a0078e54f5b79d17bcdd7fe2291099c5ada5904750f2554c7d3465175a9e141e

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WeMod-Setup.exe
Size 155KB
Sample260727-1ws8dseq3y
SHA256 a0078e54f5b79d17bcdd7fe2291099c5ada5904750f2554c7d3465175a9e141e
MD5 a99d309a683c64fde4d101f00a286aee
SHA1 1e795dbb1f98d1ea83170abbfda3a496e80a885d
SHA512 ca55b39837f541903f9758f86713fcc4929ce398d170f9c2665ed0553766e67f84356504d049500fda2f4baf9c7d503385f46c8594de8264050d85ebc20e5a80
SSDEEP 3072:w0x45QyUyhaEtHZeO/deV4ILlCI+40OHHBpF:145rUwaEtHUx4SF
TLSH
T160F3AED9E3E815BEE6BB8DBA4C351DB005B7AC421CD5ED5A1D8070A84A33354243BB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
36	4676	WeMod-Setup.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	WeMod-Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Wand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Update.exe

Executes dropped EXE 12 IoCs

pid	Process
3772	WeMod-Setup-639207864558976669.exe
3992	Update.exe
3328	Squirrel.exe
456	Wand.exe
5060	Update.exe
3936	Wand.exe
4840	Wand.exe
4456	Wand.exe
1080	Wand.exe
840	Update.exe
2076	WandAuxiliaryService.exe
3292	Wand.exe

Loads dropped DLL 12 IoCs

pid	Process
456	Wand.exe
456	Wand.exe
3936	Wand.exe
3936	Wand.exe
4840	Wand.exe
4840	Wand.exe
4840	Wand.exe
4840	Wand.exe
4840	Wand.exe
4840	Wand.exe
1080	Wand.exe
3292	Wand.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WeMod-Setup-639207864558976669.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Wand.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com	WeMod-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com	WeMod-Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1"	WeMod-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	WeMod-Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "33"	WeMod-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com	WeMod-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	WeMod-Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "33"	WeMod-Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "33"	WeMod-Setup.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wand	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wand\URL Protocol	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wand\ = "URL:wand"	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wand\shell	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wand\shell\open	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wemod\ = "URL:wemod"	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wemod\shell\open\command	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wemod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.42.0\\Wand.exe\" \"%1\""	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wand\shell\open\command	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wand\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.42.0\\Wand.exe\" \"%1\""	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wemod	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wemod\URL Protocol	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wemod\shell	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\wemod\shell\open	Wand.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3992	Update.exe
3992	Update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	WeMod-Setup.exe
Token: SeDebugPrivilege	3992	Update.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeDebugPrivilege	840	Update.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe
Token: SeCreatePagefilePrivilege	3936	Wand.exe
Token: SeShutdownPrivilege	3936	Wand.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4676	WeMod-Setup.exe
4676	WeMod-Setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3772	4676	WeMod-Setup.exe	89
PID 3772 wrote to memory of 3992	3772	WeMod-Setup-639207864558976669.exe	90
PID 3992 wrote to memory of 3328	3992	Update.exe	91
PID 3992 wrote to memory of 456	3992	Update.exe	92
PID 4676 wrote to memory of 5060	4676	WeMod-Setup.exe	100
PID 5060 wrote to memory of 3936	5060	Update.exe	101
PID 3936 wrote to memory of 4840	3936	Wand.exe	102
PID 3936 wrote to memory of 4840	3936	Wand.exe	102
PID 3936 wrote to memory of 4456	3936	Wand.exe	103
PID 3936 wrote to memory of 1080	3936	Wand.exe	104
PID 3936 wrote to memory of 840	3936	Wand.exe	105
PID 1080 wrote to memory of 2076	1080	Wand.exe	106
PID 3936 wrote to memory of 3292	3936	Wand.exe	107
PID 3936 wrote to memory of 3292	3936	Wand.exe	107

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-639207864558976669.exe
  "C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-639207864558976669.exe" --silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silent
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Squirrel.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      4⤵
      Executes dropped EXE
      PID:3328
  - - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe" --squirrel-install 12.42.0
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:456
- C:\Users\Admin\AppData\Local\Wand\Update.exe
  "C:\Users\Admin\AppData\Local\Wand\Update.exe" --processStart "Wand.exe" --process-start-args "wemod://?_inst=Hn8yn5kqST4486PK"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe
    "C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe" wemod://?_inst=Hn8yn5kqST4486PK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1740,i,11021342856009705832,8111510502451418890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,603817152961108738,3726765372990567747,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4840
  - - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --field-trial-handle=1740,i,11021342856009705832,8111510502451418890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,603817152961108738,3726765372990567747,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:4456
  - - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1740,i,11021342856009705832,8111510502451418890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,603817152961108738,3726765372990567747,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2560 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
        
        C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe Wand\Support_1785189743981_Out
        5⤵
        Executes dropped EXE
        
        PID:2076
  - - C:\Users\Admin\AppData\Local\Wand\Update.exe
      C:\Users\Admin\AppData\Local\Wand\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.19041
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:840
  - - C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe
      "C:\Users\Admin\AppData\Local\Wand\app-12.42.0\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1740,i,11021342856009705832,8111510502451418890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1744,i,603817152961108738,3726765372990567747,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log
Size 2KB
SHA256 7384160e534526d57ad8c778c066871ad70548d86c92e79256898fa334833367
MD5 41a2e77a29628bbb8e45f0c1f25c3b29
SHA1 24d4948dd26c2d8c7e53b112529c4f6e6a9fcd92
SHA512 79ec5caf249b1c3be2357bc2968e62a0a1c709045950c2dd8895dc5c79cbedb0f1184e5da533c6dfb2dbfadd6bffbd32684cf703d424f6e4b8ecf93212d2355f
TLSH
T1A741D07222B1B1D88D173F52297C258463FF4328FA509F5CB568625EEA290175F231F7
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 77B
SHA256 ce2b35686e01ab705d481f4969f9567a2bcb1528b1f75d1aeb54b526642c595c
MD5 6b4f72c2d843c4a5d860a23ba323c370
SHA1 fb8c353830dbf23f3a21b6c1a36386be11beb81f
SHA512 8eab08c411fd7b68bf17ccf81fd3c064d2810c1cdddbc3e2ab9c2b853dab83f8dc39e2d30de0ea44bef7ea452c6ceaf0401e33e4496f5bdf1c29f19dcc066659
TLSH
T1F8A0240C001D747F41C3C171043040734100CC0F5510374430450177517550CD410D4C
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 f3bd6b9fb246d2b40d5d15dbb13cea4fb33799532ed8ed6d95e04d70798e2d19
MD5 485995c204dc7ebcd3c2a87d1dfe42b1
SHA1 8bb82d22d52bde6d1c2e9f0c39a17d10d56631f1
SHA512 c7ec01812494ab1727fbc464dfcfa58ffc5259d29dd62b6dd3e5e55658e7add139571e6aeda847e84469f932b14d4b55956142374dba47571b9013da5a965ed7
SSDEEP 24576:fwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYsD:YRZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T1AF956B12E7E88F3FE56E27B6F471105907F3E5866362F78B6A0C61B92A833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wand.exe

Path C:\Users\Admin\AppData\Local\Wand\Wand.exe
Size 670KB
SHA256 e449f6764e01a8432be7de0fe099f43c323da81b8c83cd3b5459b017e6279928
MD5 bfdc2b923d7bd9560899e8681f7d6b25
SHA1 2a77e732215c565169cb692dd37789ad7456929b
SHA512 e9f8a50daaa825d934ad235d21510cef561a551a6875307eb73b8940b867193db3e86ffbd681865a144ddeee690d26e5cabf7ee3377fa378ef9d5c26ae75f28e
SSDEEP 6144:IZzvhs2Z4n1E7g34XtVYAOfTdZ5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rj1XUe:IJ+2Z4nShVY5L5KgHUizA1CGZXUe
TLSH
T193E48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\dxcompiler.dll
Size 24.5MB
SHA256 7886bb1d001d8a2e2e3ce170455ba576441fdaa76eec513039e73d32180d550d
MD5 c3b8188ae650e28df7ddd5b29224a29c
SHA1 3ec9e56cbf6d21f9fb50433563f5294758704dbf
SHA512 ebd7d48c96867609a91d58aa65f25899f9d6ee2f82d51fda0ed0bd4d26a82aa97f769ecf10f020cba2097732b4d4686c19a82fe59af4001f93255176e6ea0fc9
SSDEEP 393216:V9tCn2P9zxhOMXtVz5icpXH5uVUi+zHu:EGzPdrIVCO
TLSH
T1DC473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\ffmpeg.dll
Size 3.0MB
SHA256 4d06515734b4dc29ca04d717e7cef19ab60b9100459468fc4f969104b5ac10fa
MD5 7118cfea06f99e49a79217fca27a494e
SHA1 2969da2499953764c38382393a55962fdc32ea52
SHA512 ae101e503a9a4a2453acb600f5c915075daf40c6e471f4b0ea2b5abd7da1f0b680818ca58aa4eac72ab885dcb77fa28e070bfbfa8c33bad7ca8b2e10734f8a93
SSDEEP 49152:qlyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bWd:qlyJGsQsU+is9dNoJAe
TLSH
T166E5AE02F6D651ECD019C034979B9313F631344A4F209AEB16909A263F6BFD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\libGLESv2.dll
Size 7.6MB
SHA256 dc8e8de27b77ccd09df63b1fbeb69f2ffb8b6e02cc1f7bd9d6b27cc0640d3227
MD5 9e3b9b22aad10d467f0e44e5801ddef1
SHA1 bc5cf8741a3a8818ed4e2fc400b4ed8d50da5d09
SHA512 8c1ebe5dc3aeb2769b852d8457333fb80aee5f0021ec60f17f824e1af18eb082cc90523e78d5fb9163e140eb3f1ad28c2610255f2fc3e497c42a2962f1073d0b
SSDEEP 49152:7jZmaisHsL/nWt+Xa2KQOQe1gt4eUXNG8nL1cwgxLqBQ3ypxnYAZkicN1UZ+uNmC:8gHqnNj6ZAIxnRZkbYdp+h8iADBXw6h
TLSH
T119868D03F69541D9C05DE2B49B67A223FA30B8550724B7CF2A9447162F6AFE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\libegl.dll
Size 520KB
SHA256 bca9543ddf80ccb8091d2bc87f86c22093352b69c3fca3cb01fe20f4f92a264b
MD5 ab311fbbf7593fd8a9a0d8a8efb709b9
SHA1 d7efd6956f9afe1f79754bc09d95030c6a067e19
SHA512 84b09a1c1297360d8474e0895ca1ee66726d95f681b35d81ae20674eac176621f37aa44fcc5e94627dc2701f0ec1632c287c7855315f16b6ffcbb1b7f98ea68f
SSDEEP 6144:IeQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4WfaguL1iMg:mG/V/iZJOmW6GVGWFcsfAOugP4W410
TLSH
T196B47D15F3E84BA9D07AD1348A438642EB7174921F65F9EF02E052352F3BBE45B7A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\locales\en-US.pak
Size 549KB
SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
MD5 0555742b1e5f91449a199b9c42c1eb3e
SHA1 2f7ecfa75faca014c06e435fc6d449072d47ac41
SHA512 6d5f20741c97933d7c2d7011b696632e056db182941483e6c5675ecaf2b18132abbc0397b2c703e79a878838db806766aab69b2c90f6fd1dce377623d5501af6
SSDEEP 6144:LOvSsWLA2zb+H4HfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Bwf:MAxJHfdZM6Qqbg0jBwf
TLSH
T1C7C44D1FF744112A05A352A2BF0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources.pak
Size 6.5MB
SHA256 096373b7b5a9535b5ba60a37883d1d2010d28dafd90d4c819a902db09aef4ad1
MD5 204420168fdecf480d2eb1ca479c3877
SHA1 2b853205f5e2b8ea76f0beec2256f62bf6318347
SHA512 9e7992f0889de939b38642fb0991e9dfa8b7e8a74a5804a936b2e4146be29548c8a29ef16ca8cf14d256dcf3989e10e57780d8c531c422f2e1b594f9ade9106c
SSDEEP 196608:+mntWBRtfTL5QoCmkrB0QMguFBgt3m06Rw+K6:+mnkTtC9mkr4jFWBm0iw+/
TLSH
T1F76633D7B1346C1BC6C443BF8918463AA85C6B707D86D2D2189C722CDCAE64A6FC467F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar
Size 46.6MB
SHA256 94fe610d61f3c623cea458ffc4de2aa34120565286091566bff2f6b2c9016cb0
MD5 1f668a7eea551a1677d9dc0094619947
SHA1 9b47355a039a5006656d759fd9497158e7926adf
SHA512 422ca64133f3ce602330edf1907566c8150dcc276579a4c06ecc386d19af75d005587241fe9997bdf36a4f49159094c3e983f3e885a08a0bc10f10382f3b35a5
SSDEEP 393216:JCzp81umtzSbeX/56mEn/gfUzAbHg/pR+ZcN7lgFsD96U:JCiOecl/gfSgZovJ1
TLSH
T1C1B7D01DE2B46D7615AA10A620463227B13410A7BF613CECB78CC5AC4FCE98E6177B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WandAuxiliaryService.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
Size 1.1MB
SHA256 b5dfb48f78490f02eed11d6fc00ae183e51a61d7a1f9fb725b8ce2703e26ec96
MD5 388d5dcce022d979cd5b22d4a3510217
SHA1 f0d124dec3dcadabd664b24f779f7878d021e722
SHA512 779591f59ebb9d07abd472d60e09eb0e269d38c2a87870346b77e585db8b3a222f2e099f21bd9f3cf4d231da0513a389d52866e09716542de55f3f4f1ed64d52
SSDEEP 12288:9gTyRxzXegg+wCLwZwe5/YGfG3Gu5KgHZizm1CRQ:9gyjzXTFewAYGfG3GuUQYK
TLSH
T1303528859AE896DFD1BF57359CB00E344BBBAC01E6D1EF8A0445A6B84C53311A87237F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

capture_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar.unpacked\static\unpacked\capture\capture_addon.node
Size 353KB
SHA256 9843eed2aa7957f5334dbfc5b4058c47c0313a6df7e8b84ea48761aab5bd878b
MD5 a8ba41ac913136f6010daeeeb6ddce22
SHA1 c01fe8c971d0e3137501fdd4233bf1a0ef9dee61
SHA512 d314417a39783083b58106a2d4520b236ef5feba776cd494653c7aeb9cc250ba63b08ff70751d3b1a02a02ffa6d3d36871151b8143654dd4ac8658d0ccb693cc
SSDEEP 6144:cBwUknKeSUreO0nj4BPxQUx+zKt26wEGnwAp/j+1:cBwUKKeSFOgjkPxYz02XwA81
TLSH
T1B2747B1AB7A404B8E477D23C89674A05E7B27C4A0760E7CF23A4435A6F33BE1993E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar.unpacked\static\unpacked\icon.ico
Size 409KB
SHA256 1a90e62ec52c31681af31d9cb4790c8a3af4b72bd8de3a0e937802965a23a38b
MD5 06aa52a7fa25dfc51e7c846172d985f2
SHA1 10adb45e32e5a4831154e5e17425ba3f911bc325
SHA512 b7f3c9c000a8a4af76cf619908177bd29a98a69825e2f711705cdb810bb8c8f4c29ec8c409855ca1d1354dc52c72f4c72100dea24727980d4b8ecd1e4a4ed3a8
SSDEEP 6144:t5Ker1PJVHjMYimBSfN/yw+Aw1ECD45rO:t5KgHaizA1CG
TLSH
T14E947DD5FEE521ECC0BB9C7A4C325D3169738C4698C1EE92588779BC419316A2D332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overlay_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar.unpacked\static\unpacked\overlay\overlay_addon.node
Size 584KB
SHA256 d1297bad4729487a6eb1a113197efb22cb14a7141077eba35ef23548ccc4701c
MD5 90339133aea979616eece38e500e572a
SHA1 a28b1992f9cb66e731e9132dd2e9d5eba2f57c53
SHA512 c4ac3dc1d5cc476482a1e3e5823761ece7898b3e95bdd53c39d6dfa488e75ee5658a61b21c074d790a18c3a586d7602415d1c4fe3ae48eeff286023904c0ccd2
SSDEEP 6144:iK2OdWGEPV5JCaZhxodkV1ogSt56MqyRCeIj0mTxOND+PgAjB8ODG4MOyoQwXc/w:iEEPV58agp6terNevDG4MfS3f
TLSH
T103D47F2AB2AC03B9E167D178C9434916EBB278551370A7CF03A1569B2F277F15B3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analytics-frame.js

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\resources\app.asar.unpacked\static\unpacked\preload\analytics-frame.js
Size 1KB
SHA256 c94031bd1997e73e46a37f101818183497f26a1d71d5316fb70088119220ea17
MD5 cad574a5e3b3f93ad3e7f4eaf594e4cc
SHA1 c2e25dd3848a4a1068e24439efe916aaca5e66e1
SHA512 1b632e1621857392dffc4fc23d99d61ca435dcdc7d80d684e321623054dd50f353f9333a1dc8d2ca7dbebe5f00020ab44b6deee2ab265a450c8d65806b1bbfeb
TLSH
T1C931CFE0AC821D9C33A70174B796371634273ED3CA0E91446B284DB76996ED00559FFE
MD5 SHA1 SHA512 TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\squirrel.exe
Size 1.9MB
SHA256 0d31cbb88112ac1c51a8dd3ecca703b6a338621b886a4710d4308c30057fab2b
MD5 f0f6da537a16ee0d4cead699d695efb6
SHA1 6b525c3556b6145e55f231ba246d81a8ac8ad6c6
SHA512 6826b8f71e6715f80ece4a016f08cd4c2bdd0fde3f98a2cfec015949ce50ae3f150b4efc83895b330ee18c1072b16599ba1f91a2cac0554da12a0f98d0b50a37
SSDEEP 24576:CwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYs2:hRZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T1CB956B12E7E88F6FE56E27B6F431105907F3E5866362F78B6A0C61B92B833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\v8_context_snapshot.bin
Size 698KB
SHA256 ed5e979db2aef4a152758f2b9b7b06349a1d3d5dd687fdb96e2b3fb730a465e0
MD5 a119c66308517b41d07e0c070939d5d0
SHA1 e5ffb8afeb8914c4981d93f3727183aa451c6a88
SHA512 fb27910e77f0ec790c4c193c726d93be01ec080d9f4175194094c36b5107c71f53e9d2f9c6e65f0b2395353e34bb1a759c0f36b55f227221a97757d0e44c0bbe
SSDEEP 6144:G/V4XptgO5XKt+Hlzk/ov7Cx2NyuClVlxykismIdukcLKYNcPK:G8D5XoAvmx2NySkQIId/H
TLSH
T1C8E4A761FB0A8F3AC5453BBD8DE657463A30B18E9E87E24B7405633D78B96B04C3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.42.0\vk_swiftshader.dll
Size 5.4MB
SHA256 2be94f05436eb31c4fa4e4d3418627b47819bcb91e99abb99905f0626149ec34
MD5 d3051ab8fe01ea307e449696841b3bfc
SHA1 6cb94f77ebf99d2e76ad6da1413895844ed78d14
SHA512 0ce16413d67604cbda0ac4176528d53c6df778a3452d98d996d92ef874ddd30a4a3a2d906952bcf0c893d6d971fa303b24c5582aba11e4576bfd58aa9db0e323
SSDEEP 49152:h+et2UcrN42sf0vTrWny2/Gh9qIHGZpVZSbiP1VFz2ZtIgrduZsgP/m9vqjfc2cM:hJt2vI4gmlml3pCIn
TLSH
T102463803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

init.json

Path C:\Users\Admin\AppData\Roaming\Wand\App\init.json
Size 53B
SHA256 9b8c5c43e041227c74fff13a0cf490ead50a11c9bdfa576ab1421dc73f73650d
MD5 2fd8d750775576ac33266e4a6d2e2a46
SHA1 8bb639e9820e3a96c4e8732edbf96c163e4d8816
SHA512 053e8d6b04aca4f1e23d6261b0adf3a2309b821566e463c4bbc6866d4c5c2c6d161a8fa4352c12ce922b6d123130bc44e870cd87e91537c05b5dd85fd32e006a
TLSH
T1B09002D60A6614336742124F51D16431493C1070C05805644CD60C545472E15614B666
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 718015ae54cd20081742d85740682c0029664cbcbe98cb34c213781c1882f2c6
MD5 440bd85348e6b2f2180a00380268dcb0
SHA1 ae9c385dfaa2294dc94932dee68a31f201918d1c
SHA512 bc1c3a834dbb1d9a4f9ff4dfc5139d8297c1716e0878b5950d7731520fa20be99cb4538b0652d8cda39d46182ea356bdef1db8af56ff50d987b18a4a9a238291
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fe1623527afe77c979c145fb7a7cd7a013deeb283ee4a067d7be4c130e1a7fd0
MD5 bd035196640eeb82c57d4101770de66c
SHA1 0b22c6fd90aed72c127b0b7725bcadb1c6d6205a
SHA512 adedf60454d3c07ecee54a385fc7592076b0bf4c9c08175783c81e2da98591d04664cfbae72f45dd4bdb9dd216aac0d8033eccd4a25d5aa96adc439bffdd822b
TLSH
T139A0021501E005D1C20043F810D503892610FDB9C24726034394028ADD503636191440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0fb1.TMP

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0fb1.TMP
Size 48B
SHA256 da39e8113889db036a9b87af55dced1aa10bdba31fecb8391aa9fc294b722c47
MD5 f7954c6202975d946039957133d06330
SHA1 56e69bce20104c4ab35b050545c06672e87179a0
SHA512 fa9a6ad5349ba9d2c7b935bcf184d9f853f528dcdcd833ed362d212a0a9e785252d26884d204ba2017ece45fe988b3d34e9112a07284f26145b2f1c2a1c77fdb
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

memory/840-478-0x000000001D090000-0x000000001D5B8000-memory.dmp

Download

memory/2076-482-0x0000021E42470000-0x0000021E42492000-memory.dmp

Download

memory/2076-481-0x0000021E41F90000-0x0000021E420A4000-memory.dmp

Download

memory/3292-529-0x00007FF9C2230000-0x00007FF9C2231000-memory.dmp

Download

memory/3292-528-0x00007FF9C1270000-0x00007FF9C1271000-memory.dmp

Download

memory/3328-308-0x0000000000020000-0x0000000000200000-memory.dmp

Download

memory/3992-59-0x00000000002E0000-0x00000000004B6000-memory.dmp

Download

memory/3992-335-0x000000001C320000-0x000000001C340000-memory.dmp

Download

memory/4676-9-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-43-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-39-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-3-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-31-0x00000193801F0000-0x0000019380996000-memory.dmp

Download

memory/4676-10-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-7-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-2-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-0-0x0000018B7F4E0000-0x0000018B7F50A000-memory.dmp

Download

memory/4676-1-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-4-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download

memory/4676-8-0x0000018B1ADB0000-0x0000018B1ADC0000-memory.dmp

Download