4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2025, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Butterfly On Desktop.exe
Size 2.8MB
Sample250124-ej3emsykgy
SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
MD5 1535aa21451192109b86be9bcc7c4345
SHA1 1af211c686c4d4bf0239ed6620358a19691cf88c
SHA512 1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
SSDEEP 49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4812	Butterfly On Desktop.tmp
668	ButterflyOnDesktop.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	Butterfly On Desktop.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Butterfly on Desktop\is-GBJ4E.tmp	Butterfly On Desktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-82R44.tmp	Butterfly On Desktop.tmp
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	Butterfly On Desktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	Butterfly On Desktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-64FLE.tmp	Butterfly On Desktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-S93RI.tmp	Butterfly On Desktop.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Butterfly On Desktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Butterfly On Desktop.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ButterflyOnDesktop.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
376	msedge.exe
376	msedge.exe
1712	identity_helper.exe
1712	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4812	Butterfly On Desktop.tmp
668	ButterflyOnDesktop.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
668	ButterflyOnDesktop.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4812	2332	Butterfly On Desktop.exe	82
PID 2332 wrote to memory of 4812	2332	Butterfly On Desktop.exe	82
PID 2332 wrote to memory of 4812	2332	Butterfly On Desktop.exe	82
PID 4812 wrote to memory of 668	4812	Butterfly On Desktop.tmp	93
PID 4812 wrote to memory of 668	4812	Butterfly On Desktop.tmp	93
PID 4812 wrote to memory of 668	4812	Butterfly On Desktop.tmp	93
PID 4812 wrote to memory of 376	4812	Butterfly On Desktop.tmp	94
PID 4812 wrote to memory of 376	4812	Butterfly On Desktop.tmp	94
PID 376 wrote to memory of 4452	376	msedge.exe	95
PID 376 wrote to memory of 4452	376	msedge.exe	95
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 4372	376	msedge.exe	96
PID 376 wrote to memory of 2476	376	msedge.exe	97
PID 376 wrote to memory of 2476	376	msedge.exe	97
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98
PID 376 wrote to memory of 2432	376	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\Butterfly On Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\Butterfly On Desktop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\is-29HFR.tmp\Butterfly On Desktop.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-29HFR.tmp\Butterfly On Desktop.tmp" /SL5="$80236,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Butterfly On Desktop.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
    "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0x100,0x104,0x9c,0x108,0x7ffdb4d246f8,0x7ffdb4d24708,0x7ffdb4d24718
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9772044784226003291,13992729729182635646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ButterflyOnDesktop.exe

Path C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
Size 3.0MB
SHA256 a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
MD5 81aab57e0ef37ddff02d0106ced6b91e
SHA1 6e3895b350ef1545902bd23e7162dfce4c64e029
SHA512 a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717
SSDEEP 49152:mkRQiGnheuUYAOaTAwM9dhmk2D+5u3OUuHKGTNAtlfwuJ2AzX:mkSphFUBxgp2D+5DUuH3TNdw
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 9736e60a73122ffac79009725dacef71c84b500945771b35ed0bb56e5ca70426
MD5 314bd47f5d0554b7d4b29a4e6b90a0d8
SHA1 f9833ea78f6158ff33b4d41da9e19c4ea1755bf6
SHA512 61ecc8779b7d5453f04a1ddc0d077f6f7a1bd0703638410901da75ef18206afa1fa602496acd0dadf58c394cfb462b1ca7adce1abba82bd2e91542aa8cd9b778
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1002B
SHA256 04303d614cdcadb763dbb188a45eef2b612bf0503eea0eae8b15862b903b4c95
MD5 bf4babec4d1736f023a1878a2bd9a20c
SHA1 9c718fc6f1c940c5ea8db3343a4f19b495964c71
SHA512 30394426c7bda1c88b37bc8b6332347f4f64b051249f67050ef28b1d127612320e036acb59ebec5aedfbfcf536b0fb211d0b57ff4db4e61603120529a1606c62
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 25c4e064858eb168d29d90f792a7dcd0b58193524e53160a4a81734cedf7b15e
MD5 5ac7368d3ba637dbb16f1ec1c8c674e6
SHA1 0360f4ad641cb97f702b93e149ea6e0188469210
SHA512 268196da69b5df021aaa7daf0f658934ab43c635c53d88bafa313918cf12dc01204a5b0c7af72a80562fba4e15828cdfba8c3d9705c1c6b052ad214b11954246
SSDEEP 96:nHak2XV13ViSwpvWMoiVmde2NuS1PVRg6IbgGEzw2BjKTUWQyV+VD7AiEwb:nHak6V3ZGWMmNuS5Tg6kgGEzw2B4rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 645631cda708852079e95b694202157ccf091329c1eb7764458a582e0fb1e622
MD5 f25b9e2c02e4dd5237213b2fefde3880
SHA1 0ce6517666f2d25bc1c13263e28a53d7d6df6dfa
SHA512 6869aa975cf2d073d23db38aa73e0e9224d6eaaa7a510b052026df6fac284fc40122159740d58a6b8f39d26bd019427e925bd513eed8adc42d98badce966d7bd
SSDEEP 96:nHakAXV13ViSwpvWMoiVmdeHBjsTUWQyV+VDCziEwb:nHakMV3ZGWMXBero
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a59daeed68cbaf6b9fc095c2e4ba458e5cb0d16c9d3debad2106d0e75287ce9c
MD5 e346050204aa5b9b134e0ab2153cf71d
SHA1 8511791a9ff1361cabf65fbf6e427146eb3c1105
SHA512 bfdb7b3e0f642eb51719ee15eccdcf9f874a45c73d82265b8f6c82b11d7079cf90ecf8d084df1836752fd8b0e0785ecd13838b8b54e81076f5e1162f5eeb390a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWe2RUa/chKAi8wU8epwu:A9iIxuERzA83h09RZxY4DIXiPU8fu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Butterfly On Desktop.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-29HFR.tmp\Butterfly On Desktop.tmp
Size 688KB
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
SSDEEP 12288:YRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyc:yObekYkfohrP337uzHnA6cHswHE/6gU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/668-165-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-149-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-211-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-210-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-209-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-185-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-41-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-131-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-132-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-177-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-166-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/668-164-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2332-48-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2332-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2332-2-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/2332-13-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4812-16-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4812-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4812-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4812-37-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4812-46-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4812-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Download