5f3c83a2485fa7f4ff6d557d8d094de0b885283fb9f7b50912d381fb1edd0fdc

Analysis

user interaction
yes
max time kernel
297s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WeMod-Setup.exe
Size 155KB
Sample260804-zyra5sysdz
SHA256 5f3c83a2485fa7f4ff6d557d8d094de0b885283fb9f7b50912d381fb1edd0fdc
MD5 c71f7ac04095fd04847f81b6503013a4
SHA1 70db8f410a5ac9ef4b4d8235cf399feb20771e36
SHA512 32a636ea94e9c46ec1914d3201dd89595b15ef0315801af340a1d497f535d3ec69382e4c2746edde169768acea7c073d5384cb2bbf50de07eca4e7c2fba318ce
SSDEEP 3072:w0x45QyUyhaEtHZeO/deV4ILlCI+40OHHBpF:145rUwaEtHUx4SF
TLSH
T11FF3AED9E3E815BEE6BB8DBA4C351DB005B7AC421CD5ED5A1D8070A84A33354243BB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
52	2472	msedge.exe

Executes dropped EXE 21 IoCs

pid	Process
4848	Wand-12.44.1.exe
4464	Update.exe
4556	Squirrel.exe
2136	Wand.exe
2460	Wand.exe
4868	Wand.exe
1316	Wand.exe
4936	Wand.exe
4064	Wand.exe
4928	Wand.exe
128	Update.exe
2960	WandAuxiliaryService.exe
2516	Wand.exe
7012	Wand.exe
7020	Wand.exe
7120	Wand.exe
5808	Wand.exe
7140	Wand.exe
440	Update.exe
3772	WandAuxiliaryService.exe
1544	Wand.exe

Loads dropped DLL 24 IoCs

pid	Process
2136	Wand.exe
2136	Wand.exe
2460	Wand.exe
2460	Wand.exe
1316	Wand.exe
1316	Wand.exe
4928	Wand.exe
4064	Wand.exe
4064	Wand.exe
4064	Wand.exe
4064	Wand.exe
4064	Wand.exe
4064	Wand.exe
2516	Wand.exe
7020	Wand.exe
7020	Wand.exe
7120	Wand.exe
7120	Wand.exe
7120	Wand.exe
7120	Wand.exe
7120	Wand.exe
7120	Wand.exe
7140	Wand.exe
1544	Wand.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1995599370\_locales\sv\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Wand-12.44.1.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wand-12.44.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wand.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2472	msedge.exe
428	msedge.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Wand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Wand.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303514670216162"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\shell\open	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wemod\shell\open	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wemod\ = "URL:wemod"	Wand.exe
Key created	\Registry\User\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\NotificationData	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\shell\open\command	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wemod\shell\open\command	Wand.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wemod\URL Protocol	Wand.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\ = "URL:wand"	Wand.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000ecdf7df450e3dc0105e4da8857e3dc01405502ec5524dd0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\URL Protocol	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wemod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.44.1\\Wand.exe\" \"%1\""	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\shell	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wemod\URL Protocol	Wand.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\ = "URL:wand"	Wand.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\URL Protocol	Wand.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.44.1\\Wand.exe\" \"%1\""	Wand.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wemod	Wand.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{11413D6D-C75C-4608-9BB3-1EA35181F53F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\wand\shell\open\command	Wand.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Wand-12.44.1.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	Update.exe
4464	Update.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	WeMod-Setup.exe
Token: SeDebugPrivilege	4464	Update.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeDebugPrivilege	128	Update.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	1316	Wand.exe
Token: SeCreatePagefilePrivilege	1316	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeDebugPrivilege	440	Update.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe
Token: SeShutdownPrivilege	7020	Wand.exe
Token: SeCreatePagefilePrivilege	7020	Wand.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
4464	Update.exe
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
1316	Wand.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5076	WeMod-Setup.exe
5076	WeMod-Setup.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 5872	5076	WeMod-Setup.exe	85
PID 5872 wrote to memory of 2344	5872	msedge.exe	86
PID 5872 wrote to memory of 2472	5872	msedge.exe	87
PID 5872 wrote to memory of 4360	5872	msedge.exe	88
PID 5872 wrote to memory of 4360	5872	msedge.exe	88
PID 5872 wrote to memory of 4360	5872	msedge.exe	88
PID 5872 wrote to memory of 1768	5872	msedge.exe	89
PID 5872 wrote to memory of 1768	5872	msedge.exe	89
PID 5872 wrote to memory of 1764	5872	msedge.exe	91
PID 5872 wrote to memory of 1764	5872	msedge.exe	91
PID 5872 wrote to memory of 3480	5872	msedge.exe	92
PID 5872 wrote to memory of 1764	5872	msedge.exe	91
PID 5872 wrote to memory of 3480	5872	msedge.exe	92
PID 5872 wrote to memory of 3480	5872	msedge.exe	92
PID 5872 wrote to memory of 2388	5872	msedge.exe	94
PID 5872 wrote to memory of 3332	5872	msedge.exe	95
PID 5872 wrote to memory of 2388	5872	msedge.exe	94
PID 5872 wrote to memory of 3332	5872	msedge.exe	95
PID 5872 wrote to memory of 4024	5872	msedge.exe	97
PID 5872 wrote to memory of 5140	5872	msedge.exe	98
PID 4024 wrote to memory of 4892	4024	msedge.exe	99
PID 5872 wrote to memory of 5808	5872	msedge.exe	102
PID 5872 wrote to memory of 5808	5872	msedge.exe	102
PID 5872 wrote to memory of 1064	5872	msedge.exe	103
PID 5872 wrote to memory of 1064	5872	msedge.exe	103
PID 5872 wrote to memory of 1064	5872	msedge.exe	103
PID 5872 wrote to memory of 3492	5872	msedge.exe	105
PID 5872 wrote to memory of 5496	5872	msedge.exe	106
PID 5872 wrote to memory of 2756	5872	msedge.exe	107
PID 5872 wrote to memory of 860	5872	msedge.exe	110
PID 5872 wrote to memory of 860	5872	msedge.exe	110
PID 5872 wrote to memory of 5092	5872	msedge.exe	111
PID 5872 wrote to memory of 6044	5872	msedge.exe	112
PID 5872 wrote to memory of 6044	5872	msedge.exe	112
PID 5872 wrote to memory of 1576	5872	msedge.exe	113
PID 5872 wrote to memory of 1576	5872	msedge.exe	113
PID 5872 wrote to memory of 1576	5872	msedge.exe	113
PID 5872 wrote to memory of 4848	5872	msedge.exe	114
PID 4848 wrote to memory of 4464	4848	Wand-12.44.1.exe	115
PID 5872 wrote to memory of 340	5872	msedge.exe	116
PID 5872 wrote to memory of 340	5872	msedge.exe	116
PID 5872 wrote to memory of 340	5872	msedge.exe	116
PID 4464 wrote to memory of 4556	4464	Update.exe	117
PID 4464 wrote to memory of 2136	4464	Update.exe	118
PID 4464 wrote to memory of 2460	4464	Update.exe	119
PID 2460 wrote to memory of 4868	2460	Wand.exe	121
PID 5872 wrote to memory of 2156	5872	msedge.exe	122
PID 5872 wrote to memory of 2156	5872	msedge.exe	122
PID 5872 wrote to memory of 2156	5872	msedge.exe	122
PID 4868 wrote to memory of 1316	4868	Wand.exe	123
PID 1316 wrote to memory of 4936	1316	Wand.exe	124
PID 1316 wrote to memory of 4064	1316	Wand.exe	125
PID 1316 wrote to memory of 4064	1316	Wand.exe	125
PID 1316 wrote to memory of 4928	1316	Wand.exe	126
PID 5872 wrote to memory of 3832	5872	msedge.exe	127
PID 5872 wrote to memory of 3832	5872	msedge.exe	127
PID 5872 wrote to memory of 3832	5872	msedge.exe	127
PID 5872 wrote to memory of 5664	5872	msedge.exe	128
PID 5872 wrote to memory of 5664	5872	msedge.exe	128
PID 5872 wrote to memory of 5664	5872	msedge.exe	128
PID 5872 wrote to memory of 3504	5872	msedge.exe	129
PID 5872 wrote to memory of 3504	5872	msedge.exe	129
PID 1316 wrote to memory of 128	1316	Wand.exe	130
PID 5872 wrote to memory of 2804	5872	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.wemod.com/client/download
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7ff9f9dac188,0x7ff9f9dac194,0x7ff9f9dac1a0
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,6124893540857406835,1231737264748314618,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,2108978168248005526,10471955736195785492,262144 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,6378494444939350154,12835441937273189497,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3608722725281208374,1272118378705767244,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,2597242978384801355,5582834113349660727,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,10772323124069160681,5183482407427003340,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,4626249605860181699,12309497204191827106,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,11953100489854959319,13727715845297663950,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17314500315970054854,10335046163403195893,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,11953100489854959319,13727715845297663950,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8682771675266025012,15013448934417519770,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6348,i,12485240509704494055,14893700481519151779,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,3423635439851130440,12664361886688036938,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,15467514094319222659,13366749564897863974,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,6574681621954393526,6170685576541127055,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,6558259153749143719,7836833938362181993,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2872,i,5417003319465506677,12309063063686156975,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3437049219582754622,3011277922637778599,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2872,i,8106762246338939984,6017648046273979856,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:1576
- - C:\Users\Admin\Downloads\Wand-12.44.1.exe
    "C:\Users\Admin\Downloads\Wand-12.44.1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Squirrel.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        5⤵
        Executes dropped EXE
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --squirrel-install 12.44.1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --squirrel-firstrun
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=relauncher --no-sandbox --- "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --field-trial-handle=1676,i,16531191541832878012,17884301612150611574,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1680,i,9063779338917591506,6548981438987467593,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1984 /prefetch:11
        8⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1676,i,16531191541832878012,17884301612150611574,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1680,i,9063779338917591506,6548981438987467593,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1672 /prefetch:2
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1785877170033160 --launch-time-ticks=749530689 --field-trial-handle=1676,i,16531191541832878012,17884301612150611574,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1680,i,9063779338917591506,6548981438987467593,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2412 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
        
        C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe Wand\Support_1785877925230_Out
        9⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Wand\Update.exe
        
        C:\Users\Admin\AppData\Local\Wand\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.22000
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:128
        
        C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
        
        "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1785877170033160 --launch-time-ticks=760679841 --field-trial-handle=1676,i,16531191541832878012,17884301612150611574,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1680,i,9063779338917591506,6548981438987467593,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=5736 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7248,i,9484161033136843540,10774317329327267916,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
    3⤵
    PID:340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6652,i,4399699772874603869,14967341693891060666,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6636,i,1739564452695063603,3318604481361566646,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7964,i,5212300649847451984,10092188048362864071,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8168,i,17990831841367924963,10273471232824667229,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:14
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8320,i,4840220843434682413,5644163062470618600,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8352,i,5532761542973929084,4223745393919487459,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:14
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8568,i,9395709603974600621,2951020623182912865,2097152 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8384,i,13547643875173789405,12961086825663070286,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:14
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,12554545510489832294,8840505141627346012,524288 --field-trial-handle=2168,i,11614186296769688639,5363910890096326301,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:14
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:3648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff9f9dac188,0x7ff9f9dac194,0x7ff9f9dac1a0
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,18047744096577271990,13782132545859914914,524288 --field-trial-handle=1984,i,1531000350250007282,11373553224407690639,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
      4⤵
      System Time Discovery
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,2524133825192605223,9559594761844323758,262144 --field-trial-handle=1984,i,1531000350250007282,11373553224407690639,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,1887585967178062494,1320602539158311103,524288 --field-trial-handle=1984,i,1531000350250007282,11373553224407690639,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
      4⤵
      PID:6356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,6268227546964572053,4866241303743171112,524288 --field-trial-handle=1984,i,1531000350250007282,11373553224407690639,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,6268227546964572053,4866241303743171112,524288 --field-trial-handle=1984,i,1531000350250007282,11373553224407690639,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:6588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5852

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260804-2211.dmp
1⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6348

C:\Users\Admin\AppData\Local\Wand\Wand.exe
"C:\Users\Admin\AppData\Local\Wand\Wand.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7012
- C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
  "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:7020
- - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
    "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1700,i,13152974007405173444,15159532277830845961,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,12273142872210776014,546081018024026647,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1696 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7120
- - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
    "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --field-trial-handle=1700,i,13152974007405173444,15159532277830845961,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,12273142872210776014,546081018024026647,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:5808
- - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
    "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1700,i,13152974007405173444,15159532277830845961,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,12273142872210776014,546081018024026647,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7140
  - - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
      C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe Wand\Support_1785877981268_Out
      4⤵
      Executes dropped EXE
      PID:3772
- - C:\Users\Admin\AppData\Local\Wand\Update.exe
    C:\Users\Admin\AppData\Local\Wand\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.22000
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:440
- - C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe
    "C:\Users\Admin\AppData\Local\Wand\app-12.44.1\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1700,i,13152974007405173444,15159532277830845961,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,12273142872210776014,546081018024026647,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ea6d4cca36921420fb287b8c2bae509b68a558db3a490014828b67eac1ac91d
MD5 7a68e1215fbfd7a6660aa61ec0335a60
SHA1 ea21f860bafe7fa736ba044204909989b85c5dd1
SHA512 c3fa4a8005c82da0bdd939e92de866ab7127ee7ee97d81e47e35a9295a250f76376a70ca293c75ca93f06cd4d8c9a6031a4263359174de4215849534e6585f4b
TLSH
T101D023F47657F6D1D73D003894D04210353945F1359B47417155DC0DDDF0048E2E79DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2880a88f58314746a643b1176447cda5c9b53a85083b7dd04fbbdd3a86a107b
MD5 6a57c6066cb29dc8408b6b48e8e469ef
SHA1 6d25ec76eb59afb43edc7a9cb8c98dc4fafdc6c1
SHA512 1a382d7f614c9683e753a5231a194689a4331470a7b8a8eb1b14cbb73bd4b56f1b3741186f665223cff995efb9d9d6cdb70f3841a7ffe2af8d7817f6d9e1ad30
TLSH
T1DAD023F4B346E751C72D4034ECD0A321367691F4349F8B62A065D80D99D405CE3EF09A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 20987248d99a654efa8e4086b7e9ad15859dbd957e8c6342924b166d3b1be9be
MD5 460ef0a8bbcb07988e8b1ddeede1ab03
SHA1 213f10634410e66223c2b5dd7aabae5543c70540
SHA512 5bfee1351de93152f9fc3d73c822e1483f2e48c1191a09447daf2a68537198d23ed7580dfad582a4f0f0710f6ba87aefaf34cecfa3c11778863e1f55ed14fa32
TLSH
T1FFE02BE5C8229C2B09FD071A74600A01D701233B2E804A5F363D910C8FF463E0A9BD5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 67KB
SHA256 25b05fb02fedfc6cce6cbb542030d8ab4e66c10b4d7ed8f3f309e7fea4ac9963
MD5 c6d0f9252d7d9a57f18b99cbdf8083f6
SHA1 fd0c5ebfb986e45d9fbc2ee61a563803e6dd4066
SHA512 745f28a5222771f269e95f323e4161fe2b9cefa2eb31675dd2b23cd33508734cff9c4d4290f57f1221d9ff953d834e2a008abb31df662d3720e23f35f2872662
SSDEEP 1536:QH5HZyBokKeTWIgCgEP+MuMtoVJDuUEMNIbU6eVKwuWvz:Q9Z1eiIgCgEluLfIbU6qfuWvz
TLSH
T13A630218A5EBE63A4B1405E4476A804F37154FBC20AE2E6F88CD760D18F17F59EB8C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 405KB
SHA256 bb90ac8097da7c793676be5885f5cf00b9e5a27e30a878296c59d1b4ba27bb62
MD5 0af3640643657932c2b1de637482ecba
SHA1 363c3fce3a60b5a7149203ef63197f6abfafa9cb
SHA512 cae198a924008b8171580f9753b9c89e629875359b354ce62707e97429dbbdc00121af35aa083c14944cf274b60c1d103a123df475b8c5914834e1067ab5273b
SSDEEP 12288:ube26/DCSTYo5pgiLGQ8ktPC5SRP8l3xri6gXc:uK26/eSVx31t65Sp8rVMc
TLSH
T1AA9423D595D7CAD1DD9B04E6CAFFCCC1983072360E0CA1EE1B12B9AD493F96469B2309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f6
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 42b6ea08e20e09eb0f8ed4f31c649c695e1bcaa5b4e4e66de3e9a9e6f293dafd
MD5 22d95d4f84b3701d291cdade03320a5f
SHA1 c6f1c33fb9047904f469433e91f8e3a4f11e1431
SHA512 905f1f0d1d11385c789c80e4c8241308390b9ce4ce092769a7ffd090a3796aaf7c9cc05af9d7cefab5ba845c4064f1987286cad03f23d43b7568b921128d1c60
SSDEEP 192:ChepU055X3dWHoZu2RWE27oDN+tcdk88LHV/g:CuU070IwLsD4twk8I1/g
TLSH
T19212C98B4FB296A4FF251233B6C589E4757058A9D8831FC3D3E9063A221FBD55F120B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5cbbc6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5cbbc6.TMP
Size 2KB
SHA256 9faffd490a59d0e8e4e855172e499c447edb54ee7bfa3ae6a35903efd16b44b0
MD5 383f5ef073ba9399c36c94eeb34c389a
SHA1 ecc59ea9a4e039adcf32dea58d7d059755b91bbd
SHA512 3ed3c2d38c2002f9a4fa07845538c17aa2010c4891e2850a389d89faec52d85bfe38e39d9e617ade3c5d8ba1696a7f9be84a1883fab328a1c68ec62828eecf87
TLSH
T1BF511F8B0F4BCAB5F362027776C092E5B93288D4CDC72F416FD849B5B41AF661D72648
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 41KB
SHA256 ee41000034e32be3a02d7d62123906ba3f1975053a93749c601972f9f48ec318
MD5 c9a07a3d3a414f2bfeecd91512fd2c48
SHA1 7f6ce8a1d192e7e3cafd6859f32b54bdb2fb955d
SHA512 78e7f668da0409cab79f32606225e0c38563c013f92c8151ed03dda088a0a9b2ed5ff18da8e8d472c690fb122c77166d66737e06c1a9e990b78dc7254f8a6c29
SSDEEP 768:JuC6XAPQyaGao4WYcWAx7fqkMrMA0iaipzkcDYTlMGlGsh0B30bY:iAccxxz4pAcUc0bY
TLSH
T1D013676675F9120AF2BB9EBAE8B21BA54C7ABE562D04C81D5870610D4C31F40CD73B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 383B
SHA256 00e0f349fec384cb2b2439e56be1a904bcb60eff7a3f222bc9f0d970822781db
MD5 fa3818b0d52174b4a0d132d648bb29c2
SHA1 2001061e0f5f84c676cfccab5f3c76af6195190b
SHA512 9d54e40fcfbdc213bd0dbd4c2d785f35d0fbdb2fcd7c50acad441fc02544d9fce9703bad2390528db7810aefb69bbd03af1a4d6a09d89531d37f65c25ab789aa
TLSH
T10EE06DA84ADD821FA59420976338FF4CDEE3364EDEC8AD991F09C858B081240B6ED5A1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 56889bf217b503a30272f7729c960cfa09e2d0d8d8db2e16ba3a1fbcde83a481
MD5 9f56be2d5a5a129ec720896bc5a07608
SHA1 f7c687f105debcb59f1e6cd3ef539a4d06cc6fc7
SHA512 5ec30d73657fb4a61b5926d996187287c97cdd036c20a2a5e2e8fba9e66188e79f284722391aa946f7b54e59347b55d99d067a0447541ecab52e27ae158ab111
SSDEEP 192:D1mra5UMaij6GEr09Hak5TpO+stjcq6CnHiRTwC5eno:D1mra5UMaiGGEr09Hak5TpO3tjchCnHw
TLSH
T151E1CFF3C3E9862DD91191F0EB187E1BCE1D0955436C3D5A88E4AF5BA3F2471E241A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 e8b1425bfe098f6b97f69d7041265d53cabb96173dc585e9cbfacee0792c0494
MD5 7ef908e15e0d9d0ce3ab9cb22cf94cf5
SHA1 9e6d175a6af0285ac82334ccef5967f641addca4
SHA512 9c793dbec5831ed5f0746d5c3bb27756b38652a80211e95fc6a75965e9f96dff7c993e9054d7f672096d0961799734ffd4ef0ac882c1ddbdaffd15f2720fc004
SSDEEP 192:D1mra5UQ2A9nlirkZo7E3pjaij6GEr09Ha5TpOxjIsHcr3AIhVfI6gshGtIvzkel:D1mra5UQ2A9lskZo7E3pjaiGGEr09Hat
TLSH
T1E73291F3C3E4862DD81162F19F187E1BCE1D0954536C3D6AC9E4EE8B63E1472E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 aa70b6a26f71f66c1a4697dfc4e9755071d2ab5202eb590bbffeea979463a31d
MD5 c601c3d2509a11b0ab213a0e529bb74b
SHA1 6809583886cd000c13746269b277d3aa16888809
SHA512 d53e5783ef3eae83dce07aebd6342914f55adf62c474f99d59215592c563377dd203e3e1dbc5d25b4ff5ade377f22b55fe02c8ae7c9b289af58f6eeecff9ee39
TLSH
T11AD023931F343075555C3DC54079FC8FE32660544403DDD520D09C59153549C4F4B141
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 afa2c6b2cdbe21860f8992c561ab276ec202a162a2f7875653bff7614f597dda
MD5 ce8dc1c52367b1e04a5e56d8a3998631
SHA1 506f6d2007f29b29b32a50dcd761fa3ff8849da4
SHA512 f08a67e2cafe6bc690c3e97c3b68c5288b2c8d4e7e5fa0ada602cc532f23124a6207e3af6936dade22f7533c57f325a5d72cb638e337b7a476c43cc283f2609a
TLSH
T19C412DE38FBEB427102C68BF0E98B809397FA435514168F5DAAA867CF0854F74F17466
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 f559c3668f51b545562fb30fe7e250ee5f2370cac71cb670dd9995b4f48e93ff
MD5 a452650f0208e8c748e03f89dd343b7e
SHA1 e9a3796b6c0d1af5fbda79bbeee2ffef93b77cac
SHA512 a045b834c506f432089a44bffe839fa29cf861b5d4c84e39b4352112b14e7459c806128e0b7d7c0af677213397fa3ab3d9effd6a96dc7face5b03b094b2ad79b
SSDEEP 384:sxZ0n1wvm4o/fZsxSV7orN0OdSiV/bd/52sLks:s21um4o/foSROP/bh52q
TLSH
T1069209066634593B9CEBD219FA067B53E7F8252395844E54EAFC9E0C04F67ED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 2ba46c1c7a75b1e1b5077973b67254776e79e9ee794a863c662f23cda0ac2996
MD5 910e5abd8507ca096e73b96d2b8e9005
SHA1 bcbca26ebcca66db094cd163cbce0ee4de2f5827
SHA512 5271e2f6f452dd91602dc9ce709296a06ada68e0a486485f46b30b371ca5c3456b88bbb11f86f6565dd681f876a07aa43a7fdd8b17487807ba9b1a085b6762e8
SSDEEP 384:sxZ0nEwvm4o/fZsxSV7orq0OdSiw/bdL/OVSZsLkYS:s2Eum4o/foSWOy/b9OwZKS
TLSH
T1ACB2F952653489778CDBC619F961BF63E7B91423DC944E98AAFCCD1C00EA6FD2212C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 20ea0424a5557a0df8b138d890f5710543fe0786f1b8d49802a263c39bb8e5a1
MD5 9addd024539f78b47a91a9adad102bab
SHA1 909137f81d63391d98e8e8266935d41f4d445c31
SHA512 ddca17c9d802d20b3d512003c65fc46eac9364988ae00a3cf5e900bfa950ed425e186c70dee9a757b2e97ea860c58211771b6691d071570cba71b2a9028523c8
SSDEEP 192:sxZ4RIyMqZjK1Ml8Mlo/fZsWaKQ7PgYsM0qzodpW/W6+WNGY0ZERK+ZIgjJTJ:sxZ4jto/fZsWaV7orM0RW/bG51sjJF
TLSH
T1A762F7166A389977CCCBD209FA457B93D7F9156391900E44AAFC8B1C01E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f1eabfe09a83d8a20a465adbd83f1b0204c319edf7ad35ceb6dbf034871e9ed9
MD5 3c04f208edd08f96604f70cdd57d2b49
SHA1 7dab37be235f7502c3d054e2b0aab7b0e622ce85
SHA512 b329d0f0d1b4f0d79d0ca4c141aba72bc2199e044f6f2ac44f47f568cd7809b85be4abce3b0bfc41ea77ecdeca5d1d6bdc62b9cc50e53522f352848e5c2a5265
SSDEEP 192:sxZ4RIyMqZjK1Ml8MOo/fZsxSKQ7PgYsM0qzodpW/W6+WNGY0ZbRQ+ZIg5WekIJ:sxZ4jWo/fZsxSV7orM0RW/bG54sLks
TLSH
T1F06207166A346977CCDBD209FA457B93D7F9156391900E44AAFC8E1C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5eb28bc1eb63ae68762ede2134109b3eae534e24abde0cdde2ad9024eba3ffb5
MD5 727b72ab0221c9891db5a87e134cec29
SHA1 a0409e164282b04d4071f2c811ed1b7720d50ed2
SHA512 38d89347d130cb67f3c6b77cfc33a2ebd359e4b5b39765e022f897287f736199383031016658399f79d16094be85e2e7d40abdf483a80d2ee6f5f82e403d2cd2
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3GGq9Llw:XwZh38Dv2SkEnZFWRm6GQFmu1jaKGGqQ
TLSH
T152030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\4f2277ea2139c475_0
Size 61KB
SHA256 c03defbdedca47af1bbae1f59c1cacf2d3e1f8f7df5bdf5d2e6d9daad085f65f
MD5 b6c40c663d194cfdd00c9805fddee290
SHA1 f7f0ab3af475081b304903fc26ec367d3c4bb6e0
SHA512 d22fdedf7236828a00ddac5f12920d67e3ce67a615a2edecd21919136b4c0fa199f5b54cae425087ec8f209f25eb695de01cae3d07fe40b846ad06a3b5a91fcb
SSDEEP 1536:cZEGjq+4JfCS+ksYyiApR+M0Dpbarcjj1WJdsRk5HPwqpzGt/V:caGv48bC6Rx0DND+I/V
TLSH
T1C65318A7B17260358BAD21D6A49A7F00F11B17561404C9ECF0BD6A913B18ECB53B7BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index
Size 72B
SHA256 89b8bfa3eb001ec97369c7ef0b99b4719de5da3e769bb6134e32ed3037a4feef
MD5 652fa595b6737bf3ce93235d16b05755
SHA1 99abd413c3d7e7d0025b062cfdd03ea07be03b88
SHA512 b42ad2dcaa3373ef88fb4eada63420004fa5c3f133136568ac6efa36b7235b75f892e2d4f3e21d7c43a8d6ed4061fc68a991286ec23fb5cce3143ac72b21a4de
TLSH
T11AA0023516D50053C40206B461D625B233245C65A3164315C0A10B569D51979D603145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c2e4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index~RFe5c2e4b.TMP
Size 72B
SHA256 65ee2b3df2b5747581e5e07b0c70f5c2ae66781bb2149db500b0055fb2f030f1
MD5 366d07a5e35a436a0dcfb0e98052a95b
SHA1 db87a706b35bf756fabdb4e68a5a02fa4da63888
SHA512 aecb0a6604ed3caf0c9088553944fc2f77a8c9ade3d26d895593341dafe73221a91f931e20cf1cf336ce8a7b7cf8adf4e3fb97e483b63277edfb780f5257b050
TLSH
T1D3A00265C6960442D01807705E8902547B48DC13554E538BA4D135558D5B8684E01150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
Size 3KB
SHA256 0d0462ea9c510da733ae24ada1cc58ee0ef75b5ec0a6b4c355470c5630e15a7f
MD5 f608843005049d9c5909ba629b13a784
SHA1 8f3b0fae06d8533b17776c2a064d90ce0adaa7ff
SHA512 cd6fc8dd76b6a7eedce9947f471afdf446f04885a23cf16a4a0d456b43cba4688095cb44696d13a4404bf773dbbe239126ba8462c509f9366edc90a20b68b8e8
TLSH
T10051E70D4C830B6EDDBD20726CFB0014377AB8DD56889A1BB49CE0307CC77692FA9268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index
Size 72B
SHA256 f8d905948935811d9ffc417cd1f798fe19243f32458d52d8b316a80ac1d87c94
MD5 8d959fda7b5a272772ac46d61b74f041
SHA1 83273f47069197616459b5a1673bb14fa59b0f09
SHA512 9c96286b1e53400ba4bd74f94d0c8443fb3363d759a353454226e7083e76789f2d1c1374517956aec576428b91ac5948b5c599f76f8044e7a5ae8cec167af2d9
TLSH
T1D4A002FC03850001C81323B03797C3416614A9501207134B81990348D8E0D40426910F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c2032.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index~RFe5c2032.TMP
Size 72B
SHA256 0cb99b934472c59ce598c7173edddeaf8349595e12453262e35e9fbb72a9a0fd
MD5 31c25a12817dfc5dbca67a399686d70f
SHA1 082728f202c5040c160b9156b2eff897e0fd9332
SHA512 a060ab086b02faa4d9b30879bee60409bc00f7daf535d5578eb0c0035e89ae286e2e78992b868ad0e1b854376d342a930902cfb1e6e40aa2140c5e3da51ef43e
TLSH
T15DA002544380850BD42B13B569EB02423750C8111180974741D13194CC554809D4114C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e3261215-22b7-406b-8278-602ec1f49ca7\index-dir\the-real-index
Size 72B
SHA256 d5a1bc90c668f2ab4aeb10ee53c69fdcd7c4af5bdbc70d0bd7dcb96a6242f40d
MD5 23a801e12216d471548c70deed043b7c
SHA1 fc259c6aab9122a7fba7ced0cbee789effda1b88
SHA512 cc6b80ad2d0a7a3394f8f3682ecf8c758cfd8f45e489702763e305a4a2f0aa3f53e26f250d4b577268e51674451d201cff2171e0d9537072fb5ace06224bf072
TLSH
T16AA002210ED3213EC50503F525465D6826A0482013114F05C1D10945CD54B524347514
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c33c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e3261215-22b7-406b-8278-602ec1f49ca7\index-dir\the-real-index~RFe5c33c9.TMP
Size 72B
SHA256 ab110f24ae43e2d336fd653bbc513470932bd984481295c9623356e9ad53bf8e
MD5 e2508a24dddd75d89c50fc0a99c25aa1
SHA1 ad2f05f7963d560d2a9cbfd199a4e975c8c5a5ee
SHA512 661dc5664a406ef6da41136b139860892f90c7b43c9d547c0adbd49e932b7c7396163cbeab177139131032df49c8af950b35ace56a16b82e8b1f84b37ce95080
TLSH
T1FEA002D857453149E22203745942D2746702897940F5563246E107449CE68464732811
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 95693a97e9923fd3513d32e6a40e1a61a15a37ecba916490eff3f91e89dc9252
MD5 03cc27b3a8cf0b76f3d833fa76b3388a
SHA1 b9176437a3af2686f6279c82683bff146d3c1a68
SHA512 d737a66da94f3b5cb255319fc04ed49369e36bcdb8aa3c2ad207bd3a28204f53be57c4219e746d3d3fb1b1b85a046852c21910694e717976b3e5fffe943a2acf
TLSH
T11DF027FB2DE23D15FE6BC3D2103245640415BCA98510EC6F146EF39390B1739289DC72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b2d88b1c38e35b4db840f362d606675c48f55c1410cc771f31e25a77133732a6
MD5 1e186846664cf50f0cd2c6dad5ef20a9
SHA1 926da40a0922d6d2e3b6e78c2886808bdb48dd21
SHA512 54d1cb5260b2f9872c0aa603f4911c485a17dacd6c9f1c70b5a0736d7359dac7b7e3d6d7385fa136f9eebb35cb11505557f99344e84885737b8f4738bc6c16c8
TLSH
T183B01230440C9081C02902713061085431142D101205130848AFA9B5856614042CD101
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 a2004a1b41aa215d8327a0674781e214b295ac4e4d6f9a57aad6740a17d86700
MD5 af9fb754b46e0e9f99a7876a807d4a1e
SHA1 c753edab4d5489fcd66f6fd1e936a0b40a6a51ea
SHA512 5343b6df75cf06d9d6bec6831e3631dd8a84acd664db8c687cc0a44be02550d5b8af24dfa4486a40db5f0a94124aaebeeb1f480835052326758c0850ad175be6
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlh9/IDg:ctGj+BCNC5qFVpKxhFI8
TLSH
T1B6B2651632BA02023C7E791D87A497371A42B1B33058E93B7BE854B64E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6149b43-32e6-4189-b9b9-0763c5713c84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6149b43-32e6-4189-b9b9-0763c5713c84.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 32e7637b8e9db0a9c880eaeb65dcf0b5182c6a3bef6394d49d241b9d3e5d05cb
MD5 ad776b30f73c0224deccc8aba94c504f
SHA1 82a34f5851bbcf2f679ff158b5b1e0328ecd6e0a
SHA512 670f5a850680467307d41c21204f2010a450923b7c808c2aac9d25744c124d3d23e8c0d925f24f521f1e1933ddc5a2abb5db2db2c4c94b00e9b54f79824886cf
SSDEEP 768:4FHP7wggRLo+Mv5i+WNMalZ4TjKgqmU4m:GPOFuiN534igRUJ
TLSH
T1DFD25A72E8A5DAB7ECEA8AC9F34A7647DEF01063C5889ED4E5D85D1D008319D170FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8a7acdc4d4bb2e6445c9e75afaacafc8ace3454c6716e960d846c872762c6d2b
MD5 5edc3b1f91353ec2793565ac19bc45ea
SHA1 0a74c5dead7ad89bcad3abf451a8c6888006a73b
SHA512 584e99385affa7c414c0f07be83c3ebee25bb1dbf5261a6916451be834014247d4f500441aa26d6d0f8146d1e12a671f6b9aecec2318c5b8c646f1d5b8b5b84f
SSDEEP 768:4FXdQXwggepo+Mv5i+WNMaKt1NKRkJjGTjKgqmU4m:QdQyCuiN5UHKGJjGigRUJ
TLSH
T1ED137FF98CD3897AD89E6B8B972D2D1659BCC133F1A48584F3990E0DCC6647FE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e179f5675813c2ffa22fd7d89bf02a6354d01d7a1884bedffc7821a59f8433a9
MD5 a4fc832017ac0525882d74fa4a8be9c3
SHA1 5b42fe6879548a7d7c3b76a681c09210e8fe7d77
SHA512 81e0b03cc12009cee9b155455242a49fac5d5d75a8749ef369236774a142b85bc1cc1b6bd5ef516210164caff6dbfd7a1c8c272bdbb10aaf5c9767a57bd63f44
SSDEEP 384:nIiF9CcmyWCs38Nt8TUNTUlIxBrk6orDF1ifbMorrmViv5inbSZXHvuTQwty/7IW:TFccps3mwg4PDTo+Mv5ibSZXPuTQB
TLSH
T112B24A36EC98DAABEDE74FD9E74E7643DEE01163869C9AD4DAD80C0D008719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 da6b2daf90b7a963865e079017e4bcdfbce64838c609a7cb7c79cbbeabc1c2c6
MD5 d771edf22f7dfb219b1c3dbbe6fc3f82
SHA1 b0d2c134df4f831594eb3da83921319b5d1ae422
SHA512 21c3a95490f45b895954575b5530d4a76be3e21e87351eb184a9277d2d6a8eea24fb79022e82eb1a848ee90520ffc59d0f08206122b515b54e914f34d6b09182
SSDEEP 768:rFccps3Lwg4RV6o+Mv5i+WNMsRZ4PuTQB:Ls3GKuiN1b4Puy
TLSH
T1F9B23B36E899CEABECD74FD9E74E7687DEE01163858C9AD4DAC90D0D008719D1B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 33b631a0e3152a36c57ae701f94767b0db806a6386dd73323e964be4ebf6e24b
MD5 e24c6db8dea19287c69f60e59f5b8161
SHA1 372c4e874224e607c82a482e944a50e065f98610
SHA512 4c753c6aa8ad64c866033eb9a8e0d2e7b26aa192adba8294ceafc4bb614cd6eaa7922445e3445cb15d8b95dfc3c52baa40c59666b5f26b771d15f5c846d1674b
SSDEEP 768:4FQb7wggzLo+Mv5i+WNMMkZ4TjKgqmU4m:hbyXuiNDC4igRUJ
TLSH
T1FED25A71E8A5DAB7FCEA8AC9E34A7647DEF01063C9889ED4E5D85D1D008319D170FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8cf0a2194b7b2a40a384afe9c9cf186503f6a42c8edf8b9cbff333cfd96b95cd
MD5 c676d6bdeceae740d13d120e2276e9bf
SHA1 32a6eef2e32dcb4f5044e0b9e6b4625e7fee79cc
SHA512 6a90b23de593aa7b0b27f10d2bde8fcb8a165b50329d537a8ca7998948211b4d06e924ff3d3aa1c82e00113504b177b1a24645b61d52ef5f8d75b9c2841fb467
SSDEEP 768:4Fccpg37wgIA/o+Mv5i+WNMs+Z4PuTQWj:wg328uiN184Pud
TLSH
T1AEB23B76E898DEA7ECD74BD9F34E3683DEE011A385889AD4DAD94D1C008719D1B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 80e1517936f39cdb6b47b9933c174eef86fd6c0b428b060fdb4da1bbbbe6e37d
MD5 c4d9a645db76ef45af2f152fb956e2c6
SHA1 ea91582d986c93ee15edfb5b30ef1528e6c36c9b
SHA512 1c29c80bab73c323ac5e3a1cbf14f963398725def6bb0b0ccf9ad255b9f2449ca10ce9a9d4214af6e1b1e1a3b4b00cfc4820561a12829e0c8591c4977648c323
SSDEEP 768:vFQV7wgV4/o+Mv5i+WNMM+Z4TjKgqmU4m:aVb0uiND84igRUJ
TLSH
T18CD25A71D8A4DAB7FCEA8EC9E34A3647DEF01063C9889AD8E5D85D1D008319D170FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9f0e7e8f0eb58c077c58e070de8ca9e3d2e6aca571a1e6c1b473e5e523d06062
MD5 51d7aaf678a9d20d35f1b1d4ad82cf24
SHA1 d1cd979ac4164c7ab59ac0fe3f3ec03ab0d33057
SHA512 2ee2b6951549e5eb27f6b8da3d3cadb08b41239dc914e75ddb959f6cdc8bf3925a86b38c674cae5bacdd06dccd9660df211a3f49e0fddde8b8972ccdd815b506
SSDEEP 768:4FQe37wgV7/o+Mv5i+WNMM+Z4TjKgqmU4m:he3bruiND84igRUJ
TLSH
T155D25A71D8A5DAB7ECEA8EC9F34A3647DEF01063C9889AD8E5D85D0D008319D170FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 67b535f127e0c549434d94121e37fca6c4cc41d46a3c67b33f3f75c530225ad8
MD5 312301ef1bd6c7456f2b6f680f2cdd64
SHA1 39f5e1a3952d7908f26828fc6591df0bb9268222
SHA512 60c9c23a0bcb848fafb5a91727ce23d219c16b0d332a9cd91d34aab2bcd79b3a977fffba0362bb4a5d968e0a63ee6cec253e2395c74a13d6cb5f893c54a54dcd
TLSH
T16FE00430510505FDC03C0331014355313FD1541041F103044511455D1C337415330FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c8b5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c8b5f.TMP
Size 392B
SHA256 17dd871b17f14d6d0a2c667551cb3866cd22bbefe8a639e58b3d494360e3b95b
MD5 da43e8bb0171bca35a0ca24763f3d69e
SHA1 e641206601f8b78de137ae3f80b596882f51cc8c
SHA512 38921a03b389c3e7028e8e7afcf36651d3fe7ea2fb99545ee47b4df033aac77b9ef37dc56ba55a8f28d6e740d6674a306ddfbd451026ca6b5bb6c612c65c27fa
MD5 SHA1 SHA512

Submit Download

Ruleset Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\37\10.34.0.84\Ruleset Data
Size 3.5MB
SHA256 54bd9731392c3850fc347fcb09c4dd558c915e742dc491ae4173ba1f00abaa50
MD5 135db4e8520e0c6ad4abab7bba2c621c
SHA1 ac85f5b7858165aaa8cfbdde0919364ec14654c8
SHA512 2bcd8fe87a02350c49a18327b614294530721c9456487732108eb0f2c4842faf2b329f04983f36f46424febcd59c0e5e14d69a9f52e60a6dfd161926ec6b7ce7
SSDEEP 49152:aLNynd3uBgOEqeaZjRBwJHKKZ80LkF8AghdiJXRhPgjEdqmGe6BL69hCO4bmMNP9:mNIT+wuO60
TLSH
T1E706A352572D4B22F0D2C03A88F5CB357700F7E4A19592EDBAA8414F7D8E2712F5A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5518e03db6999f16e0ae96380a64854f3e1649c305406108e401279d244df567
MD5 a99a2aed8a48972df5d879b7d8a62a09
SHA1 1fecee92c59b375d52cf5bb7c1eabdabc386a9b6
SHA512 297e0b73c0738cff817b533ea05bdf6229aa50ab305aa58d0991051de17fc91331c5fcad1fa52e8aced0c45fd0284fbc1675121f6a551434c74a680db188c648
TLSH
T1AD413FD04C385BC2D5BD0A6E348B38EC92DCD735F5A4357C6C98E9950A7925C748883F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 77B
SHA256 8750ab9bfaed1138a3f4aac405c69cc17805a2639c725fce575bca56a64a89a8
MD5 1251109b22228df845d191ecef07e76a
SHA1 9b292fa12661ccf4c51638070a0f57f72791c07c
SHA512 271c37e80a30c0a5951f1a008f1a2bedf7078f66ecf03531fe37fbf518eb359f8dd208b3b0436beecd4bc964a4de28491fb2c35f916e482001f7f8438aa12eb1
TLSH
T1F9A024C45437F47D43DD010C001CC4734F04300F07CDF101044753070435000511074F
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 0339014a4600f11f584a186403ebb7f81d30fe0a5f25367ff8cf2d0133be410e
MD5 2fa38f7582bc1cd61140cdd5d7235e0d
SHA1 04323472be6bf7448b382a2ae5a33e4779406870
SHA512 c23eaec44eec3fba611b0836b335b66e32cd1e538d2c6a28125efce9b9c8b44355027e21e05ba08c0de1177b71d3ba13d220d501d0805ab5257029707dc2ab2f
SSDEEP 24576:vwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYsD:oRZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T18C956B12E7E88F3FE56E27B6F471105907F3E5866362F78B6A0C61B92A833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 43B
SHA256 71d66e87a9561f8cc70f06a466a5f75a77aa9cb55e8795e0539c514eff7cf7d3
MD5 16a098a0d6be1295817825c888a8f03c
SHA1 609b1472e8db8411ee1d8c8240c7a17c2b01eecc
SHA512 6fd899b855845b173295a321488fea2a8bd2081f9afdcee77720df88baf3bdfd761b159123e4343e5aba51d4cf0c8b3c00fa41dc9f3d87a2ff3153d9ee4e8245
MD5 SHA1 SHA512

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 38KB
SHA256 6c9c2af113518416fe5ce94f6e415bd65b18ac1d9fe5f77660a94456c5a7d420
MD5 1d5992317607e5d531cb677a3c873059
SHA1 534210ebbc824f19949683bcd32281ec90b0129f
SHA512 6711816fb473255ea6ad78353f3795fa7808fb99a8d91241dc9fcd33eef125bca4bc05dcfbc1211141109ff8ac5f26152c89475f0df29fe81fe5d5e2a25e07a8
SSDEEP 768:2bZUR9ewbyFBpbqCyAE8QUcWDXpKPnpETPRkmHRY7xLO6WsGeQu:Dy9zyuQycl
TLSH
T192036CE8EAEA15EEC1B7CCB28E320CF07173AC4285DAEC5365899439D293619547364F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wand.exe

Path C:\Users\Admin\AppData\Local\Wand\Wand.exe
Size 670KB
SHA256 52653af835198daa3478208aa5cb60c79f404e753bdc7b156c064690c284efe4
MD5 eeeff5f2f878887afda697b672d077a2
SHA1 9a3117ce0448d109d5263dd6e7ccae11f8ece89c
SHA512 fbf666f2aec49a7c6c256950ee678289da9417dea99b7b057aacc48d847148e77aba5fa1b857b303535f943ec47fcbf0ebd74a229f67504447796b98bfc489d7
SSDEEP 6144:fZzvhs2Z4n1E7g34XtVYAOfTdh5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rjlXU:fJ+2Z4nShVY5X5KgHUizA1CGpXU
TLSH
T162E48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\ffmpeg.dll
Size 3.0MB
SHA256 9554680cd705ae5bf765bf9879b352e8cabf0d666ec799a4b9e40c1439a5bb26
MD5 7ce5dd6c107d534720cb108d585220f9
SHA1 df0d49a63d72fff171f6edc95951f2f5bc9b766b
SHA512 6d190f65e97f712960c1e0e12f3f665d7fb383708dcdd692de1989791121240ff39c9555abcce7ca315e08ee341296e0fc8bb17520f4c07cb39719926d256dc1
SSDEEP 49152:llyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bWd:llyJGsQsU+is9dNoJAe
TLSH
T102E5AE02F6D651ECD019C034979B9313F631344A4F209AEB16909A263F6BFD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\libGLESv2.dll
Size 7.6MB
SHA256 5340c92bc94442ea8b329b12e1786a51dcce9ac5d46795ee5f0bd42928926d54
MD5 86be7be3af30f990266eb8177b662000
SHA1 1d81b874d59401a39a72a91a656274981d9df04f
SHA512 1e51289cb8233ee87d02deb6a26701d90676e1b4c87c745e86807f9bfeba04ad9fe29765f63ed882d237eef73bcc598077c0991df40edc3367d8cb1a8f4e013a
SSDEEP 49152:sjZmaisHsL/nWt+Xa2KQOQe1gt4eUXNG8nL1cwgxLqBQ3ypxnYAZkicN1UZ+uNmC:dgHqnNj6ZAIxnRZkbYdp+h8iADBXw6h
TLSH
T1CE868D03F69541D9C05DE2B49B67A223FA30B8550724B7CF2A9447162F6AFE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\libegl.dll
Size 520KB
SHA256 5b60fe8bc87c50adf5f8f81eae6f89156970d2f146dc1f3102e08675662d69d6
MD5 ec46a3c6067798b4cea10bf0340a95bc
SHA1 82eed34d4b9afdbeaabd2b3bf304e25badc6d812
SHA512 2e90c45acc9cdea65cc792761fe6d8c41252a70ae0ac37585273b584b961800c1da672cf1fd1e117e853b3e6fb25ba39e34215697f2759144fa2ff34cf607e8e
SSDEEP 6144:leQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4WfaguL1iMg:1G/V/iZJOmW6GVGWFcsfAOugP4W410
TLSH
T1B1B47D15F3E84BA9D07AD1348A438642EB7174921F65F9EF02E052352F3BBE45B7A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\locales\en-US.pak
Size 549KB
SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
MD5 0555742b1e5f91449a199b9c42c1eb3e
SHA1 2f7ecfa75faca014c06e435fc6d449072d47ac41
SHA512 6d5f20741c97933d7c2d7011b696632e056db182941483e6c5675ecaf2b18132abbc0397b2c703e79a878838db806766aab69b2c90f6fd1dce377623d5501af6
SSDEEP 6144:LOvSsWLA2zb+H4HfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Bwf:MAxJHfdZM6Qqbg0jBwf
TLSH
T1C7C44D1FF744112A05A352A2BF0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources.pak
Size 6.5MB
SHA256 096373b7b5a9535b5ba60a37883d1d2010d28dafd90d4c819a902db09aef4ad1
MD5 204420168fdecf480d2eb1ca479c3877
SHA1 2b853205f5e2b8ea76f0beec2256f62bf6318347
SHA512 9e7992f0889de939b38642fb0991e9dfa8b7e8a74a5804a936b2e4146be29548c8a29ef16ca8cf14d256dcf3989e10e57780d8c531c422f2e1b594f9ade9106c
SSDEEP 196608:+mntWBRtfTL5QoCmkrB0QMguFBgt3m06Rw+K6:+mnkTtC9mkr4jFWBm0iw+/
TLSH
T1F76633D7B1346C1BC6C443BF8918463AA85C6B707D86D2D2189C722CDCAE64A6FC467F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar
Size 46.5MB
SHA256 8f22f7be282ea7c4729dceda059993e6a87d37f1eb7bec75db0cd896b0289d24
MD5 fee51ab0ef60282816cc3daf24e1989e
SHA1 389b86e4fa539a7c4d64cc7aba1f485d60544e1d
SHA512 780140c4e55064cf6e6fa543021014a40d93ce2b4a0f82c4cf5ee5ca0072a690ad9f0b7f23258990f3228d9c2cbdbc7dd78d77634d43464bd1fdac657a982c54
SSDEEP 393216:KXup81umtzSbev/zlHWJ/gfUzAbHMIpR+ZcN7lgFsD96a:KXJOe52BgfzgZovJR
TLSH
T12EB7D01DE2B46D7615AA10A620463227B13410A7BF613CECB78CC5AC4FCE98E6177B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

capture_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar.unpacked\static\unpacked\capture\capture_addon.node
Size 353KB
SHA256 a20003b4ffd75672a8a350610c3656da34bec1db4402dc4f7b8c7b6bde705684
MD5 8891159e42bdad429af7f5396b639da0
SHA1 d7d7331a1c56f0ecb559a6a07d40ad21dd3ac1b3
SHA512 3f2c684be67b29dcd664c6afd6f98ddb6ef05661888128f756306c97eb7c11f47591ed658a02671ed45529688ac0b172cbcc7c291b6ac6209596f4e7aaf51fb8
SSDEEP 6144:pBwUknKeSUreO0nj4BPxQUx+zKt26wEGnwAp/j+1:pBwUKKeSFOgjkPxYz02XwA81
TLSH
T1D3747B1AB7A404B8E477D23C89674A05E7B27C4A0760E7CF23A4435A6F33BE1993E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar.unpacked\static\unpacked\icon.ico
Size 409KB
SHA256 1a90e62ec52c31681af31d9cb4790c8a3af4b72bd8de3a0e937802965a23a38b
MD5 06aa52a7fa25dfc51e7c846172d985f2
SHA1 10adb45e32e5a4831154e5e17425ba3f911bc325
SHA512 b7f3c9c000a8a4af76cf619908177bd29a98a69825e2f711705cdb810bb8c8f4c29ec8c409855ca1d1354dc52c72f4c72100dea24727980d4b8ecd1e4a4ed3a8
SSDEEP 6144:t5Ker1PJVHjMYimBSfN/yw+Aw1ECD45rO:t5KgHaizA1CG
TLSH
T14E947DD5FEE521ECC0BB9C7A4C325D3169738C4698C1EE92588779BC419316A2D332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overlay_addon.node

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\resources\app.asar.unpacked\static\unpacked\overlay\overlay_addon.node
Size 584KB
SHA256 66c7aba787575822ccc1523be5fc98986b0e0bd1b75c430310823027acf72ac3
MD5 b1e9575ac15da4acf58b972aa4a19e19
SHA1 33608ed5f5771ec22439351344702fa52d02c118
SHA512 8a293c9564d6ad9f9653a16b9562a0f905f8786b3894a6c1dcc9b85e626486dcbb48c80e21f7846b5e08b19c099dfa8211e6c929582a9c90ee925d223127ddf9
SSDEEP 6144:eK2OdWGEPV5JCaZhxodkV1ogSt56MqyRCeIj0mTxOND+PgAjB8ODG4MOyoQwXc/w:eEEPV58agp6terNevDG4MfS3f
TLSH
T139D47F2AB2AC03B9E167D178C9434916EBB278551370A7CF03A1569B2F277F15B3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\squirrel.exe
Size 1.9MB
SHA256 1b1495c07576a46a2fa43f0b59d5828f0647f96ccb6ea2b7f0110785a2fbdcf1
MD5 2624e7459767ae311a637c3d45b9f79e
SHA1 e01883d52940669dda06ad5c0ea89c84479bbd14
SHA512 40aa836b40a53b94fff706fa5afda7cd7c4e3785640d549f771b080dbaab489cbd0571359c10a6ff1118cbea90e19e60716675cdac8662f5ecbf24bf9783ea91
SSDEEP 24576:twRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYs2:+RZe6acFI54CGT0bG6mB+a/ey5m+qv
TLSH
T1D1956B12E7E88F6FE56E27B6F431105907F3E5866362F78B6A0C61B92B833148D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Wand\app-12.44.1\v8_context_snapshot.bin
Size 698KB
SHA256 ed5e979db2aef4a152758f2b9b7b06349a1d3d5dd687fdb96e2b3fb730a465e0
MD5 a119c66308517b41d07e0c070939d5d0
SHA1 e5ffb8afeb8914c4981d93f3727183aa451c6a88
SHA512 fb27910e77f0ec790c4c193c726d93be01ec080d9f4175194094c36b5107c71f53e9d2f9c6e65f0b2395353e34bb1a759c0f36b55f227221a97757d0e44c0bbe
SSDEEP 6144:G/V4XptgO5XKt+Hlzk/ov7Cx2NyuClVlxykismIdukcLKYNcPK:G8D5XoAvmx2NySkQIId/H
TLSH
T1C8E4A761FB0A8F3AC5453BBD8DE657463A30B18E9E87E24B7405633D78B96B04C3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

init.json

Path C:\Users\Admin\AppData\Roaming\Wand\App\init.json
Size 53B
SHA256 1f79d06d8d5c23f69d271f2e0a10310c9b9f7216245dd3d71737e3d306e29355
MD5 31b91626fb74f9ebb9dbd2e261d9abc7
SHA1 16573d5cdcb965e427f09488f39de22ee15342a9
SHA512 515df2e60e5725cdb40042672a51e01b78796ae9c3f1e5e34a2174174bfc9eb070b66ff4b54245290d42977c7072426560a43eca2ff3564a6b52476330dff1b5
TLSH
T13B9002A815E510229B01134B04C2243295581025C45909756C9A915008D2916495B26A
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 847B
SHA256 b28d4548a140388de060461d3d3aa9d92449338f7b734c8a874a9b7e5a5cb1eb
MD5 3ca109f417401a3873f2b8bbd95bde7c
SHA1 cce4b948bb81b4f24be8e4ed09bc1c25c6364c55
SHA512 6428f9e134d6874585867753f621d9ae798eb6a2321cb73c5f03b20d44380728bbcd9e65d5d582cacf39214b693976ad0257cb7e9ba798bda395381cf530d01c
TLSH
T1EB0189D3C7E80A3E896223F82F243923C1BE0908131C7D568CD9EB4E5BE6475061064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Network\Network Persistent State
Size 868B
SHA256 02783e89d5bd5f5ffffaef0e5999f524872bc1d1655ae2e863c6ef095a8386ef
MD5 5554079900d755be3a57592f8751d57f
SHA1 b315ab14ae4643065813c5464eb39b7a68626933
SHA512 e1b6afe69a4302eda71686885be322760aa89ca7d0bff227d72fc8bc852f6abbb007b453c4df2f210053620d7ca1db18c97a4b5bd608ef4f2c781998ea5c0059
TLSH
T1171166D2C7E8067E896613F86F243A63C1BE450C031CBC528CD9EB4E5BE54B15601A8E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Wand\Network\TransportSecurity
Size 189B
SHA256 023a625c92f08d3beb979c90087d2324aec3b3fe3ce6bf95282ec7ccad63ecee
MD5 0fb6388ee311305165bc8c32c3df61e2
SHA1 6e1a633008f916cff17ee0e4118b5283432ddbc5
SHA512 e4692d127d3b2aca99727a5aeeeb14d632d1b5003e0d151dfb77c9461fc658e291c13afc6564aeecbd910744ec9b30e36aee9b96c4da1a115709ecbe0e4f7bac
TLSH
T1D3C0223AC23EF8F33C3C527A2D00B0903F31D03110405CD0D682412E61C20E9150A001
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 57d61f90b1fd849277945d840763b5451234315351215a1299c2546eb6a58526
MD5 4573ddebdd20abf1b034d10b1b49faf6
SHA1 cc81370c246064d4c7d58fa9bc3b22a6ee8a6f9a
SHA512 36dd7bd7bc2eff0cf8dbbbed29837329660caeeead8817725caaea606c673815d7e9145328d2654859f2687a471c9f2f57776a1764d567b9562447a04c916a2a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\Network Persistent State
Size 3KB
SHA256 2dab3e8906743733c1d6927f0c76f0bf7dcbadc0cb500d8a4f529ffe0ab9ffff
MD5 d5aab84d2da0ec6330bee0da7b2f4df9
SHA1 9c82ab30ef147e79856bb8e709c75043ffcbdeb1
SHA512 49962a2b4456b1ad636d0829f50494958e759288a63849fe7f465edafdbb43ff7e410f46580951b5b02b3480c693ec8784f419fd25d243ac706068606cee27d2
TLSH
T1117188D7C7EC463E8462A3F55B243A23C0BE1A5C536D3C4788C8DF4EA7E18765641A8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\Network Persistent State
Size 3KB
SHA256 2a5784b361ade5338f222b36233188c7206e846eb9d5733c99fe3e485548d4ec
MD5 e2185a96d8c85aaddc4002176ec4ad69
SHA1 9987a1bd6b61781d8080800467684004617a907b
SHA512 ab3d1cc5b0091fb9577b243a960c289613b94633c67007bd14968ace0dc7f2241daf8a05ef1f39718d53b72cf0c8fd9e9d229fcb22bcc3e36dd017f71aa2d0e3
TLSH
T15761AAD7C7EC4A3E8452A3F55B243E23C0BE1A5C536D3C0688C9DF8E97E28765641A4E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\TransportSecurity
Size 522B
SHA256 626eee1ee3f7bb08d741a83fd51dbc33c89e4699dea9775c20bdf1aa7a8ff056
MD5 07ff3a4eccdc2700a021fe7f6ad0b6a2
SHA1 0218e35b70dd5d40b4f638cc3152ff1deb85e310
SHA512 cadb5278b2946b7f0e5bb9d982a4179bb360695b8f339d0d80403d47aa54193a924fcfea02306238943b9f4743838396d34002340dcc3639cf83fe0900bb8ba5
TLSH
T105F0E9538E7EF4A7147C187E0FC4B4057CBEB4300551A4FCDA2A856DB5815F71B0A81A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 35456272fe99c9dc9548e3d7ccdecabe363aec577d28380d4226b5a149986ca9
MD5 42b0aa923592f55f40c9916cf2131be3
SHA1 ff6ab2ff523919b079514bcc8d217c2f214cd1b1
SHA512 5d74a0a00e41dfc34fa6e39f534b03e39be65cb610fec5e4c3a9ca836151791f8587bd4b9454b03feb865f3d9221ab62c56132a2cb56bfdfbc391e78db6e2f4d
TLSH
T12CA002195944C1D2CA4512F850451385A2047EADC000024583D00289DC511A4A791091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c43d7.TMP

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c43d7.TMP
Size 48B
SHA256 3bf4b4859824812a5f4a2a616794b5b09925f2f641864bf5be8748a4cd2d5e75
MD5 c16bf4d082db3d817e0988086af9936f
SHA1 7762224712e55345d2280afda850ea3bad0abb48
SHA512 38a4e8d9d7db67d044a6407b041cfbe071235f18b315f0451df78724e0bb243b3bb7504c068ceb7c9fedf96dc5f5aea47c2e6ab4d0b5adf3837367fa03d577d6
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Wand\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

b8d05153-c50f-4113-98a0-f1dadccd5c4e.tmp

Path C:\Users\Admin\AppData\Roaming\Wand\b8d05153-c50f-4113-98a0-f1dadccd5c4e.tmp
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

Wand-12.44.1.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Wand-12.44.1.exe:Zone.Identifier
Size 102B
SHA256 b248217de772c92f2bd4760c7871e5988a34c3d4f67556dbe47d58048ad4e616
MD5 d2f06e815219a0daf1df558ba1b98131
SHA1 559153a84da08b33a80bba3ab5ac31823f52d342
SHA512 84da7820b76727c48a985e120756574d259ebab7a9530972e22627f6861075ebbfbfd0bdbeafe4ca55e27e7fc87fbc6dd7b9450427f1a590e00770f4d0c5b77e
TLSH
T1F8B01283C624B43D5E0523CD598DE03C701FF1109A8E83E89CD1809A9AC51EA03F2D29
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1594366241\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/128-1675-0x000000001CFF0000-0x000000001D518000-memory.dmp

Download

memory/2516-1917-0x00007FFA206A0000-0x00007FFA206A1000-memory.dmp

Download

memory/2516-1916-0x00007FFA21670000-0x00007FFA21671000-memory.dmp

Download

memory/2960-1674-0x000001FDC2DD0000-0x000001FDC2DF2000-memory.dmp

Download

memory/2960-1671-0x000001FDC2860000-0x000001FDC2974000-memory.dmp

Download

memory/4464-839-0x000000001CAD0000-0x000000001CADE000-memory.dmp

Download

memory/4464-501-0x00000000003F0000-0x00000000005C6000-memory.dmp

Download

memory/4464-838-0x00000000214B0000-0x00000000214E8000-memory.dmp

Download

memory/4464-1415-0x000000001D440000-0x000000001D460000-memory.dmp

Download

memory/4556-1008-0x0000000000C30000-0x0000000000E10000-memory.dmp

Download

memory/5076-8-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-6-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-5-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-4-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-2-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-3-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-1-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-7-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-9-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-0-0x00000227EBB30000-0x00000227EBB5A000-memory.dmp

Download

memory/5076-10-0x00000227EF990000-0x00000227EF9A0000-memory.dmp

Download

memory/5076-28-0x0000022FF6DD0000-0x0000022FF7576000-memory.dmp

Download

memory/7120-2690-0x0000021E71B30000-0x0000021E733B6000-memory.dmp

Download