braodo | hxxps://bazaar[.]abuse[.]ch/sample/82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c/

Analysis

max time kernel
1800s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20241007-ja
resource tags

arch:x64arch:x86image:win10v2004-20241007-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
16/10/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bazaar.abuse.ch/sample/82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c/
Sample241016-rbc61ashpd

Score

10^/10

braodo discovery stealer

Malware Config

Signatures

Braodo
Braodo is a stealer written in Python.
stealer braodo

Detects Braodo stealer payload. 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000023d08-267.dat	family_braodo

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
1612	msedge.exe
1612	msedge.exe
4448	identity_helper.exe
4448	identity_helper.exe
1564	msedge.exe
1564	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2892	7zG.exe
Token: 35	2892	7zG.exe
Token: SeSecurityPrivilege	2892	7zG.exe
Token: SeSecurityPrivilege	2892	7zG.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
2892	7zG.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4004	1612	msedge.exe	84
PID 1612 wrote to memory of 4004	1612	msedge.exe	84
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 3416	1612	msedge.exe	85
PID 1612 wrote to memory of 4172	1612	msedge.exe	86
PID 1612 wrote to memory of 4172	1612	msedge.exe	86
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87
PID 1612 wrote to memory of 3812	1612	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bazaar.abuse.ch/sample/82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdb6346f8,0x7fffdb634708,0x7fffdb634718
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --service-sandbox-type=collections --mojo-platform-channel-handle=1808 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10077309323325808443,7032286549332546132,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4840

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c\" -spe -an -ai#7zMap2235:190:7zEvent12310
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 219KB
SHA256 2296e29fe8d691df9d0d90f3bf10a97c812828cc62769f6bf54f7a831829ee39
MD5 30b8e4aa1bf8289890e6ae4c4faaba1b
SHA1 59540b73fb63ccb20362ea94aa3e2baefd8909b7
SHA512 9f4510821f47bf9afcd5e29d5a832ed9889130801f481ee1563668c3c252553a175946b25ca6f4f5c9c48ec8c56198acab1c385d5abc748915b023ce748324c1
SSDEEP 3072:8QdtZ0Aku6xPMrJ/Wu7iEsBY0xJhmT9Nr8eTY3qcl0T/3lF:8QdtZ0AkWdd7iEsB3nhc6qclCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 09845d4c8186c3fa518b17057c1393e929d44e80cf11429d4200623022389259
MD5 7a997129307a515a06bfda7b42180a94
SHA1 6fdba081f5558da53e7bcf61ff2458e904aae446
SHA512 a87705c56296e4971996968b3a5ed28ffdcc074a7878b81afbd1dbebfda07d5ba6492a3170423eb30f7b089bc5357af6dc535709333e0431775e7fd365f2cd47
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 ea50a8e4ef586cab69e776991dad4531c74432febe71efb0ee8b0278baf53a95
MD5 b8ef2846d577610653cf833fc52f9003
SHA1 b52b63608394b8b76edc52d7c59a63493652b159
SHA512 4f869f148684eb7c207ba71116213a1e87bf4baae72ae55720af6690c60d1f8694fc08407fe036e39be51e62d972a5fb4eecc6e03ed7a8ce1740e5d99c5f2824
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 1d6fd0af42c7d34d63b8f34d7375e2fdebfd43218b9744851b3e7985f29cd364
MD5 60e81f4ab0b7d2379e2ccce41f652a2d
SHA1 c99b9b119e8157b09194910080e7781324049e87
SHA512 110ede3be6c521aee99116781bfbca8310af27527eff4350df24e3fe21c7ca7f1e4155d65139aa50f5230d6b6a9dae5629faf5a2416190cd9735c49f19da5a92
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 7673332617e87f0b68140bbd6f3fc31f079b230bc60b42794d5753cbfd4c9514
MD5 7e7dc0b54d9f5ba22d0b8aa4c0782ed4
SHA1 5a8cc2c21fc245a30a317aee04e627b7afe8f47f
SHA512 f8bd7fbecf56bfe14649d08fb5b3e266c0a9ea974cdf232a516cafed0fff0609cbb45215f2cf82d450a9b42209bad27a49865940a947f77bd8be172568877cd4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5a9baf4d9c8f96f214e734e535b0e424af225224f8f5a9c11f317a234d848a65
MD5 f26d44f55956d6155a8e654867fa4836
SHA1 68d3a8f81b34f4f3a20375eb004aa9d468b04c4c
SHA512 ded0f1d179c7b561ec58eb1728af61ce0d3472573ff541a567bd104d52248519e66e65bb74ab4ef88ea4dc1213048ea9f4a16de9867f047fa5de7f5ceb8913c8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bfff9dbca0a617a444883329e98ac233eee02b832e51e9dc6275622d72687110
MD5 5e1fd89cc254c85402fff616ea67db75
SHA1 429bbec38ae93a602bb9e9ef622a6aa952a1926a
SHA512 4b0cb6b55d598d22d42fc63bce8cbec71bd10e65c5af365018f19c1745276d16fcefe76b343518380c96ee044d8ec4c9b2434d1477a8a643099e99799747013a
SSDEEP 96:n3kkxm/BQYmqN1QL1SnwpvWMoiVmdeHdwEUvQyV+VDCzTEJb:n3k9K+6xaGWMXPw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a2eab430529dff6afa64a8d70f03a69db381e5539d04cf92897fa79a07a666eb
MD5 c6a4927ba592b1fe132b4b46d26e814f
SHA1 d057f80a1a47c47a9515b7fb5fae1ffcda48d85c
SHA512 d7ee680b8716b1ee0564dea5cf7780832790e8dfc1937ee1cf282cbbea68321d5c3654048a8b5328278e7f81c59485784e73af68336a461a82ba89656fff30d4
SSDEEP 96:n3kkxm/B6mqN1Qb1SnwpvWMoiVmde3Puu1jm2dmEUvQyV+VD7ATEJb:n3k9j+6haGWMPuu1m2pwy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 485ab0ae331bba097b7222a78ecac9a764a7f5179f4dcebcbc2592e2437c735b
MD5 07a496e774d56c522499d71f82b02af0
SHA1 db98159f0e2a568a4e24d92d874c7094941f4bd9
SHA512 2af3b6e6a41b3d48028cad7dca2ad0165b9c6ab719482254b824a4c5f3ce5eff06887b48fe5cd24c5987429a4a8db02f4876570eae5501f6c7f229a3ce6be76a
SSDEEP 96:n3k8sQixm/B6mqN1kl1SnwpvWMoiVmde3JblMFIm2dKEUvQyVeJVD7ATEJb:n3k8j+qPaGWMJblrm2Zweb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6c6787762e42d3d39a3c2d6f18749e9e65a749c8af27f59b211a42f2ffe4298e
MD5 d46ebb57239905407613c6c3c46bb2d6
SHA1 cfe6e280efe5bb874845260bdacfe263ea1e1a9f
SHA512 fa6b661b6a0c1ef9e36c39c9b55b436edc4d3e4f5c1adf6e0e70ea3b98d6826d9c10b20d1d213b7272aa074bfc6e07ddcf048758f543110cc83b42b4655c1d4b
SSDEEP 96:n3kkxm/B6mqN1kl1SnwpvWMoiVmde3JblMFIm2dEEUvQyVeJVD7ATEJb:n3k9j+qPaGWMJblrm2zweb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3d042a1bdf9b0ef1054b24427b1d49fd1c93457e408e166555b2ee67c0515372
MD5 16dbbb2b81beb94484bb2e72bed93f71
SHA1 b303af5fff28346bc0c2c06e9578b7002cc1097c
SHA512 03993467f9ba36ced981626618ed166a14b848c288d9a6ba6cdcd4b24f354d76298c0d46187259dc1e0b7d9d7c8f5e5fbdbbbca3a599a059670aa55eeb47b84d
SSDEEP 96:n3k8sQixm/BomqN1kQ1SnwpvWMoi/UR5mdeWu51rJblMFIm2d3lUvQyVeJVD7ATC:n3k89+qCaGWMsMu5vblrm2Hweb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 bf753fde53be4c19cade9457475962e1d4163bc12e1d668e928c56a6400cb582
MD5 2afa1a4410e474f818a8ec7a6e360bf6
SHA1 751cf0554c21ee8abdaff820cd27bd208486ad4f
SHA512 b2d1e13f58f5d9e2eccb71308b254377f42f6702373ef886e0f534b6fe82d154da5de3f1b5cc54da26db4a11ee973af101656da1e9c1fbb73653bfe273768727
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584ee6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584ee6.TMP
Size 370B
SHA256 bb34317dc3228eb54c4296bf578ba97fe8f943f5ec97d5700aa096f29eee6638
MD5 3d90641eb85de421fafaf46a7df9d5fd
SHA1 46a4f2af4bd03de42ebe9a7c36e71a0900393618
SHA512 fd1d7f95e5d0cd28bf0a244a93cf37e539970b3847280171d17a23cac9ca806545a856161bdde5c2388f6852382cfaa23062642c7a4405c83d1698f88f99fd04
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c1def1e0dacee84183088beeaacedc8153b0cd8a983b6cb6ee0ad225f23ec23b
MD5 c5b08f5664c753a2ff38c26b0f1ea247
SHA1 117adca307a95cb085f888387149b6ce3010e62e
SHA512 54ed33102bc1f7311aff5f985c984397606397019413bd3efe390f3586e15c78460d4ce631dd358a6a0489bee8f61fb188c7c62a0144b31cc4e4e2b359dec27f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupm2Oe2RUJRHq6+B1E0QIu:A9iIxuERzA83h09RZxYO2KbE1Iu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7792987a0c8ba2bf39d13e877e0747c52382629f56882103457a429536bb7f46
MD5 7833b7e6d1ca47e11465cf42f1792260
SHA1 07567259306e2d3c61c2371d49257676589586f6
SHA512 f43dee1a4c57eb0449b866713db29e857da7c31445eeee185da3c4061e9abb51464f9d9a5a1c581a9a5135f9bf89b7a45ef297ff409fbf444df71824bc821769
SSDEEP 192:doCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupm2le2RUJXTm3YHu6+B1E0I:R9iIxuERzA83h09RZxYLWTmyubE1Iu
MD5 SHA1 SHA512 SSDEEP

Submit Download

82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c.zip

Path C:\Users\Admin\Downloads\82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c.zip
Size 16KB
SHA256 aa8cac6fa552baa577e71a8e61ea17bf00f80068a8dc98116fe6b9512009766a
MD5 a9b626c2388d199e5d254ce4c37e268e
SHA1 a14364adf77faa55b6cb9ad28852bd708a73e2d2
SHA512 a668fd5523052159f2c808859e20e7f3239607b87729b1f17d630adc6fd98c96d1edc8712f5197e2781f2d8f65ec2f0eb4a488298c21c76f5554d12955c55604
SSDEEP 384:meeSTlqBkTY/6lln8r+NcdYe1wryguvb+Ng+VuCN38pyW8PNh9m/MzC3Q:Dl4khln89d72+guvK3hPNh9uMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

sim.py

Path C:\Users\Admin\Downloads\82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c\sim.py
Size 3.8MB
SHA256 82906c8ce512d1d4e4436e48846a20d7a7f6cc85e6609f79e2177a5cc4f0742c
MD5 cb19e2f6e76eb6234c4612802ba74ba7
SHA1 c04f7302315afa60f2a90af7c232c42fc27956e4
SHA512 8b0b09410ccc705c5290ef17f9428643bead10a5daa813b4654d7dd9ed413b2504ef5d07c39e037c7ea988beeeddf522bb999b8127c11489c5db642e19b4ae4b
SSDEEP 384:KRExTcSVqPb61rNykWy/k74Fft1froMzZxuF:RxTcSVqPb6N/7oIWF
MD5 SHA1 SHA512 SSDEEP

Submit Download