2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

Resubmissions

13-01-2025 04:35

250113-e7x5tswlfz 10

13-01-2025 03:52

250113-ee43nsvjby 10

12-01-2025 15:57

250112-tealdsymgt 10

12-01-2025 15:53

250112-tbnc3s1mhn 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-1-master/butterflyondesktop.exe
Size

2.8MB
MD5

1535aa21451192109b86be9bcc7c4345
SHA1

1af211c686c4d4bf0239ed6620358a19691cf88c
SHA256

4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
SHA512

1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
SSDEEP

49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4748	butterflyondesktop.tmp
2824	ButterflyOnDesktop.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-RTN9D.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-EFRPU.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-Q2K0T.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-NKT90.tmp	butterflyondesktop.tmp
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ButterflyOnDesktop.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
920	msedge.exe
920	msedge.exe
1460	identity_helper.exe
1460	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4748	butterflyondesktop.tmp
2824	ButterflyOnDesktop.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2824	ButterflyOnDesktop.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4748	2728	butterflyondesktop.exe	82
PID 2728 wrote to memory of 4748	2728	butterflyondesktop.exe	82
PID 2728 wrote to memory of 4748	2728	butterflyondesktop.exe	82
PID 4748 wrote to memory of 2824	4748	butterflyondesktop.tmp	100
PID 4748 wrote to memory of 2824	4748	butterflyondesktop.tmp	100
PID 4748 wrote to memory of 2824	4748	butterflyondesktop.tmp	100
PID 4748 wrote to memory of 920	4748	butterflyondesktop.tmp	101
PID 4748 wrote to memory of 920	4748	butterflyondesktop.tmp	101
PID 920 wrote to memory of 3308	920	msedge.exe	102
PID 920 wrote to memory of 3308	920	msedge.exe	102
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 5020	920	msedge.exe	103
PID 920 wrote to memory of 4976	920	msedge.exe	104
PID 920 wrote to memory of 4976	920	msedge.exe	104
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105
PID 920 wrote to memory of 3988	920	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\is-E078O.tmp\butterflyondesktop.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-E078O.tmp\butterflyondesktop.tmp" /SL5="$70240,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
    "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cefa46f8,0x7ff9cefa4708,0x7ff9cefa4718
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14725214279604143576,9973993843218618072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
      4⤵
      PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

Filesize
3.0MB

MD5
81aab57e0ef37ddff02d0106ced6b91e

SHA1
6e3895b350ef1545902bd23e7162dfce4c64e029

SHA256
a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

SHA512
a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
20KB

MD5
61aa8b462053d982fd7dcba3537f953f

SHA1
81c782098faad96056b75b115c3b8c53066726c1

SHA256
53c820ca7848acb86a45c299f00a007f160d4f5f8182431be6390e308f0510f8

SHA512
fa34bf0dd074afe1781b5404ef0511ffdcdbe3263d0aaffcc0fa2317a39fba4d3d6d06084a7185586a417fb43727473f84c1260bca78df56becc29c970ac8ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
a2824aa919c04d356579a3c36a1d7cf7

SHA1
4ca8674dcb03d30ea1a40ad50629c5f3586d6ad6

SHA256
b2b47a3d273f4a6b87966be4065083c8a186f78375f2f163ffc0445dc1587480

SHA512
e38a2539ff865eb19d2711037124fb4afb11dbb1dcc4ea959606a1c8bf00a3f8ef6a6204d305cce389566b6c0285cdae51603f761eb32ba030351212687f824b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
d21a2ae22d0f4b06110dac51f23c6ff8

SHA1
ace64a66baf8c3e33675ad629a7b84ac5e404607

SHA256
053a9484ce0d5b8af21d382a1e5a6fee750c8d591795f78434d7e82e840e87c2

SHA512
27215146c461cdbf4237d9bd5f52af96f3da7769eb20bf9e1941c157b321f1b6b681103a341831481960e2926abd4d2270b8c32b1430fcbaf85b24d01d29d2ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1001B

MD5
31b19ae5f10578cd1980f7dba84b1f50

SHA1
20f85039d4d10d04e5037f6a726193aa3fe31bb5

SHA256
8e2a7689904c3c271ba2055c85b6f1cb035f6154eb7301ea2fadd6c909ffb12c

SHA512
807465a8acb77e90f3abe2ecd65cf44b5fb66d435ed43f37df44cc038250d09ed6c213c3d6b182fc66362bdec82bcb7de10f21e27acaef2140203636b5b8a882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3bc37f65d2436b8f0db34b43859c2d82

SHA1
00fc75918025ef1662dbadb2d5c3cd9cee4b16ce

SHA256
ef502b8a3d01a7a098fbd45a1608b8ea5974ab993e9cf88f4687cd275ea341ff

SHA512
58c4e5252540a0b684a125dd2889840bce25e8a927712d952932cc275931482b003b723908de702a902bd7a82657b45e99aaedc718c52049476149425eef8eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5d311a1214f60f7f3a6f72980f8ec616

SHA1
3050fdf72fdd60345af5462413bb6feed5e233e9

SHA256
da5b09f576227c5685ad18b7fe5ac71339a6a00994f5af36cfe84d31a7230f51

SHA512
5033badc8597246333b68614054d9e85e726f98d625450465de55a1b5342241d9ed469c835081498e4e4e0c55d50d2f2c051b01bd591dd3e994b18a57197300c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5afe629d28755971ba8ac5cfbe39d8d3

SHA1
e0977a2b3856b54b34e124f9e2b080bb23844e54

SHA256
3e6b42c6d5e8f397feac1170cf6175c5b16649d0e7b2c2708d2f6bcb440d21b5

SHA512
26f949efa55636de49a94d3e95bfa8400d4a2cfc9b6a0b809d776ca79f0aa4b1e947aec1415dc785ed880952cc9bdabbf1f50ba735ffdd9c15b14e4466f4e7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d14845b03be65da95d782f509a8e342

SHA1
15a117cf7bbb9f5390ef84060baa7e136c465bdd

SHA256
ed8644ce540d3e2afa397e66d14e137ccd9cce9216b8d1e9883f8099f1067427

SHA512
ee496c3b56235662c6cb775d1988dea26b15bddc22d7628a35754ef6d6f4a721fee697ea58cf8cee18ede80da6fb68fa8a05db9136b19b551d4ad5a4ecb1d112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f0b67a6ebc1e36fab47ad1f614982d60

SHA1
241abd5bd84c9f51689739a2dea1622e1abb1d6b

SHA256
53536ace48cf2e69b8dbec75f2ac16f6e4eb9b77a2da6ac81d50fbb8856a605d

SHA512
793e7a1b099f36a1b50ac9e889c5528708052e8416b3412f03d07300b0919dba5320280766cb4b2734c08fa1ab32b6e1f50dd9730c6a8dab670148f4d48b37f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
c62dcf22857dcb5963c5bc546ea3bbdd

SHA1
01d860789d4d203792e493ec63fb570880549526

SHA256
093f7428688538ea0b8164e8fffa9b0bb7449c7e0941ea7e517af0728fea9977

SHA512
783b5863e8087852d65a17f71d671f421f2db62d635286aa67466746015a62791b1a1fb0b4996aa585a03e060190ab4a9f172118c8b2a2d0e7d2a7e6e4b57a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594b86.TMP

Filesize
539B

MD5
d58e5311690770b9a069bcc64daa2e28

SHA1
396f974927bc2b8cfbde15020b02f3966f1eadb3

SHA256
6886e56783c9331e4496b9c2fdfe897564039cb139c15a7dc2e2df32e3189f75

SHA512
0589fab1c358304693971368b8da743d42058899a2ab8039195fec045de4e4d90202114906f6b10c2e485ebaaae92e8fc30d20c1fe0111216c859183725a9ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7f445bd09ec6b5baa93d970b0ec8a057

SHA1
b377ed1ce61b8f19f2ca4f5257bbdb8d0f6960c4

SHA256
2d53f3ea564729696cee47e33e7a0554de7ccd57b8762d0ce5d5b889ad55b933

SHA512
dbbb12e9ed736806f21087afa1aa81c535b17cc10af46e1dfb5c9a0b7ccddc7bfb471c0b8bc9689d253fa834c30256b6af745bc3af4379a05414720bfe9f3746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
359948f5a80e04cb6898ce8cca49142f

SHA1
b2bd73e8fdb98f037d2dea34b882705edc9c4a39

SHA256
f424e02b07910b26690302d93a0b420aa45db641b30bad9e17c4f08305f9ec0e

SHA512
c8c7c85533712c11b743eb7416f828ad4f21c9dbc8d99711c08f66ad5930d4cd53e90938426e1a01bc755fbc6b89f24e4697ba04debdcdcc984e667cdde5bd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E078O.tmp\butterflyondesktop.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
memory/2728-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2728-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2728-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2728-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2824-166-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-164-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-165-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-132-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-177-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-131-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-251-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-417-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-416-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-41-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-149-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2824-418-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/4748-37-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4748-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4748-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4748-16-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4748-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4748-46-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download