Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
24/10/2026, 01:06
Static task
static1
1 signatures
General
- Target Wand-Setup.exe
- Size 170KB
- Sample261024-bf62waez3v
- SHA256 666299af0faa6ea090bf8ec408a105ab61e18e840f989327a9ef58e9e6f0723b
- MD5 8c541649939c359dd7e5c0efa75e0af7
- SHA1 5384774355a195fc0eb863f46b857ec4d27c77da
- SHA512 87ece163725d9da56ad6b7959ab6bc8d1733cb2d66de11483ca1af33880809ed092a662a2456efaea160434b26dfd75ebe71b1ee1c556808e79eab6d4381e017
- SSDEEP 3072:/TdcOox45QyUyhaEtHZagrT3vTi45QyEfr:/TdcOu45rUwaEtHPi45rC
- TLSH T13204AED4A3F915FEE67B8DB10C310DF0127BBC8245E5DC0A2A85B0B98663754543ABAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 29 5948 Wand-Setup.exe - Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation Wand.exe Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation Wand-Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation Update.exe Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation Wand.exe Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation Wand.exe Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation Wand.exe Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation Update.exe - Executes dropped EXE 12 IoCs
pid Process 1420 Wand-Setup-639284007855811015.exe 3008 Update.exe 916 Squirrel.exe 1052 Wand.exe 4780 Update.exe 528 Wand.exe 5128 Wand.exe 4036 Wand.exe 4136 Wand.exe 2756 Update.exe 4312 WandAuxiliaryService.exe 1436 Wand.exe - Loads dropped DLL 12 IoCs
pid Process 1052 Wand.exe 1052 Wand.exe 528 Wand.exe 528 Wand.exe 5128 Wand.exe 5128 Wand.exe 5128 Wand.exe 5128 Wand.exe 5128 Wand.exe 5128 Wand.exe 4136 Wand.exe 1436 Wand.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Update.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Wand-Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Update.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Wand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Update.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WandAuxiliaryService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WandAuxiliaryService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Wand-Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Update.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Wand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Wand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Wand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Wand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Wand.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wand-Setup-639284007855811015.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Wand.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString Wand.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 Wand.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 Wand.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz Wand.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz Wand.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 Wand.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz Wand.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString Wand.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com Wand-Setup.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com Wand-Setup.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total Wand-Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" Wand-Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "35" Wand-Setup.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage Wand-Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1" Wand-Setup.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com Wand-Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "35" Wand-Setup.exe - Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wand\URL Protocol Wand.exe Set value (str) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wand\ = "URL:wand" Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wemod Wand.exe Set value (str) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wemod\URL Protocol Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wemod\shell Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wemod\shell\open Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wand Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wand\shell\open\command Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wand\shell Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wand\shell\open Wand.exe Set value (str) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wand\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.66.0\\Wand.exe\" \"%1\"" Wand.exe Set value (str) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wemod\ = "URL:wemod" Wand.exe Key created \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wemod\shell\open\command Wand.exe Set value (str) \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\wemod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wand\\app-12.66.0\\Wand.exe\" \"%1\"" Wand.exe - Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 3008 Update.exe 3008 Update.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5948 Wand-Setup.exe Token: SeDebugPrivilege 3008 Update.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeDebugPrivilege 2756 Update.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe Token: SeCreatePagefilePrivilege 528 Wand.exe Token: SeShutdownPrivilege 528 Wand.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe 5484 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5948 Wand-Setup.exe 5948 Wand-Setup.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 5948 wrote to memory of 1420 5948 Wand-Setup.exe 92 PID 1420 wrote to memory of 3008 1420 Wand-Setup-639284007855811015.exe 93 PID 3008 wrote to memory of 916 3008 Update.exe 94 PID 3008 wrote to memory of 1052 3008 Update.exe 95 PID 5948 wrote to memory of 4780 5948 Wand-Setup.exe 103 PID 4780 wrote to memory of 528 4780 Update.exe 104 PID 528 wrote to memory of 5128 528 Wand.exe 105 PID 528 wrote to memory of 5128 528 Wand.exe 105 PID 528 wrote to memory of 4036 528 Wand.exe 106 PID 528 wrote to memory of 4136 528 Wand.exe 107 PID 528 wrote to memory of 2756 528 Wand.exe 108 PID 4136 wrote to memory of 4312 4136 Wand.exe 109 PID 528 wrote to memory of 1436 528 Wand.exe 111 PID 528 wrote to memory of 1436 528 Wand.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wand-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Wand-Setup.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\Wand-Setup-639284007855811015.exe"C:\Users\Admin\AppData\Local\Temp\Wand-Setup-639284007855811015.exe" --silent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silent3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Squirrel.exe"C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe4⤵
- Executes dropped EXE
PID:916
-
-
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe"C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe" --squirrel-install 12.66.04⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1052
-
-
-
-
C:\Users\Admin\AppData\Local\Wand\Update.exe"C:\Users\Admin\AppData\Local\Wand\Update.exe" --processStart "Wand.exe" --process-start-args "wand://?_inst=F0oabGTCgUqWuUu5"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe"C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe" wand://?_inst=F0oabGTCgUqWuUu53⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe"C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,5290801949957997498,10494682987863864913,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,12313876686974873283,15223292769556556770,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1728 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5128
-
-
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe"C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --field-trial-handle=1732,i,5290801949957997498,10494682987863864913,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,12313876686974873283,15223292769556556770,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2256 /prefetch:34⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4036
-
-
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe"C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1732,i,5290801949957997498,10494682987863864913,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,12313876686974873283,15223292769556556770,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2592 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exeC:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe Wand\Support_ab1dcc5c-3897-432c-af57-a6b79f17289b_Out5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4312
-
-
-
C:\Users\Admin\AppData\Local\Wand\Update.exeC:\Users\Admin\AppData\Local\Wand\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.190444⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe"C:\Users\Admin\AppData\Local\Wand\app-12.66.0\Wand.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wand" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1732,i,5290801949957997498,10494682987863864913,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DefaultSiteInstanceGroups,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,12313876686974873283,15223292769556556770,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3428 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1436
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log
- Size 2KB
- SHA256 1666db5c00ea707708afd191fbfb662013d0034c1e70ecc90ab0bf2179ad048b
- MD5 b8ab204d880a5fcdb4304f556025bae7
- SHA1 32498fb5712872949e2599aa30a4fa543bcc9db9
- SHA512 67b4cbcc7fdbe5f7b89fdb38a003138a162945166662dcb0a19afed917e119f72f662d8ca20169fc9a20d6476ef8f113d9608b4f578e72c582df56016245ed8d
- TLSH T19C41BD7122B1A0D88D177F57197C258523FF4728FA905E18B668625EEA2E0076F232F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
- Size 77B
- SHA256 f9afe52ca7262d7892bb9dcf3b3d97d47567a5153c98261910f62d7bf0f3447d
- MD5 f674521ac1ba43d3532e2df1080c86eb
- SHA1 04960a58caf680e68715425d5ea7b7701bf1f258
- SHA512 243127cfc51a0ad068eeb0e05814de003f52f6de4013927d5cbe1a89be1a201f1f4edbf79dd9631ed21452a87fe1c1cc9132317187488014947ffa712893d4dc
- TLSH T161A024F17470707C0CF1CC00101DC45F5400FD43C3755441315570550C51350301DC00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
- Size 1.8MB
- SHA256 513daf0d32408dbac23f75f88e53db687ad7cf0035247cab09b2ade7f44afdeb
- MD5 a519d645373fd941a1e60206f9b0155c
- SHA1 740056db08cb4abd5336c775f658979c16257dfa
- SHA512 8eb559197dba36cc3d68bccdaf616eb8bb5e076f2c091fcc6bcb8f727ae9dae516060fc52e9f5ed0fdda40f0e37d6e814c18a495e8972a25ddb519a031e8fc99
- SSDEEP 24576:cwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYsD:rRZe6acFI54CGT0bG6mB+a/ey5m+qv
- TLSH T197956B12E7E88F3FE56E27B6F471105907F3E5866362F78B6A0C61B92A833148D11367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\Wand.exe
- Size 670KB
- SHA256 9dca8afca2842746477ad34d51f543bf057ce3fa245ac2a3503673f5e745f129
- MD5 33e9accc9fea2664f7364d54862b2c58
- SHA1 1c63322daee4d5187d575cf3217d9135b0107cf0
- SHA512 4b2813f11c9722ee79487978b7d3074aeb352e78d0152cda923cb7f785bd758714e6b2c10de58a471be11f5388c87a5a40ad8fc4aec4515ca15d5ed68ac8095d
- SSDEEP 6144:cZzvhs2Z4n1E7g34XtVYAOfTd/5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rj1XU:cJ+2Z4nShVY5N5KgHUizA1CGZXU
- TLSH T1C7E48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\WeMod.exe
- Size 54KB
- SHA256 0781fb2fc7fd4f1d3dfbaf2432a8e670f6fc5e779269253e0492ca741e6e8fe4
- MD5 e7512eeb50d704d17a242b22482ca8a4
- SHA1 8aef2dddf978653a7c3968a13a9c62b3072954d5
- SHA512 bdc7601f626efe61f2d00a50254f3e928e08e53a781725cc5389d2a43342c26fc23474379128bcb476a64dd524148c1e066eeac5404e2dd7f675cc66f1cea5fc
- SSDEEP 768:8bbZUR9ewbyFBpbqCyAE8QUcWDXp+PnpETPRkmHRY7xLO6WsGXSu7aYiDLrE5y:5y9zyuQyhv7a7P
- TLSH T130437BE4DAE914EEC6778CB19DB20CB06673EC8248D6EC833588C4399793359597329F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\chrome_100_percent.pak
- Size 113KB
- SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
- MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
- SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
- SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
- SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
- TLSH T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\chrome_200_percent.pak
- Size 183KB
- SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
- MD5 e0d4001307e8e8554810b27796ad636f
- SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
- SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
- SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\dxcompiler.dll
- Size 24.5MB
- SHA256 2204d51e500eeb9596f0d51a4e04e50ad6c48e07fbbb69b0df0282cfe287f68d
- MD5 e28c058d52c00379f516208d0d9b16d9
- SHA1 017a9365375e14b316a61bb4b838703162fd8ff7
- SHA512 a9cd5ad2b56f3354a0cb76c16114c1f658aaa6a7a06db344cc09082512660fcc51579cd7dc1c442e637f38732c96ab54a934a4fd4673fa97a1eaab329541e551
- SSDEEP 393216:F9tCn2P9zxhOMXtVz5icpXH5uVUi+zHu:UGzPdrIVCO
- TLSH T128473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\ffmpeg.dll
- Size 3.0MB
- SHA256 e5951c82e712d537ddb7b8c49c420009081c4e571df4fbcbdd4d6a91bd5c4eff
- MD5 ca58daea8219047d517cd183e0fe5a5d
- SHA1 147d36bd0a84fbb265764527c3e3489b42c279cb
- SHA512 6f8af4fc4e31ebde5ce9c4dd3460abdd2f1d16451890a046552103dced4ac37a55122b5afa6d37486e39aa712d65aee5f36ed491a841e7db92a00be985a21c8d
- SSDEEP 49152:ylyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bWd:ylyJGsQsU+is9dNoJAe
- TLSH T158E5AE02F6D651ECD019C034979B9313F631344A4F209AEB16909A263F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\icudtl.dat
- Size 10.3MB
- SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
- MD5 5bfd3eefca4b5ef2d1a869396390a7de
- SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
- SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
- SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
- TLSH T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\libEGL.dll
- Size 520KB
- SHA256 21ca5a63464c20bdaf301191e28d8fa20e7c68edfa33e8e4a4a88237e8046189
- MD5 d193eb267e555cd2f14f7db1b0ceec4f
- SHA1 4f7fa6c50dbf8d877faddcf70526f7c92d3384a1
- SHA512 034afde4525cf32057940b99f7e15be47380bb4481e93f612637dede8ed8942762e1a22881aa665a89a93520312af2684d2c6c6ac7e60bec109c142d439d9b08
- SSDEEP 6144:seQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4WfaguL1iMg:KG/V/iZJOmW6GVGWFcsfAOugP4W410
- TLSH T139B47D15F3E84BA9D07AD1348A438642EB7174921F65F9EF02E052352F3BBE45B7A324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\libGLESv2.dll
- Size 7.6MB
- SHA256 f28b06af81c180188f2f9b391c28cf3493a1dd4fb351122b0ab74c71aa7e956c
- MD5 25d088c9be3ef38604d6c0529e2f768c
- SHA1 a7595ca7ddcb39fc32b11c15f51340af7e0b0828
- SHA512 a337c7ab22d0c2389c4840cf3c455dd24cf38ecb79cc24ced760c30c8b7a94ba7dfdc94d88aeb545dc393c48afae884affcaab585a75ef082e7928c774ac7f11
- SSDEEP 49152:sjZmaisHsL/nWt+Xa2KQOQe1gt4eUXNG8nL1cwgxLqBQ3ypxnYAZkicN1UZ+uNmC:dgHqnNj6ZAIxnRZkbYdp+h8iADBXw6h
- TLSH T1AE868D03F69541D9C05DE2B49B67A223FA30B8550724B7CF2A9447162F6AFE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\locales\en-US.pak
- Size 549KB
- SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
- MD5 0555742b1e5f91449a199b9c42c1eb3e
- SHA1 2f7ecfa75faca014c06e435fc6d449072d47ac41
- SHA512 6d5f20741c97933d7c2d7011b696632e056db182941483e6c5675ecaf2b18132abbc0397b2c703e79a878838db806766aab69b2c90f6fd1dce377623d5501af6
- SSDEEP 6144:LOvSsWLA2zb+H4HfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Bwf:MAxJHfdZM6Qqbg0jBwf
- TLSH T1C7C44D1FF744112A05A352A2BF0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources.pak
- Size 6.5MB
- SHA256 096373b7b5a9535b5ba60a37883d1d2010d28dafd90d4c819a902db09aef4ad1
- MD5 204420168fdecf480d2eb1ca479c3877
- SHA1 2b853205f5e2b8ea76f0beec2256f62bf6318347
- SHA512 9e7992f0889de939b38642fb0991e9dfa8b7e8a74a5804a936b2e4146be29548c8a29ef16ca8cf14d256dcf3989e10e57780d8c531c422f2e1b594f9ade9106c
- SSDEEP 196608:+mntWBRtfTL5QoCmkrB0QMguFBgt3m06Rw+K6:+mnkTtC9mkr4jFWBm0iw+/
- TLSH T1F76633D7B1346C1BC6C443BF8918463AA85C6B707D86D2D2189C722CDCAE64A6FC467F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WandAuxiliaryService.exe
- Size 1.1MB
- SHA256 71313d0d555419e22e3a158339ec16f313517063e9b6a76cbb246b2fdbdc8b45
- MD5 3571f3d1c8b04f8c71c95e957dd3d720
- SHA1 0ea5f75486913601b9844b8d7336caa5b6e2cc15
- SHA512 3006caebcd2d7961ce17c4b6fc70975ad73a3eb2b8bd6fe368e1943db52e22b6b07460eaf47b1b4038cdd2a5d59eaa08fb41d146c606dc0af474634c6547b701
- SSDEEP 12288:oJawxkk5tNmT6cGJDBlfCBue/xXRGL2F5KgHyizD1CkPy:lwx/tNzcUlQxXRGLAUQWoy
- TLSH T1414529C49AE896DEE1BF67719CB00E344BB3FC16AAD1EF491944A5F81853305983227F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar.unpacked\static\unpacked\capture\capture_addon.node
- Size 353KB
- SHA256 658af1d360cb634774f123e02c9b7d846687b6a244d576ddc5b97b0258915d8b
- MD5 2a99759fbd9718e74f4b4de3bf1b3485
- SHA1 8e7f00dd3a086dcc30f2cbf2cd76d29f35a49325
- SHA512 e7c154211c60cc86783b342407d76f59918b1a20f2f56aa0e903cdc361498c3ff10250e2ce254a82d84942b2e45707a8b57f8167fbc7a38a7d614d464967c9f2
- SSDEEP 6144:zBwUknKeSUreO0nj4BPxQUx+zKt26wEGnwAp/j+1:zBwUKKeSFOgjkPxYz02XwA81
- TLSH T140747B1AB7A404B8E477D23C89674A05E7B27C4A0760E7CF23A4435A6F33BE1993E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar.unpacked\static\unpacked\icon.ico
- Size 409KB
- SHA256 1a90e62ec52c31681af31d9cb4790c8a3af4b72bd8de3a0e937802965a23a38b
- MD5 06aa52a7fa25dfc51e7c846172d985f2
- SHA1 10adb45e32e5a4831154e5e17425ba3f911bc325
- SHA512 b7f3c9c000a8a4af76cf619908177bd29a98a69825e2f711705cdb810bb8c8f4c29ec8c409855ca1d1354dc52c72f4c72100dea24727980d4b8ecd1e4a4ed3a8
- SSDEEP 6144:t5Ker1PJVHjMYimBSfN/yw+Aw1ECD45rO:t5KgHaizA1CG
- TLSH T14E947DD5FEE521ECC0BB9C7A4C325D3169738C4698C1EE92588779BC419316A2D332AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar.unpacked\static\unpacked\overlay\overlay_addon.node
- Size 583KB
- SHA256 78bee4420ea14b50f042ef7e0531d8227750a2df2d80452407216ddac0dbbe6a
- MD5 a047dfa60c2ae45d410bf6cb20250ba9
- SHA1 d192a0e011d607b16029d3df55593ec16ff0fc93
- SHA512 7caa5fb7d4beeb6710295c9eaccee393869159780fec48c70023613ade70e8b0850002e1ec6f83590a0be5f5bf4e7607a7edede37f52b88670f420b88926ec2c
- SSDEEP 6144:49iwdG90oADyryXo/YNG6uzfk5kWLKe/Kdc5/Yp7uyQaqx8PjAElrczX/Gb:455oADIsqbWBK6raAEls
- TLSH T124D47F2AF3A803B9E167D178C9534916EBB278561370A6CF03A1569B2F277F0573E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\resources\app.asar.unpacked\static\unpacked\preload\analytics-frame.js
- Size 1KB
- SHA256 c94031bd1997e73e46a37f101818183497f26a1d71d5316fb70088119220ea17
- MD5 cad574a5e3b3f93ad3e7f4eaf594e4cc
- SHA1 c2e25dd3848a4a1068e24439efe916aaca5e66e1
- SHA512 1b632e1621857392dffc4fc23d99d61ca435dcdc7d80d684e321623054dd50f353f9333a1dc8d2ca7dbebe5f00020ab44b6deee2ab265a450c8d65806b1bbfeb
- TLSH T1C931CFE0AC821D9C33A70174B796371634273ED3CA0E91446B284DB76996ED00559FFE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\squirrel.exe
- Size 1.9MB
- SHA256 4be6a55fe2067c910c8349b9371e644d3887cca49b90dc9f3dd2e750ea574ac1
- MD5 b08a2eb33b49fe3ab7cce384c09a4e13
- SHA1 2bad97aa426ef0535aaf6b3132d0797d48e1f206
- SHA512 36d503233210132fc0894e4839ae088663a2c79d1093c44feecf83373b27041c23b3b052042d7e1e8e1d84d80af911aa7d01ce56d30d2555652f340917a68cc8
- SSDEEP 24576:FwRrQEJglh6acFI54CGT0bG6NEB+a/ayU0YJ0mXrNR5C3tQo51A7ehqv2Xe2vYs2:mRZe6acFI54CGT0bG6mB+a/ey5m+qv
- TLSH T13A956B12E7E88F6FE56E27B6F431105907F3E5866362F78B6A0C61B92A833148D11367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\v8_context_snapshot.bin
- Size 698KB
- SHA256 ed5e979db2aef4a152758f2b9b7b06349a1d3d5dd687fdb96e2b3fb730a465e0
- MD5 a119c66308517b41d07e0c070939d5d0
- SHA1 e5ffb8afeb8914c4981d93f3727183aa451c6a88
- SHA512 fb27910e77f0ec790c4c193c726d93be01ec080d9f4175194094c36b5107c71f53e9d2f9c6e65f0b2395353e34bb1a759c0f36b55f227221a97757d0e44c0bbe
- SSDEEP 6144:G/V4XptgO5XKt+Hlzk/ov7Cx2NyuClVlxykismIdukcLKYNcPK:G8D5XoAvmx2NySkQIId/H
- TLSH T1C8E4A761FB0A8F3AC5453BBD8DE657463A30B18E9E87E24B7405633D78B96B04C3652C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app-12.66.0\vk_swiftshader.dll
- Size 5.4MB
- SHA256 9622a960b194db1bb8ca09c6dcbb8df7e8039e9bd2aaee8cd96d25515ca1fd71
- MD5 ed04bbe170d28a05ce6795ef8cb8058b
- SHA1 5a9d5d2f02974dc4ba58637e79e126c3b172ccc1
- SHA512 2e0f3bcb7c9c1e0ca5e7ac6ca238c24b60ab4789f91cd06df50a7c28f85b5600d9c1f6fe6a4b848058d4fc1f17c7a27bc0964900e50073969c9ad80fb078a3d5
- SSDEEP 49152:O+et2UcrN42sf0vTrWny2/Gh9qIHGZpVZSbiP1VFz2ZtIgrduZsgP/m9vqjfc2cM:OJt2vI4gmlml3pCIn
- TLSH T19C463803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Wand\app.ico
- Size 38KB
- SHA256 6c9c2af113518416fe5ce94f6e415bd65b18ac1d9fe5f77660a94456c5a7d420
- MD5 1d5992317607e5d531cb677a3c873059
- SHA1 534210ebbc824f19949683bcd32281ec90b0129f
- SHA512 6711816fb473255ea6ad78353f3795fa7808fb99a8d91241dc9fcd33eef125bca4bc05dcfbc1211141109ff8ac5f26152c89475f0df29fe81fe5d5e2a25e07a8
- SSDEEP 768:2bZUR9ewbyFBpbqCyAE8QUcWDXpKPnpETPRkmHRY7xLO6WsGeQu:Dy9zyuQycl
- TLSH T192036CE8EAEA15EEC1B7CCB28E320CF07173AC4285DAEC5365899439D293619547364F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Wand\App\init.json
- Size 52B
- SHA256 c1cd333441398ebf4b5f4d7a55d602c034b3f45e6e1ba6ad12f7773377e306b8
- MD5 bb348a829d1554a6b08eed37d583c7ae
- SHA1 fe5d84358535bab4ca30a51442d2903f07d400e9
- SHA512 7e071741ea36443188b87b3750bcd0f586b4270bda68a014b9a54bb49033ca762c51f0ebeb17e52898bbc4a5331e309990658bc9510bf2434502333e5d2d7f41
- TLSH T1BE9002940A4B3173DB1202C600C3603185151110895C0A240956055448567158197263
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Wand\Cache\Cache_Data\f_000002
- Size 809KB
- SHA256 1b488327428ab7a76bcc9152831a04075bf0a0d30e7d8c57a066204571f86305
- MD5 0613e554e773dbedacca6120cfb04899
- SHA1 6c0de6e0e5c9df6b85bba0353dd75b38f6179e0c
- SHA512 7447e2f5b4baffc7935c4b66aeed9d3b09e082d63bd3a1b923ba6d04a5154ff7338988d6e9d066a5383bcf0ff6df141db5953b0a912fd9d0fa4d88e90e139476
- SSDEEP 24576:Wh5jol3VPwg9yeBff3Qu9cSFwAWIVKI3mpX:itovPz9y+f3Qu9rFwYlc
- TLSH T1850523CFC7A5F026CD84D579E9F3FD4F2FE1349052992A054AA14A89C65172FE2C2076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Wand\Code Cache\js\index-dir\temp-index
- Size 48B
- SHA256 66bcb8d5111520bfd7da9de911da831478abdc82849594b261e128476db0e48b
- MD5 6ecc97cbfe3652f27446302b94fedb46
- SHA1 fb7c04151b76015e90cf8ee30358bc5e250ed8db
- SHA512 eaab1b46e24177446c2505ec5e1cffb20792be7dff23c2274bee565dcfe1dda805e6611eca4b89aa9d6f4b4074969abf7f15dce5b191387f29ccc583765f0e8c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Wand\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Wand\Local Storage\leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Wand\Network\3fa1a8b3-4341-4d2f-95c6-8bd2a81c81f8.tmp
- Size 924B
- SHA256 2ef9af82aeb85153dc679966d1b5abd386fbc5159a0fd13346d4ead8a900463d
- MD5 be9b653c891f22206d494b9cf805052c
- SHA1 3ae5808f7398ff3efa5c88746905d6abeaf3c5f6
- SHA512 6de0674c9ab998661bc3c97b75c39f985cca0e0a9bc9fc6d8bea154631bf511ca0fa1d235c2c1fbe1b7f13b453273ed9b4137313c526f95fab88fa3cbec092d6
- TLSH T128117AD3CBE4063E891223F41E247E23C2BF081C131CBD428DD4DB4E07A5472064124E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\609a61ef-03fd-4bd8-a17e-9875ada7adff.tmp
- Size 93B
- SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
- MD5 322f01bb491180333c338526d93f115a
- SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
- SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
- TLSH T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Cache\No_Vary_Search\snapshot-new.baf
- Size 20B
- SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
- MD5 7177cd1b3e21f48a23cb47dc11b36f7b
- SHA1 9e1086a6c2296b41c004834f7521790bb2941d67
- SHA512 e7e8b2204e455f6e7fa5a2239cbb4c0c506562d30184fb07d63f8544cd0249226bd3d7d399ef0b69774e72afe100f9858da527b0e15a7bd3c35782d7513eff23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Code Cache\js\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Local Storage\leveldb\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\2e976790-951e-403e-8757-3dffb68dfebd.tmp
- Size 3KB
- SHA256 f01c7cb87e22d5024546228ba355579a2b2cd71f68833e1de7b87818e0807abf
- MD5 58e43b2312f3daf4455a04ebe85b5f00
- SHA1 8532fc3420c7289f69c4023184cf0209f4e844cf
- SHA512 cfe5c94cedc373be5d7a069857702d915e3d97ba804fddfcfd4c40caad98a3f7c5b3e97d2b783e302472895b4e2ad4bca1fcd7b9c4bf58f072312e0fb5f25afa
- TLSH T15C71AEDBCBE8063E845267F51B25BE23C5BE091C83283D4789D8DF8E93E1472929154E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\temp-index
- Size 72B
- SHA256 46484d516c2b993768ef6ad86ab28a4ab0961e4936f2f87e0f705f0c529b012a
- MD5 202671f947ed0350d3040aefb3d8fa9f
- SHA1 4d29a04f22125e235da82c24ee48b4c28b34030d
- SHA512 01fbfd841912b891b012719d98447d5746b9a1605dc631e4d6e3cb444a6e071c58deadfea23a7e31c77bd563f24e214bdcfb288fd29453e61d515fd4cd8b1b40
- TLSH T1D1A0022141784292D41402B5219E41CC2314EF2A5115120142F00B95DDE126B41D3940
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Wand\Partitions\ads\Service Worker\ScriptCache\index-dir\the-real-index
- Size 48B
- SHA256 b719748d881947e8d0cfa13c5a5eaff72a59d5cdc55df4deeb15a6b3d7b97bb8
- MD5 732d76a69cf3cab18b127f45fc540e3d
- SHA1 f26d2065d462b4fa650c08fdffceb6b228028405
- SHA512 f3ac50af2e5b79d108e894a0101cb1c243fe0008600d705454cd235d4bb8d94d3aed040178c6a35148319f8b201b8369fe8ed9fad39fbac3bd0d659fe730c6c2
- MD5 SHA1 SHA512