c88a65202055ff51
SHA1 52816bda3de67685e39f833adfaf229ddc2591aa
SHA512 7b48d3a7966c6981956c75bdb267fa0606899a32bfeb3d2032e06c53e8e0e680783874ddc9ffb97ca9558aac310b34e699430e5602f37d875fb71df4ef9268a0
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVjxBVuwYro91e0z:j26HRUE7MRWgs2f02u1jagxB4wjoQ
TLSH
T12ED2EB7B740DCABE4F804ADDEC297E9F6D6802CB9698CD8047FD941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 49d1b6fd8e1ff0a6704703a3f58ecc29106844d5b9020bf25b9d33b5659a63a5
MD5 887f77889957765434c6047f299f813b
SHA1 ef15065893af9a630adbf112721bcfa05bf78b06
SHA512 50b35f1a89d12eab350e8a7e6d1c9ea34a84c065ddaaf4cf069979fb8875af82ef6ffee0d33bec64f1be93252145535cb38fe3406db24da9ebeec5c77f3fd6b5
SSDEEP 96:KREEEFEwE0EOEyE2EUWESE/EfgE8EUK4ERgE2EUcE0E0E/EuEUEJHGbqGAoouWYK:C3gFB31lERe1JDggH2vHG5FaHGbqGAoE
TLSH
T1A7910304747A02D0387D694891B5DC1B83C2B4E73459F92B37E926AA0F6BE135DFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3b8d3ce-833f-42be-8ddf-b354b7c612af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3b8d3ce-833f-42be-8ddf-b354b7c612af.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 894f773c394f0f2714c15e7b8591c77c5608d8607f08ba2303c20b06f9c9530d
MD5 06d0582a8e2b7cc6721f0017fafef41c
SHA1 65b65be232f53d21b925c6c21937ba9f243ffcb2
SHA512 7ea12afc2f6eac40cec562463d08d25eb77f879d16b1ae0ca3a15f440c9b67dd06d1a87bf0e2a33b75db576b65ddc5658b1c3e0cf45c1ef95f31035933e67d2f
SSDEEP 768:hrv+4UNbdz3Rz/TBOWCutsONXyer1IRCzniBdeVH1SK7:hbsbV3hySIqn2EH1l
TLSH
T1D403CF36A5A89E338DE2A3C6B14773037FB86057C6840790EDDA2F4E069B99D130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c766e47338badce1205dc4295bb1870f0ba3870557fb352e697a43ec53739f34
MD5 5b0c3f81aa6ead0226df68f6e1ae9b4c
SHA1 7cc550546eb5a2d98fcbffd51cd46769e936aaa1
SHA512 b041d6130bd8fd333cea34e435962b83ddf9c8dc63af500bce8abc4bb368603430ef6d897ca3e779fd814d4ffae6195c5c1bf862bb0895672f81d27f435274c1
SSDEEP 768:srv+4UNbdz3zp/TBOWCuttwONXyer1IRCzni9fMVcLCO7w/y:sbsbV3V0SIqncHCt/y
TLSH
T17913AE35E0A9DE338DE5B3D6B14776837FB8206389C40A50EADA2F4D059B99E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2ee6142389274fd551556a08227f576b9e4d4b4e8e11c092461299891b2a0201
MD5 4b2c541ea45e167d1f00cbdc1e3d2d0b
SHA1 5468ba868fc7c432b6d69f7f60a2962660bada55
SHA512 e12a7216c09f4b6b4838a3909cd67e42fb5a5c201540a1d3271d1b7d85b76c6ea8b8d5515ed5077cf3d7e10d47d540ff6914424644504c4ef67a7bf9592a29e6
SSDEEP 768:3j+9h3mp/TBOWCuttwONXyer1IRCzni97+9RmMVcLCO7w/K:69h3Q0SIqnqsmHCt/K
TLSH
T182039C3D9C529E3F88DDB38AB20E26976EA81037C4F44954EBD91F0D8177A5DF30A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ab119c56767bbcafc58b637b278bd3c8dc0330b807be5f1339256895b2d27d65
MD5 6caf0b1b4af8c4ea387f648af1b55ecf
SHA1 15d8136217b2887a842a93862c29eabf8e87fa07
SHA512 3c3c50ab61b53e79b2f34627bac697c1b9ab326a90c460fb101c9398bfe68c27ea1b54b40aef26597a10073557bc977b8f8ba89656c5e7567d894710b26be11a
SSDEEP 768:Sj+9h3Sp/TBOWCuttvONXyer1IRCzniexMVcLCO7w/t:h9h3MzSIqnfHCt/t
TLSH
T188F2AE35D496DE234CD5E3DAB2077787BFF4602785C40E50EADA6F0E0597A5E130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f75f1a19-8e9a-4f07-a914-38d933fd368f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f75f1a19-8e9a-4f07-a914-38d933fd368f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 77B
SHA256 5387b9459267aff2e01406d29e7db62c0dc37a9235f37d846e27e2d58fe3a2e7
MD5 42d1d1c950bf3bbd214fc988684187d5
SHA1 b7b783ae9c27306d6c67a84dce91b3b30e568ba8
SHA512 26ed79259dcc4d059f67fda3011b1a99716ccfa7e895d73738989b440fe1e677662a58868375f8460d1f00c0193f0c43103ffd21d7f6984aa77ac94166f1a799
TLSH
T117A01188A00AA0FC8880B8002808C3A22808A0038A88208080EAC3A2283C28083AEB28
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 d20a0682ab0cc4ee0b3bbf44c092ef35b648c6f4dae658118fa813c4db3facc5
MD5 ee658a7c5a45182287134048f7325743
SHA1 6a2666aa9af78f9d9de2669fac10460a4225991d
SHA512 85e6fdaa091e8d812585599b3ea41a51695ff616f137aabbb2ede1051e7af9cc783eb6cfbd9d7b6650e3c098e7e3f8172414e50980306e0ccee5c4aae3401dee
SSDEEP 24576:7wRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYsD:8RZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T1A2956B12E7E88F3FE56E27B6F471105907F3E5866362F78B6A0C61B92A833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2884_464778803\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wand.exe

Path C:\Users\Admin\AppData\Local\Wand\Wand.exe
Size 670KB
SHA256 89842118ae3c6dbcbfc89e25a86a861b3345c2b4cc44479819b569d29a2b5a4a
MD5 a1f62230efa593c871721c375fc44920
SHA1 f5d53a2d8544666ba4e05fdcbbe83aa234c7ad2c
SHA512 0fa7a7dbce559007794a1e104bb6bc7061f618fe53c5a5c5db0244535023bd72364894e3114c9bca59486284a9d22bd328770e889a8a9438070e5ff2384ef490
SSDEEP 6144:jZzvhs2Z4n1E7g34XtVYAOfTdS5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rjFXUl:jJ+2Z4nShVY5E5KgHUizA1CGpXUl
TLSH
T172E48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\D3DCompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\dxcompiler.dll
Size 24.5MB
SHA256 8705be57c161f31be737099220e8357b5e7603734fa1d2173ea148b7f96135c4
MD5 c7fd6bb1bfd4319226ca0626a95e5c5d
SHA1 71a4ae8126eb4365d0fb09e330c805002522e9c7
SHA512 6702fc732d86444d79d90c13b3773a1690dd38e737571d449cc55a991a6102a0737b1cff3aeace69391c41535bbe34b02169f73998247c1fc6112f16debb32af
SSDEEP 393216:t9tCn2P9zxhOMXtVz5icpXH5uVUi+zHu:cGzPdrIVCO
TLSH
T163473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\ffmpeg.dll
Size 3.0MB
SHA256 c7b8d74435b22bb2be46ac55485431621a5b4c6b906510b8e606ce94f11140e2
MD5 f152c11d5a502bbcffb7c3c5a218da61
SHA1 91ea5ba27dea04bc550fc05357b9d5e61e9af3aa
SHA512 38eaa5ae2a48f1190f8bb87b109da988b5f43b3264d45db81af3e7417b421876b45e9ccc9959b4a6136cc9ab777f2c58a497163237947ba062e3c74aecc47433
SSDEEP 49152:VlyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bWd:VlyJGsQsU+is9dNoJAe
TLSH
T162E5AE02F6D651ECD019C034979B9313F631344A4F209AEB16909A263F6BFD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\libegl.dll
Size 520KB
SHA256 87185b326b1a34a141038d0e5f06e379390eb0f5e8632e41043277f06443869f
MD5 8bbe6d75541d4faca09b0fbd10a620a7
SHA1 7ccf5f5276fa2b21b1c5fb1fa68654d17fc7b435
SHA512 6f67713f951c840325b259a610a7247adca3b7c0bf46268c581d507136c5c80e8e1517df16904c2b2ce53c459659cc55ae595a93f99d59cbb4c08e990b31a57e
SSDEEP 6144:UeQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4WfaguL1iMg:SG/V/iZJOmW6GVGWFcsfAOugP4W410
TLSH
T1FFB47D15F3E84BA9D07AD1348A438642EB7174921F65F9EF02E052352F3BBE45B7A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\libglesv2.dll
Size 7.6MB
SHA256 abe7e65ea02357e6d56e125cf48be97ca022b145c55a06693cbc18ba4d4f28e7
MD5 ded01cd8c2ab74dad9bbcfe6b12aef12
SHA1 8e9959747a22b02cc490372ae66070a7749bd8f2
SHA512 bbf7ef6a984f353f6bc9abac8957361ba423664c99defaf606a316c98e7cda03824f78fd3f16401ee38800df9bf2c595ab67c07c232a82147e7fbe333f6ca17a
SSDEEP 49152:XjZmaisHsL/nWt+Xa2KQOQe1gt4eUXNG8nL1cwgxLqBQ3ypxnYAZkicN1UZ+uNmC:AgHqnNj6ZAIxnRZkbYdp+h8iADBXw6h
TLSH
T12A868D03F69541D9C05DE2B49B67A223FA30B8550724B7CF2A9447162F6AFE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\locales\en-US.pak
Size 549KB
SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
MD5 0555742b1e5f91449a199b9c42c1eb3e
SHA1 2f7ecfa75faca014c06e435fc6d449072d47ac41
SHA512 6d5f20741c97933d7c2d7011b696632e056db182941483e6c5675ecaf2b18132abbc0397b2c703e79a878838db806766aab69b2c90f6fd1dce377623d5501af6
SSDEEP 6144:LOvSsWLA2zb+H4HfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Bwf:MAxJHfdZM6Qqbg0jBwf
TLSH
T1C7C44D1FF744112A05A352A2BF0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources.pak
Size 6.5MB
SHA256 096373b7b5a9535b5ba60a37883d1d2010d28dafd90d4c819a902db09aef4ad1
MD5 204420168fdecf480d2eb1ca479c3877
SHA1 2b853205f5e2b8ea76f0beec2256f62bf6318347
SHA512 9e7992f0889de939b38642fb0991e9dfa8b7e8a74a5804a936b2e4146be29548c8a29ef16ca8cf14d256dcf3989e10e57780d8c531c422f2e1b594f9ade9106c
SSDEEP 196608:+mntWBRtfTL5QoCmkrB0QMguFBgt3m06Rw+K6:+mnkTtC9mkr4jFWBm0iw+/
TLSH
T1F76633D7B1346C1BC6C443BF8918463AA85C6B707D86D2D2189C722CDCAE64A6FC467F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar
Size 46.6MB
SHA256 c2ecc997281b84a77ba7f40e2b04e041492ddb3d91d5e6968f91a7cb3894b347
MD5 f44820a93d7e951320f4666f04d42c3c
SHA1 cc18d79a3c6c09d0f368fbfd613d3bb7f077a3fe
SHA512 dd90e93b38fa31fd8aec7f66c47892a4df0568cee3fcee1437d12575571af4d3c140c228c2fff2dbbd4191397f3ef14bcd1c42896188a422a8329f53461aa7f2
SSDEEP 393216:CCap81umtzSbeX/a6pgP/gfUzAbHh/pR+ZcN7lgFsD96U:CCFOeDSXgftgZovJ1
TLSH
T169B7D01DE2B46D7615AA10A620463227B13410A7BF613CECB78CC5AC4FCE98E6177B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WandAuxiliaryService.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
Size 1.1MB
SHA256 b5dfb48f78490f02eed11d6fc00ae183e51a61d7a1f9fb725b8ce2703e26ec96
MD5 388d5dcce022d979cd5b22d4a3510217
SHA1 f0d124dec3dcadabd664b24f779f7878d021e722
SHA512 779591f59ebb9d07abd472d60e09eb0e269d38c2a87870346b77e585db8b3a222f2e099f21bd9f3cf4d231da0513a389d52866e09716542de55f3f4f1ed64d52
SSDEEP 12288:9gTyRxzXegg+wCLwZwe5/YGfG3Gu5KgHZizm1CRQ:9gyjzXTFewAYGfG3GuUQYK
TLSH
T1303528859AE896DFD1BF57359CB00E344BBBAC01E6D1EF8A0445A6B84C53311A87237F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

capture_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar.unpacked\static\unpacked\capture\capture_addon.node
Size 353KB
SHA256 c055b998adebbeae46d9472ef0a4ff3349ca0c907cb4568d0b09e15841966c71
MD5 0c295eb6b21a7ed3f6bb28c527980529
SHA1 d3272f31fae923175ebb4e7b855f5c19cd579b4f
SHA512 7d3a27625ffd6b4b9ec011a7dd933dc24427685af13a90b77861b37503418fe7ccfeb75353327ef8d4b0f33331a9516f29ae28f35a81b89bf8073d4ba1f3f1be
SSDEEP 6144:yBwUknKeSUreO0nj4BPxQUx+zKt26wEGnwAp/j+1:yBwUKKeSFOgjkPxYz02XwA81
TLSH
T172747B1AB7A404B8E477D23C89674A05E7B27C4A0760E7CF23A4435A6F33BE1993E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar.unpacked\static\unpacked\icon.ico
Size 409KB
SHA256 1a90e62ec52c31681af31d9cb4790c8a3af4b72bd8de3a0e937802965a23a38b
MD5 06aa52a7fa25dfc51e7c846172d985f2
SHA1 10adb45e32e5a4831154e5e17425ba3f911bc325
SHA512 b7f3c9c000a8a4af76cf619908177bd29a98a69825e2f711705cdb810bb8c8f4c29ec8c409855ca1d1354dc52c72f4c72100dea24727980d4b8ecd1e4a4ed3a8
SSDEEP 6144:t5Ker1PJVHjMYimBSfN/yw+Aw1ECD45rO:t5KgHaizA1CG
TLSH
T14E947DD5FEE521ECC0BB9C7A4C325D3169738C4698C1EE92588779BC419316A2D332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overlay_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar.unpacked\static\unpacked\overlay\overlay_addon.node
Size 584KB
SHA256 b6dd99a23d195707e96469598e803ed0ff762c8ee7541bb9073ec999870ba42e
MD5 3c1709a15cb5b0cb0dc4608caa62cc99
SHA1 f17af0aa7cd8e7a999dd1b58fd9952b2560a2889
SHA512 d4e7cda1a60c7a02b4ebbedc8540741562ab202cf080b9433cdc5600978fdc02d741d1bd15a3a02f97c380ecc9465014efa61877ec8438f42a2635672bd055cc
SSDEEP 6144:FK2OdWGEPV5JCaZhxodkV1ogSt56MqyRCeIj0mTxOND+PgAjB8ODG4MOyoQwXc/M:FEEPV58agp6terNevDG4MfS3f
TLSH
T1B9D47F2AB2AC03B9E167D178C9434916EBB278551370A7CF03A1569B2F277F15B3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analytics-frame.js

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\resources\app.asar.unpacked\static\unpacked\preload\analytics-frame.js
Size 1KB
SHA256 c94031bd1997e73e46a37f101818183497f26a1d71d5316fb70088119220ea17
MD5 cad574a5e3b3f93ad3e7f4eaf594e4cc
SHA1 c2e25dd3848a4a1068e24439efe916aaca5e66e1
SHA512 1b632e1621857392dffc4fc23d99d61ca435dcdc7d80d684e321623054dd50f353f9333a1dc8d2ca7dbebe5f00020ab44b6deee2ab265a450c8d65806b1bbfeb
TLSH
T1C931CFE0AC821D9C33A70174B796371634273ED3CA0E91446B284DB76996ED00559FFE
MD5 SHA1 SHA512 TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\squirrel.exe
Size 1.9MB
SHA256 66dc4978cb92427b6eac710426cb479e244927c87c295de9052b5dab8b9844ea
MD5 eeac131e1f256910bb6d31c1d4fbf2b5
SHA1 6700bd4f2898a43fc58461b0acb7eb5b4e3e4c75
SHA512 c93d1538266ac41f049e4d95f6e2614c61813ea372f663ee33f40900d3e7901d810e1e8b29be8ae0478995b149fd1126e73ffe70feca9b1b870bbb188d65a187
SSDEEP 24576:wwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYs2:HRZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T112956B12E7E88F6FE56E27B6F431105907F3E5866362F78B6A0C61B92B833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\v8_context_snapshot.bin
Size 698KB
SHA256 ed5e979db2aef4a152758f2b9b7b06349a1d3d5dd687fdb96e2b3fb730a465e0
MD5 a119c66308517b41d07e0c070939d5d0
SHA1 e5ffb8afeb8914c4981d93f3727183aa451c6a88
SHA512 fb27910e77f0ec790c4c193c726d93be01ec080d9f4175194094c36b5107c71f53e9d2f9c6e65f0b2395353e34bb1a759c0f36b55f227221a97757d0e44c0bbe
SSDEEP 6144:G/V4XptgO5XKt+Hlzk/ov7Cx2NyuClVlxykismIdukcLKYNcPK:G8D5XoAvmx2NySkQIId/H
TLSH
T1C8E4A761FB0A8F3AC5453BBD8DE657463A30B18E9E87E24B7405633D78B96B04C3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.41.1\vk_swiftshader.dll
Size 5.4MB
SHA256 f9f90371bbde7054f6654d18c12ff29e02ec684535a68e081d3988425f2dd9fa
MD5 e9bb72c9005179082cc64c8a17a0f4a9
SHA1 9c7291c94e6cb85b99c4ce4f9448444c48da9f3a
SHA512 7537d7f05c2b1de0fd4a5bae7781f715573d45523235c2158d1dcacf8ac87550b3fc578574a6c124501911bb023d2856341de9164454b270c26935f1bd3ddd18
SSDEEP 49152:R+et2UcrN42sf0vTrWny2/Gh9qIHGZpVZSbiP1VFz2ZtIgrduZsgP/m9vqjfc2cM:RJt2vI4gmlml3pCIn
TLSH
T137463803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

init.json

Path C:\Users\Admin\AppData\Roaming\Wand\App\init.json
Size 53B
SHA256 f02ad854b8b5fb77578e5295e4b063922f9ac0cb0f4efcf09ca200150d398444
MD5 8c91a28ce61a83537360e9708ff8df46
SHA1 489348efbd23a6aa48fe600f8f85c42cb8313461
SHA512 f913403ccf2b9702f73df078252c6a8cda91412f7028dc0f892dbd3ed0c04ec0bdd94c9857d5be8ab8efc082492d3f93bff2084c223e2f83f59234331f738a63
TLSH
T12290028419A91462DB52158A04D11569DA5A9028C46445B84C9604440553916128FB67
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 1KB
SHA256 ae23bc7b822d4f5722724fd242d5ecbaa26e251cacf06d2d134323dfa4602ac3
MD5 e64122dc2612f230c987317c41ff00b2
SHA1 c6aab03d29f2b868c18e728071138eb486974baa
SHA512 a3f1e902d42649dadfabc2fd546726525376eaadcdfe074d030847f78a927f73496b8453ea4aba32a94f793009b012a193b78cd349159580f785eaab16dbd412
TLSH
T1992167D7C7E8063E896623F46E247A23C2BF192C532C7C428CE9EF4E5BE1471125129D
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8382e67a6abc01bcc55046a05592e024dfa93291b958966359a193b77ef502f0
MD5 5525835e2608e802934eabdbf4e5738e
SHA1 e62acedea5ac94f808d2789b6b76787ef80e8616
SHA512 8193a59fb96312f0eb94d78df719b4c1a9394c1ae7210508184d1662a02cad377ef7a4e3f54641334ceea98d202e54de70370ac3991518445d07e9fb9fe83550
TLSH
T19CA00212019011D1C20402F850C50BE47225BDB6C605B22247900395DC90275A191164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b074f.TMP

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b074f.TMP
Size 48B
SHA256 c1cb7fee8c93d5290bd1a511bebc41db4c9de6078c4189e577ac9a8276b25c20
MD5 a92730577ec60ec210477f94a1aa5d6c
SHA1 afa54ad29f0f749215f4dc0aaa5b592d45dd00fd
SHA512 d2bf4b729129b2d45288c27d1f5f079ecedc438d1b275a7addf95080015dc0cce2139ed4a154f2ec33e00819a6e3e7311432061691c843b41812ca7a32d9aca5
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Wand\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Wand (WeMod).lnk

Path C:\Users\Admin\Desktop\Wand (WeMod).lnk
Size 1KB
SHA256 a22ae0d86f80d049c179c856e0877712546e41da6aac24d586c5d202738d6ba5
MD5 ef77af0e98bacfaf87b4481ba817135a
SHA1 3b93bead4e3a00e91d6f4a238a9440501dc787a4
SHA512 0ed32ecc550cb3e6fc6a304bc41a094ba5b53358e24b6a556af4e2705183bd9dff84a92558c23432c60fd5d9a32f14051a6ac3a4d55c2e3678e4b3baa1814034
TLSH
T16B21EF126ADA4B22CDBA853664F6223AC976BC625755AF0C0184D30C2E66762ED0CF1F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1836-304-0x00000000009A0000-0x0000000000B80000-memory.dmp

Download

memory/2112-439-0x00000267537B0000-0x00000267537D2000-memory.dmp

Download

memory/2112-438-0x0000026751A20000-0x0000026751B34000-memory.dmp

Download

memory/3124-480-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download

memory/3124-481-0x00007FFA68C50000-0x00007FFA68C51000-memory.dmp

Download

memory/4100-329-0x0000000002F20000-0x0000000002FAE000-memory.dmp

Download

memory/4100-331-0x000000001C170000-0x000000001C190000-memory.dmp

Download

memory/4100-63-0x0000000000BA0000-0x0000000000D76000-memory.dmp

Download

memory/4884-430-0x000000001C290000-0x000000001C7B8000-memory.dmp

Download

memory/5320-937-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5320-935-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5320-941-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5320-942-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5320-944-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5320-946-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5320-943-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5320-945-0x0000027D06540000-0x0000027D06541000-memory.dmp

Download

memory/5596-19-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-42-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-17-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-6-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-46-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-47-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-48-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-45-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-26-0x000002AD64010000-0x000002AD647B6000-memory.dmp

Download

memory/5596-40-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-41-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-18-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-43-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-44-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-5-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-4-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-3-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-2-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5596-1-0x000002A545060000-0x000002A54508A000-memory.dmp

Download

memory/5596-0-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp

Download

memory/5596-344-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download