hxxps://cider[.]en[.]uptodown[.]com/windows

Analysis

user interaction
yes
max time kernel
175s
max time network
175s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cider.en.uptodown.com/windows
Sample260505-a8a98set7z

Score

8^/10

defense_evasion discovery installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
241	3844	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
5828	cider-3-1-0.exe
5860	cider-3-1-0.tmp
4908	Cider.exe
6020	Cider.exe
5272	Cider.exe

Loads dropped DLL 12 IoCs

pid	Process
4908	Cider.exe
4908	Cider.exe
4908	Cider.exe
4908	Cider.exe
6020	Cider.exe
6020	Cider.exe
6020	Cider.exe
6020	Cider.exe
5272	Cider.exe
5272	Cider.exe
5272	Cider.exe
5272	Cider.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_333577160\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_881191148\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_138209628\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_138209628\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_138209628\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1426396357\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_881191148\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_881191148\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1139454098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_138209628\extraction.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1274046916\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1139454098\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1139454098\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1426396357\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_333577160\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1139454098\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_138209628\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_138209628\classification.js	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\cider-3-1-0.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cider-3-1-0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cider-3-1-0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5828-1953-0x0000000000400000-0x00000000004CA000-memory.dmp	innosetup
behavioral1/memory/5828-1993-0x0000000000400000-0x00000000004CA000-memory.dmp	innosetup
behavioral1/memory/5828-2517-0x0000000000400000-0x00000000004CA000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224159637895025"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itmss\shell\open	cider-3-1-0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics\URL Protocol	cider-3-1-0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe\" \"%1\""	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\music\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe,0"	cider-3-1-0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe,0"	cider-3-1-0.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itmss\ = "URL:iTunes Music Store Protocol (Secure)"	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics	cider-3-1-0.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\cider\shell	cider-3-1-0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics\ = "URL:Music Protocol (Secure)"	cider-3-1-0.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\cider\URL Protocol	cider-3-1-0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\cider\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe,0"	cider-3-1-0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itunes\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe\" \"%1\""	cider-3-1-0.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000009b75db1caf91dc01f3a178f4b791dc019700b59629dcdc0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itms\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe\" \"%1\""	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itms\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe,0"	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itmss	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\music	cider-3-1-0.tmp
Key created	\Registry\User\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\NotificationData	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\cider\DefaultIcon	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itms\DefaultIcon	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics\shell\open\command	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\music\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Cider\\Cider.exe\" \"%1\""	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\cider\shell\open	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\music\shell\open	cider-3-1-0.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itms	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itms\shell\open\command	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics\shell\open	cider-3-1-0.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\musics\shell	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itms\URL Protocol	cider-3-1-0.tmp
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\itunes\shell	cider-3-1-0.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\cider-3-1-0.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5860	cider-3-1-0.tmp
5860	cider-3-1-0.tmp
4908	Cider.exe
5184	msedge.exe
5184	msedge.exe
6020	Cider.exe
5272	Cider.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	Cider.exe
Token: SeDebugPrivilege	6020	Cider.exe
Token: SeDebugPrivilege	5272	Cider.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
5860	cider-3-1-0.tmp
4908	Cider.exe
4908	Cider.exe
4908	Cider.exe
4908	Cider.exe
6020	Cider.exe
6020	Cider.exe
6020	Cider.exe
6020	Cider.exe
5272	Cider.exe
5272	Cider.exe
5272	Cider.exe
5272	Cider.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
4908	Cider.exe
4908	Cider.exe
4908	Cider.exe
4908	Cider.exe
6020	Cider.exe
6020	Cider.exe
6020	Cider.exe
6020	Cider.exe
5272	Cider.exe
5272	Cider.exe
5272	Cider.exe
5272	Cider.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2932	928	msedge.exe	79
PID 928 wrote to memory of 3844	928	msedge.exe	80
PID 928 wrote to memory of 3928	928	msedge.exe	81
PID 928 wrote to memory of 3928	928	msedge.exe	81
PID 928 wrote to memory of 3928	928	msedge.exe	81
PID 928 wrote to memory of 5112	928	msedge.exe	82
PID 928 wrote to memory of 5112	928	msedge.exe	82
PID 928 wrote to memory of 1112	928	msedge.exe	85
PID 928 wrote to memory of 1112	928	msedge.exe	85
PID 928 wrote to memory of 1112	928	msedge.exe	85
PID 928 wrote to memory of 3080	928	msedge.exe	86
PID 928 wrote to memory of 3080	928	msedge.exe	86
PID 928 wrote to memory of 3080	928	msedge.exe	86
PID 928 wrote to memory of 1008	928	msedge.exe	87
PID 928 wrote to memory of 2988	928	msedge.exe	88
PID 928 wrote to memory of 1008	928	msedge.exe	87
PID 928 wrote to memory of 1008	928	msedge.exe	87
PID 928 wrote to memory of 3192	928	msedge.exe	89
PID 928 wrote to memory of 4120	928	msedge.exe	90
PID 928 wrote to memory of 2988	928	msedge.exe	88
PID 928 wrote to memory of 2988	928	msedge.exe	88
PID 928 wrote to memory of 3192	928	msedge.exe	89
PID 928 wrote to memory of 3192	928	msedge.exe	89
PID 928 wrote to memory of 4120	928	msedge.exe	90
PID 928 wrote to memory of 4120	928	msedge.exe	90
PID 928 wrote to memory of 788	928	msedge.exe	91
PID 928 wrote to memory of 788	928	msedge.exe	91
PID 928 wrote to memory of 3424	928	msedge.exe	92
PID 928 wrote to memory of 3424	928	msedge.exe	92
PID 928 wrote to memory of 3424	928	msedge.exe	92
PID 928 wrote to memory of 2028	928	msedge.exe	93
PID 928 wrote to memory of 2028	928	msedge.exe	93
PID 928 wrote to memory of 1776	928	msedge.exe	94
PID 928 wrote to memory of 1776	928	msedge.exe	94
PID 928 wrote to memory of 1776	928	msedge.exe	94
PID 928 wrote to memory of 992	928	msedge.exe	95
PID 928 wrote to memory of 992	928	msedge.exe	95
PID 928 wrote to memory of 992	928	msedge.exe	95
PID 928 wrote to memory of 3472	928	msedge.exe	97
PID 928 wrote to memory of 3472	928	msedge.exe	97
PID 928 wrote to memory of 4524	928	msedge.exe	98
PID 928 wrote to memory of 4524	928	msedge.exe	98
PID 928 wrote to memory of 2332	928	msedge.exe	99
PID 928 wrote to memory of 1284	928	msedge.exe	101
PID 2332 wrote to memory of 1516	2332	msedge.exe	102
PID 928 wrote to memory of 2204	928	msedge.exe	103
PID 928 wrote to memory of 2204	928	msedge.exe	103
PID 928 wrote to memory of 2156	928	msedge.exe	104
PID 928 wrote to memory of 2156	928	msedge.exe	104
PID 928 wrote to memory of 4316	928	msedge.exe	105
PID 928 wrote to memory of 3120	928	msedge.exe	106
PID 928 wrote to memory of 4316	928	msedge.exe	105
PID 928 wrote to memory of 3120	928	msedge.exe	106
PID 928 wrote to memory of 800	928	msedge.exe	107
PID 928 wrote to memory of 800	928	msedge.exe	107
PID 928 wrote to memory of 4184	928	msedge.exe	108
PID 928 wrote to memory of 4184	928	msedge.exe	108
PID 928 wrote to memory of 4184	928	msedge.exe	108
PID 928 wrote to memory of 3564	928	msedge.exe	109
PID 928 wrote to memory of 3564	928	msedge.exe	109
PID 928 wrote to memory of 3564	928	msedge.exe	109
PID 928 wrote to memory of 1832	928	msedge.exe	110
PID 928 wrote to memory of 1832	928	msedge.exe	110
PID 928 wrote to memory of 1832	928	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cider.en.uptodown.com/windows
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a4,0x7ffc2735c188,0x7ffc2735c194,0x7ffc2735c1a0
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,587789625733775915,8747005061429385929,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11528214646181380152,2082483824008310128,262144 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,7928388074326316195,11340287147541484440,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,9752799762950460870,12567716963844760658,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,12756221551580306826,12062825005052653595,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,9269353404848548136,15129830741000569046,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,16625562711985535770,2891392737738656179,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4244,i,16570003550535522469,16208737491547629828,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,875290578595905866,15788520509851746980,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:9
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,10044980824992637130,7019158743480398738,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5500,i,15226911159744457665,17027646783738288737,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,1696202248922349404,4178758584241783601,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5456,i,11837454556905356856,16469461337467717435,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5260,i,15699840357388499484,4136982205411810551,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,3774068784577053185,5599900905849661513,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9970441148265347276,13120426400819672104,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,16266840622657117186,7777099571833143993,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,4349650396688186400,13108934042729333354,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,4349650396688186400,13108934042729333354,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,3854443722329933947,2059010323773980299,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,59754993528875992,12126145236113899561,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,580746796012859716,17941325500946629264,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,621294875064312325,18249338185431001779,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,4371693266395646085,1281654290357185147,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7108,i,5133599713190415966,8577000607294596436,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6924,i,5259026211087118452,2799837395275719282,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5732,i,10807178653531263241,9290538275579037988,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7084,i,17506397169172387433,12527763635805106216,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,11576857768377510065,10434975975758465494,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5084,i,16646727101737669229,5032573659383334373,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6916,i,2445386261986749156,16396607793304646039,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,6602076886499441517,4765877250485015852,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,5446961773228070559,14292830097213915071,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7716,i,17416304107076127442,3520643949211456789,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3969123974648773762,9819258664709732471,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11103497463253699869,5326909025892518697,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=3832,i,9153647105884706995,11198035664288198824,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7560,i,1894467772151143160,12590440639212037536,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=760,i,17994807196577371090,6443328961160925275,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8088,i,3377938652823712893,11984008085694979896,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8196,i,15223610641010467209,13802887371276857379,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8104,i,18168881206721381553,1003715773553700006,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,13988968154272762633,11450469535052850317,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8620,i,9769957527837970535,6294664887231048048,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8680,i,7090237732420338360,12096628719229091112,2097152 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:1
  2⤵
  PID:5520
- C:\Users\Admin\Downloads\cider-3-1-0.exe
  "C:\Users\Admin\Downloads\cider-3-1-0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5828
- - C:\Users\Admin\AppData\Local\Temp\is-96NFL.tmp\cider-3-1-0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-96NFL.tmp\cider-3-1-0.tmp" /SL5="$40284,174871216,771584,C:\Users\Admin\Downloads\cider-3-1-0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:5860
  - - C:\Users\Admin\AppData\Local\Programs\Cider\Cider.exe
      "C:\Users\Admin\AppData\Local\Programs\Cider\Cider.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8624,i,6887490757863228064,13560198489132433075,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9808,i,8143075129404845483,16627284066952162672,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=9784 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8336,i,6161230473838876097,17074538583103672723,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6564,i,14270244613981601208,15219577300208682247,262144 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,6483250298331160472,16371469272635715553,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,9658353178196629231,17558712274742370168,524288 --field-trial-handle=2232,i,3663576623797468634,5285932251864419065,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:14
  2⤵
  PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4944

C:\Users\Admin\AppData\Local\Programs\Cider\Cider.exe
"C:\Users\Admin\AppData\Local\Programs\Cider\Cider.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6020

C:\Users\Admin\AppData\Local\Programs\Cider\Cider.exe
"C:\Users\Admin\AppData\Local\Programs\Cider\Cider.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 346ea60a0ae4d17c01949616e7832cf3b359983afcbb7e8912fe8a59321ed461
MD5 203e8ac15dc2fa01607dca121531cbf9
SHA1 6bb9e33e0eaaee142dcc669c175ec6b9508af90e
SHA512 9cbb9572308545c1a11487db03ac7301a81dad98c83fd39ad60fc0ba640dee016818808cbd7f5e840f2b2084982cd60ac725f84529aac2387baa86bafeb505f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 97KB
SHA256 35bfbf7fdb2727bde50455445e042e9380a3af7bc9ef3f838aeda32d75a0f3e8
MD5 ab3df64f6f8d66837d4eefcb2cc9c20c
SHA1 b44dfc49aae3118b118ee9542ff536eb4be63bd6
SHA512 c2ec2c021b290e62db1753377140a0bea3c0ff36de5c24fba6f6cf4e3d7701f0f949a22df577b29e59fe717e37ac396bd06f7aad01a767de2d278ff13ccc9633
SSDEEP 1536:Qq+c4gBpQZZoN8MURVaGvBW3n3tVG82PXzrDr/bBqszFqcqFhO:Zt4kpQfjbRV8IPzr1qszFvqnO
TLSH
T18CA312DAF82B534C5C901E17F71ED695DCADC62F3A7400306572E88A9B2BE3A6448367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 22KB
SHA256 ea4f2642989ee2494483c8cfdce978e7944216d091a3e5c7c17ca67d252bf3e7
MD5 f2af52a34f5731797063ae206250b07e
SHA1 91d89159bbb1015f1246580a7e15c4c22d4dc981
SHA512 b9938df883ef4327985e23738bd995cb2844484f5f2683cabd86399583dbd21bdad6819f7ac379960b801b78e73762eee87a9f955cc22ece873f4c64d5f06115
SSDEEP 384:P4nyII/P7H/N5QFz8Rc0WhnXztAlLfdoHOTIRVcZO2JnTBklAcBuXqk:QnyR/P715QFzUNWhnXzelLfdoHkwVJ2/
TLSH
T1E8A2D032C3A3F8E276E567E4AFD3EB8013ECAD558A0038981B1411CF0D55EE91659DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 20KB
SHA256 0853a7d80c2dcbf17e3cafe04332391ef4067e65d0f6712009399febc059cf03
MD5 001421d61a22df634206a8a7b486ce16
SHA1 9bd41e85857219050eca0498fc3404d06ae7ce48
SHA512 59a002a6e634a50e121a2b3cb1742274263641c6aa0d82320a1dbe5365d02f8116dc1a97009050e42b99e01bb32225e128983b762e432567bb2b1667fe826a95
SSDEEP 384:LWOPjtxgNeTZ9qpiK6jC/5Slrabx69Vk/siggPSyWC/l2nIcuEgwL7PvV:KKmNeTZeiKhQH9Vk/sigTctXAz9
TLSH
T18B92E114AC4FC52F56964A28EBD9002A44953DBADB17043722EF6E4F637395093AA83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 84KB
SHA256 ef1a84f90faba9e8fe20621808c5ac243fc27dfe78aa2eed356ec5d3fc261d59
MD5 0569384cef60ab486d3c6f998436e72d
SHA1 659428a7d179c375403afc80d09a7fd4a2fe0252
SHA512 504f379be0b65e588a31e71e8f54f15e4c81b0d96b8f0e86473b69d98e5973d99f80a1a29ba6aa24527716ac846baceb7113d86cbd86dd67807b370b0894da7e
SSDEEP 1536:9hGd8IPPoBUFpRRX3NzJ6blma2rmsM5+GpZSywks71Qf13tOFsWy:9ho8kPoBURXdGlmeJcGiRk01QyFa
TLSH
T1FE83024ADB3E3198C70C4B61D5FA5AE1861EBB8354DC0868D845AE7F11BC8CE11693DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 169KB
SHA256 2cbc5df8125a1ea57e514165de7c23577fb011931b8a58d00ec67daf96944910
MD5 f36182231a47acaa913c0d9e9ee3b6b0
SHA1 163c337ba5de268492fb44ffdc833a65a01cb6c4
SHA512 fc2e2da01d19d8d9cb3acf62ce0983ff5f528702f81fedea12150e75996bd25d42d08cb0b6c7dab32d95d5454527fa6392b18c40f22926fe44c70548cfe2aa0b
SSDEEP 3072:N3cfWHJg+uvLma+wMZw0Nh3y116xjWQtXnhWBV+8:JyZJ+Jb3m16rXuA8
TLSH
T1680412EB3F1851A8BD7772B411D61257B2DAD82F0103FA26C8ED425FD4833AE64887E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 77KB
SHA256 cb717ed58ef63cb1a17e6baf2f0b65323ee6ef4eab45f4bc6418a49ab041f616
MD5 91d8b2b71cc4844e7b112d70950130ba
SHA1 4ff393a5143703e1efbca1c88dabe70c09ab8641
SHA512 6487ab19079d37682a53b8771ce62dcb0a8d0c04833ef41fbb9fa6479131aef8dd799b04f3912324ad877ce11a95aee9a547f12fe252fd0f1305d23094129538
SSDEEP 1536:3RJ61f+DTQZNEeSIawDgnyIew4EmN9dKj6iRWTKKnDUOusR6CZ:BJOEQZqeKmhIeXpfdKJRW7nA+oM
TLSH
T13E73025ED0C1E372192B5B63C59E7BEE97D910CB426A6FAA3D1F091236090302E55F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 27KB
SHA256 d2fc1c6ebd88fb175be2c5dc3c27741e32df41e8c05e92184b3cb9ace6753782
MD5 ea242e020e5e5815ec0941667295bd2a
SHA1 78ec8f478a64a4c373db8295d378efa0d6a79684
SHA512 df022556ed72994d5d6ebd480c826ef722812e0b4e00764f74833a24aa6fa8ff1ca4c776fed06ec6823942082926e1a2afd9016589c82298c811031f345989ac
SSDEEP 768:XWm0HR/ESa4tuUsaCGIbZhLLsaETud7yj:GlH04Ypd9xLsLTfj
TLSH
T1F4D2F28F866AC96775CF29143B5D8BD71859F35094483A832F0369D86F9CB3B173B884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 30KB
SHA256 8137ddf8bec9f85165a13c56d86dad124a5cd9f98359d6a1ac271eb3a03b5b1a
MD5 5d6e051cd70f2ed3d6a7380c3cc71b05
SHA1 b56a83c74c7042d8e8594ffe79636174f4d84c49
SHA512 7ba7dfcb54f740a11c5a70ebbf68591c37afce645b4ad68dc7cc8f30be47ee29eaaee61627cde078f4817ec233d43f9a3b1d977e8fb19daef136fcfacf0ec0ad
SSDEEP 768:Z4ppkGcr+oqSjjIuhQzEESUo8PT9DwaeIooC:Z4ppZoqejIuhQEUxPpH1C
TLSH
T1BED2E1C2AE2055F146FB817A525F8236D6CCAB1D7594A1C9FB28430D4063BD688D36FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 45KB
SHA256 b1911b22148bb64a3f1a5b92d0ca59f3a2842c7ae195752da4532674ea268106
MD5 9c2b0422c1ba9876d01fa61ff83853ed
SHA1 38f336cba051cfbb14d12d0eb27d90cd730fb08d
SHA512 3904508b29c89729ea5eee8047d653a2cc2c5260b45cf2bbdd257625437abac78cec2c528a180b62fa142898e31b40b6a0d4d08a93863084c3ec4a8f8d01abd0
SSDEEP 768:Z1n7ULvUhbk3oOhm0M+dAYqpg33GDznv23nyif71ZloV1JwgdHLCTrcU4PmgKIUb:Z1Ushbcm0M+fKg32DLv23ny8xnE1JPA9
TLSH
T1832302DF86CF1731FE26CF40807D3DC6BD1A747A284B68CA5686868DD08BD9346B5139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010e
Size 363KB
SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
MD5 f007441abab99e3a21d27dc2d28060cd
SHA1 c35c3f7bc29f579b8fef5bca815d8166f25fe620
SHA512 e425a78e7b98639ce278743929745392f47677447fb862d7dca3a9a141ec7795e4a26a23af660f868c400c0f309588e681272c0a437f3fc089944d5affa90f09
SSDEEP 6144:qaBl1GmDy/PFE4focYk1uyBbZ/zf1HV40+0/OuS8c9EznEmePW9OVBfJ8E/DxMI6:qaBLGIULocL1uyBb9BW90mGoErMGObJ6
TLSH
T1958423F5E4B83899198D4DB762DC5A4483D38BB20D63B1A89FC2483E4F40E476A1B4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000126

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000126
Size 73KB
SHA256 0fc5d9d55676b3241f00337c41b3b9ee81605b8c472b6de087f0735966a8a16e
MD5 e1b86132e17aef3f2aaf67415cfdcd5b
SHA1 70721de5364f3f42a0abd65aa67778fb2d5ec724
SHA512 0d2f18b869f0c0cde7cf62a2761b9210577d2589e048770d1594d670b2e840b4f40e1d52ba5ca8830ed935ba6c491eb3fbc232b3e1dcb69c3fcc4424d6e02cd6
SSDEEP 1536:9+BtIuGx2g9hqmCs7pV887zFOCWwS5Z9jBV/mewkFHuO:KtVGllV8DCWH5zNJ9
TLSH
T1427302812FCDDC531C6DB452810051D82A7BBEDE20F579025600EE874AFA6DD652FABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 9770233a5c0f52c1ed0d0064e1b491a74a5a3e24de1b7189170b058a963a99ed
MD5 f8f2a3daf7d43ba14af00e3777541e25
SHA1 d41f961cc64e2b975d7aaa45d1f530adfc8273f5
SHA512 b7c56c27a63e98568b2f1d4ca64c852bda58432024744e49867ddcd7e1541c4410dad21ae8215ec8d8b25e460c460f350205358e61c213a7406ad1b4f160a1ea
SSDEEP 96:VVJpZ2CMraLYQ3fQAG+6ItXZtMDG/cPoqMMfX8WYoXeMozcVUluB6C5NBCJWe:VH5R3zDtXTMvoIfNZozcVU4R5He
TLSH
T18C22E82590B06117DFF8C971F8D76AF23270769A114BFF5666947C3E0EDF39A8206A20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 bdeff6961aac9b13e1e4d9bc39c0af9e06542f082df77d6e58c8c0ee7f287b26
MD5 3291f2a1e68854086b3fc15a75eb7ff0
SHA1 c1b8f41070486664ec498289d132d28b437e82ca
SHA512 9908739f0040aeb1a6348096c29bea413c00db1632b4ca4c2d5eba185afc2bc4325335f8226c4aa964e0b13f8a05b7f2fbbed71129d825b83a09bda40aa98931
SSDEEP 96:FJpvuIK2CkqGGNQ342D2zItmlfdMOn9cPmZpMfXGUKqIeMFgJrUl6BXCtC06q:XAIiGH3qMtmlFMJmOmpFSrU8ol/
TLSH
T10D32E72960B42217DFF8C971F9D35AF63331769A110BFF166194BD3E0ADF3968642A20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595efe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595efe.TMP
Size 3KB
SHA256 a8e37b1cc65aaa0d9dd7fa3fb80585963e559badfd7628f959c9849bd92eb3d5
MD5 6c63190782f61bded6ea5e9ae7beae87
SHA1 6c4b03ff990c01b5507beb70939f6b71ec0f201d
SHA512 ae51c076d2a4f8beff3a95393572edca2816c3f4af725c282728722acca129354bc6a84435e8c866058dbb581112424bf43f49f7dc6c34550abdd498b6e238d3
TLSH
T13D710985D1B0B02DE3ECC4B8E6D72A5637B05BAA004B1E153AD5887F8EDFB22C185930
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 f4b766b180ad2f4e47a27100588ed3afc1bfe13a2f85f4f5488f242beaa47c44
MD5 98df821b00f539579902a238740640f1
SHA1 c2c3286626223eafc0c2d21c48123259163ae723
SHA512 c6259faf7ee4763d6ab361acc6daf57c6fa92f107c14374e28009695652d7281766ef20a741a48a602c7143cca8d161c6accea88db9c043f1ed8e36a119fb616
SSDEEP 384:DDEakAyDQmeneKyLftFBjOJCJDmBNZ4qUo/sSrwC5i9KPn57SorMIdVGVNwp7Wm+:LIPt7BlZU4YAx
TLSH
T1C1A27CF7C3E4862DCD2166F06F163D2BCD5E0A1453683D5A89E8BF4A63E1471E241A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 51dcfa1dd1d3a67095c30c59a70750e60c47ce52225371fb39e66b7e36412e69
MD5 fa08fccd427bd449ffdc9c8fbdebe004
SHA1 520b618ace12ecce6f9472d80f1db09e6fd2782d
SHA512 88eda4c166e4760febb26f0d77fbfaf055f9dacc7e62594e9c3c3150fd1d4ec730ad79f48df7d4132aff181d626f30da2d9aca40b53cf0a61ad40e5b72b96b43
TLSH
T15FD02273233030B9E6BCAFC5406FAC9FC33B20240D82EEE410E09CA9063186C4907A40
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58d6e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58d6e3.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 992d4da544cfc3b0b2df88fb90eb6c11baae503ee46f5f75492e35f422e5b460
MD5 67ef95a71191ecf0b132fca34d52ff2d
SHA1 b4343954621744c3ecff68da1451e5e52cc5693b
SHA512 52741ba557883005861e684df2fdaf894dee7fd0e192f0e3c03352fa1e9144c434683dadc6a07d7cca5ff47a22c76735bfe99b9ec76b5b86d01bdf22f2601dac
SSDEEP 384:sxZ2nj5Bm4k/fpsQnDyGroH/bndM/ruSUjyFeiQ:s4jXm4k/flnuGr4/bkrup/iQ
TLSH
T1DEA2FA536630597B8DDAD214F921BF27DAF50463CA944E88AAFCCE1C04E76FD2212C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 928e59439b6cb468ba817a35a39af1cf078940c305c0d753b947e0745d8fec39
MD5 af69cb6b3d0bd9672bd5e98f55be1cd8
SHA1 fbd1f0fbb156a2b4e5b33f50cabd4911376f532b
SHA512 e501505565b216526d3b8dc10296cada61b4093da37bf989f7a1c26e4934fa98f3903e50b21aa3936bde3f1797450cb34bcfd773b0a7a4fc95a907cacbc1bb27
SSDEEP 384:sxZ2nY5Bm4k/fpsQnDyGrom/bndM/ruSUjyFNiQ:s4YXm4k/flnuGr1/bkrup4iQ
TLSH
T1B9A20A536630597B8DDBC224F961BF27DAB50423CA944E88A9FCCA1C04E76FD2212C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d0dee9a0ac5b99aa73d1b5e05cd48fc83a555b9921b002ba5549ae843b49b0f5
MD5 7c9973cf8b620c9a76c796affda5e203
SHA1 a417105e74d3f0313a8da45a029dd11e6aecb2d9
SHA512 26675ae42f978d2a456c8f745b4dd777a819d6f6ee23b94a3cc628da75c33e444a4406b1fe1444f80e4b0dd725677fbd1241b55ef7d594597cd16c72be6098f6
SSDEEP 192:sxZzRfyM//K1Ml8M8Pk/fpssleS8xl6I5KOdpj1K/W6+WNRHjrSdi/ztytDKfGO4:sxZz5EPk/fpsQnDyFY/bJd/ruSQXMFe
TLSH
T11372D853A6745A7B8DDAD315F540BF27DAF5046292900E84AAFCCB1C04E7AED6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 7bae59695376f8f4ef4fb6066b1e0b41d88f191b1b658737794f8308b397b219
MD5 008ff723465e8f72b794af95f8a1a81b
SHA1 2297e6556188805773aaa0e5d9e5c3fcfbe6cf16
SHA512 5bfcd181add9d536de639014cb15b13eb4dc9a35e916fc4b58ae60b8ede5cdf44aff11a55f647b74b873f1eada235ec99b2529a21850b98993db00d98b794211
SSDEEP 384:sxZ2nOZqS5E2m4k/fpsQnDy9cP0U/bndM/auSUaGFNiQ:s4GNm4k/flnu9cn/bkauQsiQ
TLSH
T149B20A536630597B8DDBC225F961BF27D6B50423CA944E88AAFCCA1C04E76FD2213C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3d0fc87bafaeffea307cafbc7c1bb41074219005eeb5fc1f1523f6a537eef62c
MD5 9cc4742cd6cc077bd21829ae12542bf4
SHA1 c8f7696efcab64cbc121eec2d667a8dd085f2e1c
SHA512 c213c4af411b8332deeec9f13e9709693c7884691f51dbb79454683a90b55a67943cd134ab8beae76f917a95bce46dd3d77909ce4f8f8be28d9f062610626713
SSDEEP 192:sxZzRfyM//K1Ml8MFk/fpshleF8xl6I5KIdpZK/W6+WNRHkl/qtD+fGOeNnonk3q:sxZz5dk/fpsr0DyDg/bi/Vu6yiGc
TLSH
T13372D753A674697B8CCAD329F544BF67D6F5046292900E84AAFCCB1C04E7AFD6202C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 710c82dc97c7ef81e07123785140cd9088079697d7ecdceb1962c1865a9ad65a
MD5 440058cbc0d9294cab6e50bc29d4b75d
SHA1 3584c46b06ec98184c06029999e994c1227f76bb
SHA512 6e24811370a1f786d7663653e9abde61645567c8bb2ec43c26d72c1b49ce3f8ce0b389875b2e06c6e73f3733d7c73665a433abdf0ee38565b5f443d5f80c14fd
SSDEEP 384:sxZ2nOZqS5qom4k/fpsQnDyaA0U/bndM/auSUaiFNiQ:s4Ggom4k/flnuaw/bkauQoiQ
TLSH
T142B20B536630597B8DD7C225F961BF27D6B90422CA944E88A9FCCE1C04E76FD2213C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 31a4ff34ecd78a2c5489d8d317d4f5e82406291d2fd1a2fc281633d37f743b46
MD5 924982480c0a0de34534394bbd06c67b
SHA1 875102dfeb5ee7b03c0f50d0305902d53945c9f8
SHA512 008e6ba18fc9666aa78528d15cbdc7e50cdc21a519d6b5d68a014ac09b1b58640dfb61ab64072839b1405bba257e3efae68ff691e3d07bc5fc5feb951bb86250
SSDEEP 768:jiP7x8t12aM7pLuLno0WRmoMQpA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kqizLlb:jiP7x8t12awEno0WRmoMQpAu1jaKkqid
TLSH
T1D0030B3B380CCB7A4F844E9CDC26BE9A6DE801CB5698895447FA884C03C77EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\623cd082b6202da0_0
Size 64KB
SHA256 94fff825a0443740bf98cd7290958b827c7e61b3504a765a2de634536f2578e9
MD5 f8d463762441252da694238468207396
SHA1 ab4eac769172b84778d61e393493e2dc113dfdd3
SHA512 81b9e3b5f3c9ef0f712d0c3efd189b35a2899ef3f812bf954ca85d03f697ba4083b1d8295ced01ea17dae3d4380782c804f0617ce7906255884ff3d297f10591
SSDEEP 1536:Pe/DF6kDjWj+IYs/b23ehz5CGmNH1al95wAM7HPwqpzkb/j:2ZbETYs/hzUGmdvg/j
TLSH
T1E0532AA7B062603587AD22D5646B7F01F12B17163588C9E8F06C69913F18E8B6377BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index
Size 72B
SHA256 589b105a71bd2db36e806936d0a1b6395377d844ce03362e3cacea15d15a825a
MD5 f5338535bf485c035539f5ee724a3dbb
SHA1 7470bad10a182d6af06e95ac23482982909bfb87
SHA512 d15d9723a6a06c658aeb425abd954fd33da91754e5e5201d028b04d0e69646a5dc90ad5e0f14a307501f202871b897516cd78c20bd32572e93c064803cd17206
TLSH
T11AA0021482852043C45F13F135DE4E613314CA200241535FC5917448EDB15494D4505D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index
Size 72B
SHA256 113dae5c8d6c94ce9a3ddac1c8c9ea25a8775077366f279b997baf6b0fcc15ba
MD5 20dc10d78cc9db8ab38371f9bd3f92a3
SHA1 6230c0aeb1ed605c9d378b8dd5a4ff2c948cd1cb
SHA512 a016ffe16897b02b069ed55182d3bbb48ce2063d3161ab49fe2ee596c597bdffbeed06b9145998654291b7961cb740e338a245bf9f84079893c6c09b7df60315
TLSH
T118A0021882841003C01A27B525DF25A57318CD2403815B0B41D12884CD7095A5DEB43C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index
Size 72B
SHA256 eebc42151117bba2acafa5d0e60639b3d22cc2ad0055fb2a5372b858f5157430
MD5 5a522e9f4085d4d5b9607b182433fba1
SHA1 80454e9099e35f8e6517826c40c563ce0d97efbe
SHA512 035e7bb107dd9713837a112c88a3a95760feaec9f6977794380e9762f25e20a268d099a8e4d3d2bdd448bb68559feb7ccfc6da3379931582c5c19ab0a0380d79
TLSH
T132A0022007A0711AD01755F15F928651530188542344620A90D14044CC9D542466121C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\98478482-9884-40e1-bad7-0eff3185aa4b\index-dir\the-real-index
Size 72B
SHA256 d412d188dd92f0a615e066291e8641f0c15fafcf7298283e735ff4482e5889bb
MD5 58ae23633b19284b1b6a845fc1b4b924
SHA1 4f6b8690053d30d9a941c03c094f6a782876083e
SHA512 358e4956f569fb47521f936a453ae70826fb4ea9774ab8e51b4b9c5ecaec09bb1622e6d52aef21bcdd61c2a37497dce66dab9759fa23cd60a36865d73fdc7c45
TLSH
T17DA0026041640151CC514EF0615245546B64DF161251D30B44D18A55DD933D84D06048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ede9d35-45d6-4625-9ca9-0cdd3c79a06f\index-dir\the-real-index
Size 120B
SHA256 51d7a95cb5f051efa37c5c1b5b1358cb33e03fe34af29c1fda7766b92a098653
MD5 bb5d7a9594611e3718952d2a43ac73e0
SHA1 c15583e7d13f35244b36622c1773526ddaf5a1ae
SHA512 c4cbaa3a25cbabb32575ad6248e5bff6cdec743b2ed0b7a15deaaf903dfccbe787fe2f5b05c155563440d1e62d156b5b043e3abac83940fdf3a66118326afb64
TLSH
T1FEB012178E2405A0C18843300642049254058F340119921301B550108A051E6C94600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ede9d35-45d6-4625-9ca9-0cdd3c79a06f\index-dir\the-real-index
Size 144B
SHA256 7168d6f4d8c5c97186a672d1fe5eab5fbf54d7dacd02c7e0e4f74d7a3ed6da13
MD5 545573784a80596ae3d1eac841473971
SHA1 8fc7532be2ac108b4a95e84b5b38f4183cca42b4
SHA512 6df4541e5df82cb1d545a106188e7819380be0c15ddd27cffc96f94d5739b0a0225a53ac09258cd26057aa4794850654e51fc1660255a19195d90c999de983d4
TLSH
T16BC0123CCE7213A5CB9443B1D0A35753A0C449A5B15E4152C6E5A41E6C312678C060BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3dc032b-db74-4f99-95f8-e190726495b6\index-dir\the-real-index
Size 3KB
SHA256 835b7adee1cefcd87174a1183f66f1f8a9df5426cc8e43b84e203aa71b8f6a21
MD5 3856dfb7cd50f7e7b0b600bda41ca6db
SHA1 c36970b7da086aba538bdc88c3a8e09675180da6
SHA512 f8e42f2a13300897b483e1abf734c9846d64d872a8237e82d71faed09ca7376f267b434b2683f3fdd97cf968d48c39891cc75c1d4cba8eb485fac7d1bcf958b9
TLSH
T13751D8CC4E465EB7DCBD95F218B2008233B90ADD5AB06A076CAC667574CB22A0E4FA05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3dc032b-db74-4f99-95f8-e190726495b6\index-dir\the-real-index
Size 2KB
SHA256 4adae4b2af993a79934a1edac78cda553898ceaa8dd73511486bac869b9d752d
MD5 82ebb976820d13d4ac2ceacfe2f1e53e
SHA1 9b1470bec7a9653e1f847a60b4320152afba404d
SHA512 8a37705c6329fc032c64a9f5ee655204c7240e36561d214a44fddf7396b18ff97288af2bb2fd15b7f8a4d0c966f7bb0a378a78d750bb497be69528eb82ca30bb
TLSH
T1A651D69C9C4D9E17D8B941F458F7102933B188FD9D84070B2CEC5A39ACCB69A1D8721C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587376.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3dc032b-db74-4f99-95f8-e190726495b6\index-dir\the-real-index~RFe587376.TMP
Size 2KB
SHA256 731edc386bf0a3a6d04ce535479ff5e23532bca8040473cdd8670cd61941baaf
MD5 0df8d23d2f0180d8096836e021d888ce
SHA1 bdb7e758f0fb8af3615fe8ca217e61f5adbd1d77
SHA512 c61f2d3b37290bb264242e3ceb728d15b97f159cacb5b5f7e5cef65c8bf275832bc707f0de30a59725a44d879eeb61add1562faf22f1da92a2830a343112e03a
TLSH
T1ED51A65A9C824A22CD6084B349CA246D333DB8955984AF0734FC8A33ACC76AD2D53354
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 e734d15739dbca1641119be52b1cf0467acd698db163ca080f24a257232c0279
MD5 06415c9670bf138730de08b05b6551d7
SHA1 35734fea379278abe689822021340ce241b8a560
SHA512 b57add05dd87f44abe9bd2ef2933785440ddf74194ad5e8a6d6b432124f8b2344886c1f1bfd830254db6c32d5988e347b4da10465ef367af5ff7a9a51ee17115
TLSH
T148F05CBB2EFB1824FCBFC3EA2472406004427814C540FC8F116A619760B67183095D63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 b7c99abbd059bb92252d32aa8d322ede506a1b334cdd23b82155c6def915a601
MD5 9a7e5e5db42f749ae169ed6af339865e
SHA1 fbc0aafd7c93b269841bc2c58f7a15b9fd4c7c26
SHA512 e31fe824e0bd63e24f9b2ddd4f61bb82302c6ab83a3cef4f72310e398a7386059ec88e879c49f794a5a3382b4de76264033c2c0eb18a0fbf9727b25a6014b969
TLSH
T135F05CBF2EFB1924FCBFC3EA2472406004427814C950FC8F106A619760BA7182095D63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 00115a72a83bb993b167dcbc2d5276d351b8d012355e4858f8fc6bdbfb1adf4b
MD5 70f4f639a52acab809e05ce44d04ffc3
SHA1 abe8e7e31b05a2ced7a389207abbf9d2b5217353
SHA512 92b5dc97845905adba214c6878f0abfe1ad3c12fe87626fb66f97e04d57782d73c27d4276949fb55d2faf9a26ad56ba806f3bd436af10664937812938d342336
TLSH
T1C9B022828E3C8282CBB8033CFB8208CC302CBF30AB0E2A0000BC22F0C8333808203032
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f577.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f577.TMP
Size 48B
SHA256 140e7797a5198afa6746d16f7573f932c4fb9ee36ad070e68a8b9dae4141eccc
MD5 4d8a2d12a32a3dfd28db8dcd6f572fa1
SHA1 ab7e46c9ad57a071da3f42a5bb36df1ef8c60f0c
SHA512 e1f44b9ef53300604837a9b37e70a9cb6c9ecf9eb1892831ec808c5f3ee917c36ef78e5efed96fd758759edb4a32dc31e4352ae75810a8acb2c16cd9517da28b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9156ff907aa39d0312c0dbe8874f55daa1dae14f00a30ff720c1cb4e71e8e629
MD5 89cbc5e5be999dd47c7bc7ab75d8db92
SHA1 35cd5000f3a56a9b9b0e563b14f26f378e455ade
SHA512 fb4deacd20138b6a24b9c9acdbfa85b4890e7551b993e18328accd3f717633ed1df37244e78d30525e56adc4ade2d9cbf3ee435f55c318f426d69d0d2f496aca
SSDEEP 96:K84YKhq+6CAKPa2KEgKlGNFejvtbbN4Hkg6XNKys6tNe1tsn72WLqKkUw:y73rrUFejvtbbCHkbXBs6tc1tsn72ph
TLSH
T101E1F551B43A13817A7D259A91E4B47F06C230A33438A53B7BFA11A61F67E20DDFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2f9ac89a-a493-497f-8fe8-1b5375417420.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2f9ac89a-a493-497f-8fe8-1b5375417420.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c99fb1a86d9508b63c879594980bc8542525e81fbffb9b542969fdff1a5cb7d6
MD5 c771695d117e79a6711acffa3caf4ec4
SHA1 cd74bbde1dede5da29ecbb29dddb843bb55b701a
SHA512 455e36ed7f063cfe0681d70a6a92cfad8c39ad3875f98486f242fe73adfb32823e7aa53ac2c3f1c1fd75506a553af7d092bf31565dc924a250de3c3b035ae1b1
SSDEEP 192:uuSL8NzvQqGfU3KdtQenQmiU18094Y/Fl8Ua5ewoLscFoWDqDrU8:nA8Nzvqc3K/QMfSY/FBa5ej5srU8
TLSH
T17542183568786C779AE39E45B4477B139FB4207B9AD42F98EAD84B1C04CB29C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d1371c83c02baf0efde8153442a84a3f01efeb6bb3bc3ad046d16bc81b025125
MD5 c548f7ee635c8f02b2a3c2f2c4bfec6d
SHA1 55c368f723bb4f0789c0ab89d7ffc2d4d462a5aa
SHA512 393a52b4662d421d990a65cef1443a6aa307943444077c0b426f63e052102bc6eabf01b1c60fff026e864754620b32a474c2c496ee8e561a95a1f10da2b0da6d
SSDEEP 384:nBiFscXqnt8NN8TUNTUlIlUTlc3K/QLvWqDfwP/FBa5ejU2srBwAHW/Y00ZZ:oFut4wg9auuP/FbA2iticX
TLSH
T114B21936E8A5D97BADF74BC5B606B6479FF011A38AD85AD4DAC85E0C04C72DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 3a717e9c64ff1096845158f9bdf0de1c740725215fd098531ccb0d869c75a589
MD5 1d1dc7e228118e46ee8754f57f8eedce
SHA1 f583bf7ce2cb7baea241ae9c228df4c7bbd3939a
SHA512 f034609697c122c2b7cb699a40f87fc6cfcd1895b885767d4d0538eb1cc02288d715dfcd02654c586f0d2541d9329a7fc3994a5e236acf416ae817741c2cb610
SSDEEP 384:nBiFNcXqnG8NW8TUNTUlIlUTlc3K/QyKmqxf8P/FBa5ejfsrBwAHW/Y00ZZ:oFxGVwg9a8gP/FbriticX
TLSH
T12AD2A3F598E79937D9AE4B83A33E6E069EBCD15375885994BB840D0CCC871BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 64828ef5cde3d944521026879534e41933259091722c6038af3d621b0bc0cc00
MD5 272a1c9e9207c6e4c209db23b688f31e
SHA1 5f52f46a5a16117d8d32b70bb78d7b1eff5c7c5e
SHA512 9b50a3e072637b30dfc9b056b34151c85f74a4d9502caa0ff7438cd6f926a9c64eff3365b95049399fdd59fe34c41c55e7aadaaab0752f577b51cd84b4063ea5
SSDEEP 384:nBiFhcXqnO8NW8TUNTUlIlUTlc3K/QRZWqifxP/FBa5ejYsrBwAHW/Y00ZZ:oFFOVwg9aOyP/FbciticX
TLSH
T192D2A4F598E79937D9AE4B83A33E6E069EBCD15375885994BB840D0CCC871BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2c6a97eb8ef1249bbf070fa2df7d281c38e1089f61bbe79f0b1f47cbef5fb43
MD5 591c678a68d3418df1e0ec97c00a28fb
SHA1 156241121555e5bfc3808238080053606c3b16ff
SHA512 0eb4c3cd665092c120d5c7c4da75aa8912fdff8051c446543d09ad855547da1d07dc4b19d0d4c9aba330bb19f6669473b887369a452aa30a991915cce3bc33ba
SSDEEP 192:ZGNjE6Pt3QmiUyAcmqB/Fl8UaX7roTm9IU6:ZGNY6FZjFqB/FBaX7IU6
TLSH
T11302E93978B82CB79EE39D45B487B7175FA4207BEA956F94DAE41B1D00C768C2307432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fbb5ee9940879a91f5fe14c03000dcf8ade2f1cd3ac6004503c00e90e91c7b40
MD5 a81e6e32cee2519216b376cb6452665a
SHA1 a31fe7916b1d7db8c196a6007a5292e0ee7bc2af
SHA512 a6dc771cba2169ab7d93cd81f3e1c7cd32735b80d9c7d113ed72b8e91f5a47aa5e799db251ef09d488671d029252e218eddedfe3a1963cb0f9fda7caef430b52
SSDEEP 384:nlcXqn68NzJTlc3K/Q+Sz2Y/FBa5ej5srBwAHW/Y00ZZ:Z6haAzb/FbditicX
TLSH
T1ED826B35A9792C779AE78E45B04B73135FF061AB9AD41F94EED84B0D08CB69C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 69883141cdfbcddea722c888327ccd69f7ae29d51d605d010ec88826b02795b3
MD5 ee2079ce8e151bc94c97a66042cfcbd4
SHA1 e8ef0c4d1fa8e63c1aed141b68a53ae4913395bf
SHA512 220eebde69c065584d72408436760c2a7caf776c292f5375823cd6c9eed7e7e1823481ea5179dbbb26eec41dd8b817c041a2824d9993fa42e079bf24c04534e0
SSDEEP 192:yGNe6PtsQmiUyinmOB/Fl8Ua5ewoLqn4oWDqDrU6:yGNe6F8HmOB/FBa5ejfsrU6
TLSH
T12C12083478783CB7AEE39E55B087B7135FA5216BEAD46F94E9E40A1D04C729C2307532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 44082bdea3670c6d970a0cc52a49f1e08e4730f4ee07c910f6109f59bfcbfbe3
MD5 d952bbf7b47409956e3b251acd8d4afe
SHA1 6b041256b0cf292f6cb033691e159bb2ed9d8bdc
SHA512 0ede22916f4b6b923555bce09c74735224a0ecceb5efa4499529ed973e2f69f749fe2bfe8688bf1345f76d09eec8aa6c037d47b2480ce5590cbb61cb30ae5f96
TLSH
T132E00103530012AEC83D1B3811C756303AF3803016B746595D14017818133041F35FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fec767e70e3711b0d5453fe5d3ccacfe737d86bc0b1001d2a9b93042484209f1
MD5 9157c573a4e9fef227c8fa6569871e18
SHA1 990d82fabbd423451cc75968e9baf26d9afe5ee2
SHA512 dbe5772fea228b9dddcaa4cf3d90ce5f27b54e920eb5a34213f97e797ec5212119dcc61c018bc9d55dac1d895b6fbcec3c35f58585b77a100c7a7cc04d145951
TLSH
T1D1E00913A30012BEC83D1B3911C79A303AF2803017B746595E25057C28237442F35FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 35a0f18c2f5543f5bb50060dbe58eaca7b3077a63b0fa890683c0cf956cf7ba1
MD5 d42314574be72806ea874197d4423a63
SHA1 f9065c6a8cb077141453339721e494956945169b
SHA512 b857f55a70e76c5280a7427c43d58f02857e9a22fbbf4d9254472caea01fd90ee1191f5b4134bf6ff4fa88ac99ad9dc37f29c713868b52a96c42868f00a13d7b
TLSH
T167E002025200016BC8290B3411C7522033F1801003B70355540401745C023040F34A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 82c2398803d7cfde5b5f82038eca601db88ced30d43133c5a5ad47020f35c9e0
MD5 ebab704b18f42a55c38656b86369d6f2
SHA1 e5877036dd73315b99e6f0421a4d69075cb0ed18
SHA512 377f4690f370d984efb5c4efb1b866b64c14d9066981c7ce0e5334c4967e4723f0b1042be22a662f45a7d4dc2df359a4f5fa69b993c7403946645f9b3e3964c9
TLSH
T171E00413A30012BEC87E1B3911879B303AE2803026F746695A2505AC28227542F35ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58720e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58720e.TMP
Size 392B
SHA256 a091282c228087d2af280235870c3cc6317680888031d4be337f2f6d318dfca7
MD5 719e9e7c9461cedf48491d21237fe43b
SHA1 1de0d66c25e2d9a47bdb0d06de614ad9c09b2823
SHA512 7219045a93675a8e71678a02fce004a7d28aa6d363f8208d624c6af2944a01aa4b5c0f07516812d053a33ff2ffe677ee497afa5d009918cfff64c302f0c16e6d
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

244d24ac-1108-4368-9402-eca4d5e0151d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\244d24ac-1108-4368-9402-eca4d5e0151d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Cider.deps.json

Path C:\Users\Admin\AppData\Local\Programs\Cider\Cider.deps.json
Size 31KB
SHA256 cfc58e4c89509c40d820e448a1c5707f3bcf722fc1086be229c63cc0b269dbb4
MD5 e3a8af5c967b39f247aca0195a447d50
SHA1 8a9e926dbff8ceefa74d6f3b73be84d9c65dd535
SHA512 cf4a338ac07a70b766ae3de4b4b6dfc98dee43d8b372b79bbb026602591df0a64fc9bbe3ae19f4eaa270d34ddec3de9936a0b45b9eb57febdd5f8ddab2a6595d
SSDEEP 384:CaiCiIXFQGmj38EsPl/XNApNXL4znTXTUmdRqfDY:CIiIXCGmjY6WTX3Rqs
TLSH
T1C7E28915E8446E3745B6ABE2E8754281F63A833B6104594F7CFC244C8F77FAA60A6F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cider.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\Cider.dll
Size 7.1MB
SHA256 4ae2e7205bea06068b21e772dc8055a01e5eaca0086148ed1875c232c7dd885f
MD5 2942f997ed82ffda26c92acf0392a1ef
SHA1 7d0418d1119045571240868080606b654627d5c7
SHA512 e28190231cd0e3c46cfb0037f8a19f660f4ef581095ff37d9c7dee56c4200443cf1bb893e1319fb1435ca603251ab42f1b95d7694f2069955982a25dc290fd09
SSDEEP 49152:9zVxuionTUpWzFIAGUZtG495isuwyY8QS6H:9pG55I6x95is0h6H
TLSH
T1AF769E976CAE1199F409AE340351F613A3A6513BEF92830A242DDDFDDC8B3A3DD43265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cider.exe

Path C:\Users\Admin\AppData\Local\Programs\Cider\Cider.exe
Size 270KB
SHA256 d6a169c75a98d82cd4fae0df8d3815c65e2427da680a681573261d6849c38fac
MD5 4409682e3a28bb42e40ac7eb3a6574c9
SHA1 29891dc050b77032e7f46c4ddb3caa197d48d4a5
SHA512 c0c69081c0e18508c3d8975c768fd33959fe386d197c0ff33e210e204b18221c8737a9c8fc85c2874ab36369b0a364b6a7c726be140c91d6d226f1f7abfa3d81
SSDEEP 3072:p4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZXAYoE41E4Glmg5mw9G8ZRjU:plm4sqMaFFBniJfBahmQ5QKFZ3q
TLSH
T14044E83E537880EED816A9304E80697AE3B135611FE3EBC733540A773F66B90BD55292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cider.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\Programs\Cider\Cider.runtimeconfig.json
Size 515B
SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
MD5 e0f6f18f9b152bc2d8c710b0214805d6
SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
TLSH
T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
MD5 SHA1 SHA512 TLSH

Submit Download

CiderResources.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\CiderResources.dll
Size 615KB
SHA256 deeef923719498d359f84ab4fff63ac95b5c3b40ed7add024ff20b0bde9cad3a
MD5 150569ed14cc651707e745531d2f5f5b
SHA1 cb32b0e2e2a4f7e99903df6a46048a8f2d30cc4e
SHA512 5bf709c51d18a4b2af45a8f86ed0fc6b173100c9bad60e4162a59d03fb4344ef41244717d9041b209342cb7d17d99efe144b160055a78da95190fd7f6a0b6ddd
SSDEEP 1536:Ssn7Qs+Mw/SThsk8voUbRjd6GQfuOjmfxvdzsMgHX2:S+/tMvoUrzQGOjmJ98X
TLSH
T1DED4F771F501F028C45D0E3A6DA2EAF899753C3C7D54506FFEA2774F26B2A12FA10686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardcodet.NotifyIcon.Wpf.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\Hardcodet.NotifyIcon.Wpf.dll
Size 121KB
SHA256 402a8dcb6a9141cb4c73bfacf1c3cc222f96b8e803e50a816a2c56eb406874fb
MD5 c6a38ea14934d7d123e08b8f3a05c606
SHA1 1bbeb5ce5bbb93432299e393d99638d17bcac648
SHA512 740240e975c45765711f9d2119a1b6d1e964ef1b69246c1dd7c0a160ce4a54cae7c038dc8867ca76fa50d9d4b62062d4ac399c480a72d9082d200328992e37f7
SSDEEP 3072:AiRUD2Q968U1Tnc3mXKMNd0zX/oWAgk34:AqE968Uwm6MLk/Tk
TLSH
T157C3CE4133FC8B3AC6FF5B3968B526664338EB603562DB4D4898153899B33C42E617E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Toolkit.Uwp.Notifications.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\Microsoft.Toolkit.Uwp.Notifications.dll
Size 159KB
SHA256 e6676557727bc03cf7bceb1cb7b46ec4623ed7eb57813e8f04785bcd9d868b05
MD5 337150c55ef9c107fe65e51ce4fc9709
SHA1 60a7acce3c339665e1f5fef99b8d2cd848436511
SHA512 aee99ab3e51aae4285e8a717cd2400db7826c79f0e404c37949ce944fc8aa1229e781a0851fb4b29c79052c5ae8b8b71c73006cff66480d150bba677c5abadf7
SSDEEP 1536:vXR9sdzDjgvdVWTEXGy59h/Wd6GWgYOHeLoS3jFbcJe5W+Q7MNQzZfx/IMfyfBTK:vByhUlIQT46JceLoS3jS1+fNiZf2HxQ
TLSH
T13EF36C12D3E88BB9FEEF173AF8B411254EB1E91F7421E7598A08EDA99823740C551373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAudio.Wasapi.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\NAudio.Wasapi.dll
Size 175KB
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
TLSH
T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\Newtonsoft.Json.dll
Size 695KB
SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
MD5 adf3e3eecde20b7c9661e9c47106a14a
SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
TLSH
T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Common.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\System.Drawing.Common.dll
Size 462KB
SHA256 cbe64b8a6ba7751dfbb8089e080940df3b0042d58d01c1f42cabdb6026f78dc0
MD5 93c7a979d60cc91a0d551697ed139f87
SHA1 384161b86c590ed3375129fcd70335bcac71b9c1
SHA512 0bc86a3caa4a4c78e10f6b6556454b2ce1ae19901b475542bee28c733cf4225eeb6af33b28121799bad77e64616c300762cd630da7a27e90beafc41bcc3cf303
SSDEEP 6144:4g2JrZYn1AFXnpMpEqamX4pwBN2/KxB2mGzQ2ihESSGsi+ULCikEMDSJcXpETuqT:4XIqwESJ2pUuq89Fmd7QUBCA
TLSH
T12AA46B0037A85E1FDA9F0B79E0620F244A72C91AA28BF7CB6AD6D53D5CC37549E112D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Windows.Core.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\System.Private.Windows.Core.dll
Size 835KB
SHA256 63ea2360e38955c2e95ec24657376957dbac1f9c2648a099c7fc7217cec3a95b
MD5 1aad26c6d05f45527363219690fd527e
SHA1 7e6a4a06ada258e7e8b5ffbaf5d5180298479e7a
SHA512 f1970879d6a6fb47dd95f9477674db7de7f61b0567eca4b0870c8edc8589476e0e90e586fc64107304aeb48c18167187941d847ae34acdefa4aa02dd5b189e1e
SSDEEP 12288:xpIbbvnzBjfo3BjlbqB2hva3Lit7D9hRNTEhQWgv:c3vNo3TNaOVhhTTl3
TLSH
T18605D350F67FBBADFD4859B0B43115C648B7508BA1CAFEB883C9E890C572A9B0D144F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\Programs\Cider\Wpf.Ui.dll
Size 5.7MB
SHA256 e6c8042ba1861a72eb734f75f1674ca13b756a40eaa579a30a911445fa458f85
MD5 252f9ded32783db92448941aaf776de4
SHA1 1a438ae3748d06a067516c769e14480f996d08f0
SHA512 a3e14fc1d105c67e40ea8b3ec569364f89f5e2e121afea91c53d60fd67899ddd27934f406cfa622b842190d98ace9178d4bbb55b3ed40c1792031f97cd813be1
SSDEEP 98304:9pbON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7l:7O9oNdvPp
TLSH
T1BD565B5E23ED4D32C3A3837A8DA0B3231D6519752143AB834F4A9B3D44BA1C9DDF169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c15d9d4b-f53a-4888-bf36-ecb6c2d8415e.tmp

Path C:\Users\Admin\AppData\Local\Temp\c15d9d4b-f53a-4888-bf36-ecb6c2d8415e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4a9a370-1453-4d29-992b-48b0628ea9f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\c4a9a370-1453-4d29-992b-48b0628ea9f0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cider-3-1-0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-96NFL.tmp\cider-3-1-0.tmp
Size 2.9MB
SHA256 6f75decd09890d52a32154d0d3b2d19bf184ea51a158a0c1f2f9daf28b3675dd
MD5 05a3d9e0943bda971f08c974ddbce467
SHA1 881546d1553d3ff42bbfb0fefa71ecfbca161d11
SHA512 e7bce3b4f5943e7c01e20d52d25a54fedf150971de3fc5a1c77ad8da23109a51cd98806ef96d14465057c0c9f728b07a4ee973c3f741a317f96c5a652f2022e0
SSDEEP 49152:HdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333uPP:9JYVM+LtVt3P/KuGP+VYNCu/333uH
TLSH
T1E6E56C1BF389613ED05B1A352927C1515937BE707A2A8C579BEC3E0C8F361886E3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir928_1580422447\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba1e39db-2475-48f4-bc15-f37ceb617a8c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir928_1941166957\ba1e39db-2475-48f4-bc15-f37ceb617a8c.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3b500a147fbe550.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b3b500a147fbe550.customDestinations-ms
Size 11KB
SHA256 4b26e0fd15ec5de41b2f134925deb972d42b39936f16c8a415890c0d2fa0258a
MD5 6b58db421ef078bdc5f186141cf9f9c9
SHA1 d6e9d5880e38b4d7b072f76e7c759fc847f49260
SHA512 a3982183d51568f212adc7f3ea6f797307413980d86730e4f6200353ce778378b8df1cd5df272c8d18c8d2a6d98e64ccd0bcf49b4195adff91336164aa0a9789
SSDEEP 96:hekIFjfaLekIFTzFekIFTLekIFX/0JpekIFqz2ekIFTaH:heRqeRbeRVeRCeRTeR4
TLSH
T1FD42EF11DBEB0E61F2FF85F356B7AB04DAB9F8A05BD9912D005482470EB1B41D62DB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3b500a147fbe550.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b3b500a147fbe550.customDestinations-ms
Size 11KB
SHA256 a03694934b57df7acb0c7ef86daab1006beb15179a56abedfe5e30b5fcb208f7
MD5 2d84a424d68f5aa5aa63334163d9cdba
SHA1 3b97db334e81ef4e8a2eff2db824dbd72acf59c7
SHA512 cbcaedf75646eb6a0ee5d2e127cbf70f6fc7f5c789a0359977a192d7b6f3c841de67810852c61751a84972cc19f91377491aea969a023acfb023df6e0db14d73
SSDEEP 96:EekIFjfauekIFTzQekIFTeekIFX/0JwekIFqzFekIFTaH:EeRPeRCeRUeR/eR8eR4
TLSH
T1A842FE11DBEB0E51F2FF84F356B7AB04DAB9F8A05BD9912D0154824B0EB1B41E629B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-options.yml

Path C:\Users\Admin\AppData\Roaming\sh.cider.dotnet\client-options.yml
Size 295B
SHA256 27a212588d6ddaa2e3bf232bf22be7fba4b0875e5a9a06ac3366e7c90d5ed8f8
MD5 2f7521e900a36649834b6c45971941c3
SHA1 6448c0a113e73fac53aaf66c669bfe724974b42b
SHA512 8c7db46f9e8a3d3ccaaeb40c2a096f762d620a69fe6139d6f3f1e6e9ef4b9442997a5f54dd6e858012288550398548b25778c8801ab85a5421a3fba3f5e1d65c
TLSH
T1F5E0C2112C46B97E02FA46CE08B2F3CB83AC9410A89A0075F52A50567A08B36456AB41
MD5 SHA1 SHA512 TLSH

Submit Download

spa-config.yml.backup1

Path C:\Users\Admin\AppData\Roaming\sh.cider.dotnet\spa-config.yml.backup1
Size 4B
SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
MD5 c443b04d0fc26b0a5a4573a78e0082a1
SHA1 3c957535345645dce7190b85eb10b39da96b2518
SHA512 7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3
MD5 SHA1 SHA512

Submit Download

cider-3-1-0.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\cider-3-1-0.exe:Zone.Identifier
Size 446B
SHA256 81156e3f10b8089150b0905b204697d91da166f3095c3c61871359738c8f5429
MD5 88ecd626ef500328bb6226929373433b
SHA1 b403757757706a81b5667d0726bc945bff12e48a
SHA512 d63554c5706b86799e7721c0a5b5e847ff55b9c205a24bdea2c81b4696a44f4b016b87112ea134082de0ed1be25e00a9d68dec77845d3d3d19745c7239f96052
TLSH
T12AF023B38B7CA746098867FB6FF91C09B0C22280CE01C399C5AC804CDAD0189D1F76CE
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1139454098\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1274046916\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_138209628\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_1426396357\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_333577160\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping928_881191148\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5828-1993-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/5828-1953-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/5828-2517-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/5860-1995-0x0000000000DD0000-0x0000000000F1D000-memory.dmp

Download

memory/5860-1994-0x0000000000400000-0x00000000006FE000-memory.dmp

Download

memory/5860-2513-0x0000000000400000-0x00000000006FE000-memory.dmp

Download

memory/5860-2514-0x0000000000DD0000-0x0000000000F1D000-memory.dmp

Download