6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

max time kernel
296s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
22/11/2025, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/butterflyondesktop.exe
Size 2.8MB
Sample251122-vb6ebsbk51
SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
MD5 1535aa21451192109b86be9bcc7c4345
SHA1 1af211c686c4d4bf0239ed6620358a19691cf88c
SHA512 1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
SSDEEP 49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3020	butterflyondesktop.tmp
2040	ButterflyOnDesktop.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Butterfly on Desktop\is-KKAHV.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-GNED7.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-9HSBP.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-OAFJS.tmp	butterflyondesktop.tmp
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1461219266\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_985556268\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1269043536\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1269043536\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_985556268\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1461219266\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1461219266\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1461219266\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_985556268\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1269043536\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_985556268\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1461219266\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1461219266\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1461219266\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_396321307\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_985556268\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_317639160\_locales\it\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ButterflyOnDesktop.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral18/memory/1920-1-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral18/memory/1920-15-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral18/memory/1920-46-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134083039690187905"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3261906842-2611857369-1513979305-1000\{11350043-7875-42EA-91FF-2C94CFDB02C2}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3261906842-2611857369-1513979305-1000\{124C9A39-4AAA-40D7-9ABF-49AC7B7113BF}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe
6120	msedge.exe
6120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3020	butterflyondesktop.tmp
2040	ButterflyOnDesktop.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2040	ButterflyOnDesktop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 3020	1920	butterflyondesktop.exe	78
PID 1920 wrote to memory of 3020	1920	butterflyondesktop.exe	78
PID 1920 wrote to memory of 3020	1920	butterflyondesktop.exe	78
PID 3020 wrote to memory of 2040	3020	butterflyondesktop.tmp	80
PID 3020 wrote to memory of 2040	3020	butterflyondesktop.tmp	80
PID 3020 wrote to memory of 2040	3020	butterflyondesktop.tmp	80
PID 3020 wrote to memory of 3384	3020	butterflyondesktop.tmp	81
PID 3020 wrote to memory of 3384	3020	butterflyondesktop.tmp	81
PID 3384 wrote to memory of 4344	3384	msedge.exe	82
PID 3384 wrote to memory of 4344	3384	msedge.exe	82
PID 3384 wrote to memory of 2496	3384	msedge.exe	83
PID 3384 wrote to memory of 2496	3384	msedge.exe	83
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 4660	3384	msedge.exe	84
PID 3384 wrote to memory of 1952	3384	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\is-966BB.tmp\butterflyondesktop.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-966BB.tmp\butterflyondesktop.tmp" /SL5="$80068,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
    "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ffc4921f208,0x7ffc4921f214,0x7ffc4921f220
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1752,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3416,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4828,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4928,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3516,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=3556,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5688,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5688,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5804,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5984,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:2936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5936,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6176,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=732,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6268,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6264,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5168,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=4080,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=5248,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6580,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5952,i,14864439618606574799,1958255897232665733,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffc4921f208,0x7ffc4921f214,0x7ffc4921f220
        5⤵
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
        5⤵
        
        PID:5636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
        5⤵
        
        PID:1496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1416,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
        5⤵
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4100,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
        5⤵
        
        PID:1132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4100,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
        5⤵
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3928,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
        5⤵
        
        PID:5656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4468,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
        5⤵
        
        PID:1704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4456,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
        5⤵
        
        PID:4604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4444,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
        5⤵
        
        PID:4796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4884,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
        5⤵
        
        PID:1332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4908,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
        5⤵
        
        PID:2372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4876,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
        5⤵
        
        PID:2780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3972,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
        5⤵
        
        PID:2224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5060,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4960,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4508,i,14203513051476475206,4943210637599781491,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
        5⤵
        
        PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ButterflyOnDesktop.exe

Path C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
Size 3.0MB
SHA256 a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
MD5 81aab57e0ef37ddff02d0106ced6b91e
SHA1 6e3895b350ef1545902bd23e7162dfce4c64e029
SHA512 a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717
SSDEEP 49152:mkRQiGnheuUYAOaTAwM9dhmk2D+5u3OUuHKGTNAtlfwuJ2AzX:mkSphFUBxgp2D+5DUuH3TNdw
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46b068803131dde1f37f26dc142050b6c4d6156360dedc038b1b9eca8bbc1dcc
MD5 5a7fddf7e1cf4bd45036aa1db1e479b6
SHA1 50ff440b022860bc5b0d43108a483893fd740da2
SHA512 f63e8ce5392cd9e90c8d4a7d5cafdd8fbb72d12e3f7c649997e7e75bfabc84a572ee27b241a3f6c19c477419ada23da85a7285868997dfea52f3ab24f31e5da7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 277e71e9ceb89201713d4002f33a073d080eacca63f8c91b3275c33ecf247e93
MD5 f99f26dbfaddbe188d0aa34c55bb0428
SHA1 61b471e4c5b0066224ed9b2ca6e3592aeecce041
SHA512 25b9c4f0bb88dff3c390df044dffd262bb0f499c00ebcd9d0f15d171bf312e2babc94e4172a0df46372107b15552cc8dadc3210866c27ba9a0f06626d4386b8a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecb16d5a92f55006ef7ee37ed705ba08c1a3647f595999eaeedf5e7e9c981996
MD5 549b3f4d463f75fc7a59b5e583e95770
SHA1 b42e93e086fc8d0121a814aa1b0905be1368aea1
SHA512 9bcb41a3aec4faea38e213de4e29f914530d66857581f4acc21eb0d54aca03df5278da8b868c42f69d3511f7930c3dc98330315caadf53db26784472a3ab1a8c
MD5 SHA1 SHA512

Submit Download

1f7ff8d8-b247-4be1-bdd8-871ba2c1c6e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f7ff8d8-b247-4be1-bdd8-871ba2c1c6e9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 83609ee1ba7999134974f08b632748161ebb9c8f83ef32a9899562e88e925dab
MD5 2bcbf629dbde924c242049d1ca7f4f2f
SHA1 3efc5712a8227463f25efc52d844ad2d69f14175
SHA512 a8a5f818afaf2a958090ef35e409b9e50bd8c750bc02deb4df16b054efa88c0b90229ccb179bc370affb73e0bc9ce3ec1e801fa3b67f18eeae6868c1daec7b0a
SSDEEP 384:PrO6jVluKl80G+jw5vkfYQKpwmjpNroSL+Bsnk6Z/DgPs:z9Ll807jw5vMcwmXkS/k6ZrgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 431a0cc050d3dae2214af3d50a3f49bb1c070247d9c0ced8012e78eeecd39691
MD5 30f3fba07b78aa3470b70051a472df2f
SHA1 0b6b696e424378d9b73508d2c19a7b4e308055ca
SHA512 d4651c2852fcbfc31c46a74242b2ab9bef478d7e7c2aad305cb27cc115354500d4c589e1a5db2b893d4a110742dba9e33c8c1a863f9f5d4692adfe79ee6d6262
SSDEEP 1536:Bk4xyPw5g5nmmR+w+i75/D/mPAcK+kx8Wtj1AAU6JTDNQUKKoIgQ0LnKLvnM0Vvm:Uj8ytpxrTNQUJqnTf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 1db3d563d96372e7a87816a45458010d8b83f42ba4e9b0006bc1279faf6a28dc
MD5 6653924ac91a9979482bd95bb42013a8
SHA1 4d98764138c533bce1841f696bc818bbe0dfdddc
SHA512 b706821ab0baa51477c8313fcd2d5e5e78b0774d61c5ffdd8c5be38c7961ead9316f97c2be5b6494ef9d5d53e8a65468cece6584cc6f5056a6bb33d71e211f84
SSDEEP 6144:HC5NHMCDp1FW8MVdk9VEOlKeo79IZAZlucJ9sK:i5NsCbFWrdk3lKew9IZAZlucw
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ae889f73fb2407074c40ba6ff76735f3ce83712f3616b9d561dc6532c5e2a1ab
MD5 c641325a2f059a707a5ae1dd500159df
SHA1 e15f81c95b4905307529ad40adc7cc6a8f40fa26
SHA512 bc3131f345b9a967d84c84e0fcf17b338818961d433f065b4272de9025a1258c6d12a0e0a0d7336260328d968f8b6f2321453b0ea4bb81d7c3d86aaa320eeba7
SSDEEP 24576:gEhr6f6Gz3euBUYmqrp2i/det/Dkfxsu5ZlLTUHwr2UrFGHbm9mm6QoXlkUd8hE/:gE9GzXmq2iVYDK15XxrB39mm68U
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 30KB
SHA256 7694cefb5af91fa4ca7f915e59ef6c12c93b16f164b959a0740788312adfb118
MD5 db08152145f21fadc89c29e63038a4b1
SHA1 ad4dbda5cb724414ae8e3f2f0c476394317ca249
SHA512 6dce5904c77b2a5c0621ce2c0aacf7102ebce77ebef8b2c1fc59c41be3ac2bf64536718b8a1c07326f9d80666e44a70b382f289df7ec604853cfc69f73ef8cc6
SSDEEP 768:ks3Xjg7GJSZUaxzlHiAZaCWK85zKx+/chp8KA4jTQAFbm:kwg7RZUaVzqdgSchpAiQIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 16KB
SHA256 4635d13be3ce718b407d72a4da6413f18321d34aaa91dcbac14e3b9cd4d19961
MD5 69a850972c7d424e410608664a163fd2
SHA1 d19d8b80c36bc6b1a8f70f63a54a5e15d60544c4
SHA512 bcecf2c4fb981f9bc3cf73c89ca593c051cca8e76aaa0ad21f2233403fdd36a3c1c3f05f350cfc360a92ea353b31edb7433f78f82ad17299a17c13fd805f0ccc
SSDEEP 384:MZVhcpNSj8LmJf3Dz0ho2hnQZooXnxI8lE4UPvc4l:Yh0Nq8LMTz0+2hnmaZdHc4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 41KB
SHA256 474ef6f98193d29e81a73d37f6785ec393de0ef6fbe927f3b28ffff2eb3b5e86
MD5 802dc3898e04813167ef270f1adf3c55
SHA1 03885da2d6b4a83b619c797a8d48f6288cc79cf6
SHA512 d14fcc1613c9f2757a7b2953c478fa44a4ee21a41b40bda5ac47b417f1062f00f179c5dbaf7ed4a6df0f90451c67e6216bf6ee884c5e0cb06e5f27cc70607749
SSDEEP 768:weFKuuCQowxbVLItdEhaK/+YKOR0KDkQ04smPTpnW1eJ+KlAACu:XK9Gaq/kuORRoG7pWc+ACu
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 16KB
SHA256 7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d
MD5 01d5892e6e243b52998310c2925b9f3a
SHA1 58180151b6a6ee4af73583a214b68efb9e8844d4
SHA512 de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319
SSDEEP 384:MGx2krkLfYLu1yss2Hi3o0AkVAAdIa1pBz8OMD1:Px2k4LYi1pH4o0AkVj1z8OY1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 54KB
SHA256 9e5c3e33f76e255ae9bf8cb7572529a9b9cb9cab2d20816d7101a9af6590a08d
MD5 dc741b46f7b336b26cf0ac3a8098704b
SHA1 bd8e4f1f8beaf114412f88a7cb28c43d33c5aa15
SHA512 831819ea705e69f67acd49ec3d456f01e01e068603a553bec0c01ed77daa85ef09ca8c83bb0eb73c161a4e5f973725d3d08411a7bfed62c0c1fd5fb690eae92f
SSDEEP 1536:3Md8t9Jbhr7ciXiHAL174/Vssj3fnF0PY7tNqpCX:3Ft9JdH8/SsjPF0sN1X
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 166KB
SHA256 998477dd68965219e12b355a1e4abd538f1c9f021f83e4a76d9338c7f513f76c
MD5 111c284b06768fbb7fcb78180204fe03
SHA1 62319f4b663ec1399cf22483630b348e2bba5cad
SHA512 af1d2991b202fcbaf55505fe316142cc0711b8c9cf0c2d82c8c738ade083eccbb6e93d8222ef610ea476de64b576b7346fd57ade3db3056af28f0972ed6b1fd4
SSDEEP 3072:fqmFmgKdSdS2XlQiA9SKntUkN/Tyfzsn3QMZpDWNAcWcLROmFehY1MOzMk3kN:ym4gKdgXlQiA9SurN/TKsxZFWNAcWtmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 74KB
SHA256 5f05ac34cc318df2f546080fb733ed6dc3ecca5388686f6d16ce8f9c515744fd
MD5 d5f928cf9038792db2b3d51a75a52009
SHA1 87c450c9056c94146ab58ac24cc7eb61f50638d0
SHA512 5e34ade24ba157053939429db05b09df6f24f2ee9cfce770f0a9d77e0504147dac963c50d76561e0c5f80f311c64d0374163e2fefd0d84a029907a3cd1d62c92
SSDEEP 1536:ah0oWtf2/0iBoEhON2b9JfdJ9LovfawNcFXNd1b:ah0Pu/T0NAV/LMfaWYX5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 47KB
SHA256 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
MD5 015c126a3520c9a8f6a27979d0266e96
SHA1 2acf956561d44434a6d84204670cf849d3215d5f
SHA512 02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c
SSDEEP 768:uj6JxavgLx5rjTH3CdZ3y11o4uMb2IVEhiB6z6GAAHJApICtBgso6HaOjTXHRWK:ujoa4LxZPCdm3B2IVEhiB62apApISxos
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 29KB
SHA256 3092ed21a077656ebaf331dd3a2404336ba7aecc29f74bb49506d1cb905b2144
MD5 ef4af3c62d2e4ee270c2558e5f22117b
SHA1 c0ffa5a685eeb067e3dbfa25a2c66f7af2ba3dc6
SHA512 02b68ba6c14a94b044a4362a4a5a88d591552b330c3519fb365d937b4a31b24c72c1d1119da46c4851a0eb15c279bf237c3890c49dace4a409aeb4a13244572e
SSDEEP 768:fJXo4LhGd5dQxY7kPUvByjZZp0RHa6pwNCg1nek:i4LYdQNCB6Mk6pwIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 139KB
SHA256 ed2c5df8e65b89754e45c3f31e023aae421d9688e83ed2aa217f8b214e81a7f3
MD5 e7b72a08f52858227624b83867e31594
SHA1 518bad2c1818ff7bdfaad1b4bedd645ba2f9311f
SHA512 f96da03865c45b1ca2d9a77e7d25e9cc770e4f3bab1a1c6ac63dac69f52d5a9e6c2520e72e7b4c5bb102ee1f5c918704ea97c76525c38f7845fc24c28809a250
SSDEEP 3072:35w03HXrf6/JK7TDewEJmGuIblxFrQ9hyqrOxS1BW9NtGIUZ3i:pnHOJtPblxJy9vBuNs3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 49KB
SHA256 d24ee65ac2cb251ebe44eb535934b88c4cf40b4eaf87fd66a81c472eb258bb6c
MD5 df9def3ce31872466b056ac18f3ec7be
SHA1 eea7bee2007b89128d9e57a5bcb0ba7127f5c586
SHA512 4c0dcdec7133455a29b5a9ad14f5b007fa56b832f8e06ee47aedb585dff3475d30dd061942a596f6c7f745f06af8bbe486066ce804249b6acc96f56452771be1
SSDEEP 1536:KeBYfyUxqF0Xf0X0Oe+5nYBt9Ddf46NGuGhHIa:vVUEhX0OeZt9DddGuG1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 89KB
SHA256 0bc5332d2239683b72b578d6152a735fed3e7b6531e74c6a34d3ea6e8c3ab311
MD5 769fbc38ade5be3e12cdddb37d679775
SHA1 3715ce544bd562e899a7555b350796ed214a912f
SHA512 a969b1c53e8f723a822eff03cee00c9130742efee7e676b9ac142fa4f01648f1c3cfebc5364f34392d5297d3c88c74b4a6429c3ed68ead32148faf01916434a3
SSDEEP 1536:ee3p1DD/mHVCehK/aCRHIKFLcthkKaqCQ69a4wQyNkGrxPBB5YRGKDQs:1T61nhKSsNLcthkKCQGLyNkGrF1s
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 69KB
SHA256 bd4331d9e575cd8856428001a7a4f3cdf4354549e6453e0b65e92cb16a877524
MD5 c33055bfdb39bc81cc82b60663c718c2
SHA1 39de4294670a88c4cf656bc2362bdf58f0a0a1cb
SHA512 51fb602a7414f368d222c2dc468a9740b961b84d45a8ac1d7b5afff34e05c8a3221bae5b7cff328af5d566b47a268ca38da232cdc4909fc1f8cd13f493b3edcc
SSDEEP 1536:TTGYnfwciSKSQSICqgxFYasw6DKIisiKBaa26YiCH1h+lsGr4tJIo1:rwcNzPxWwStivKB26YiOAR4tJIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 20KB
SHA256 53f5d2cc2a9bcd623e43fabfd4361ed6a5e49cd1065f885348b8d993ba5fde0e
MD5 fb62909cfa7dfa42957caf2e3215d2ad
SHA1 de3004266122119f52138ec24d254d63510bc46f
SHA512 7ec16fa8ea757cf33543bb777a9412363a699f6f2520e9680b4e817ac8d881a78af8b2354472b66b6b96d2c36ebde960093c55879ff06b46158d717d0a42d848
SSDEEP 384:A1gPEv5rpDULaZ7z1N4Ey2FIEJWjfk3KerLZGnQMTvEkMUWTv+hUmrMK:LPEh1DULmXD4EfnJWjMT1GnQQENf7uU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 41KB
SHA256 580f51668e68bc6c3e210e7c9587936a15e0959774c4c0cec84dbe5f3e4fe84c
MD5 0690f38db428b1adea8d421df26776f3
SHA1 2e0ecd44a1e280efb06a0cfdf70a908d06da68d8
SHA512 d015466c1b3544308dffad0063128945971128e0c87c095fabb2a2fae73bbc3228a7dd51bd95a31d930d5a81a8fedfd0f5d68a2e6427121a5a274683941c9ac6
SSDEEP 768:+ybO82IXY6fjmppTnAzp5mijaTXD5brkKUifmtM6p52Wtw6QKDLXSbXDpeThqX2q:+/8MsCHTAzpFjK5bSXp5Ttw6QK3XSrDp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 41KB
SHA256 d964bade97be377e07f6de651e0027e3031424a04c522b85927c0b6ff112e7b2
MD5 660c8c275bc63b8928b6100a9a233473
SHA1 0292a46f1dc1dcb720006a9a948b6d20f1bfd009
SHA512 cd5591e9e72a5eb0b4586d2153adc0613cefd56eacc93c3b20f0e021c095ef7da61fe3aca93e261ff5d1cf16a1c3d1eb8037f77ad89049f3f4566101347045e8
SSDEEP 768:1OvRKF8xykL9ZAHTJViZABe9s8D0unLLPUK8qUA/QgFvx/hUCDw6Ow206IyJ0iQs:k5K+j4VrktD0unLL1/QYvUCDZj206nd
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 68KB
SHA256 8aa268dc70e783f8b1e63c9af175d31e1ebaffff418f6100262d7b3a386d7a14
MD5 00eb31fd5594b0e13d783427130fa48e
SHA1 39e24af74ef1ab48c68040525b419bccde513fdc
SHA512 95d03a6af20af511df18c1ebfeb926b3a04a8b39f56bada6c91db72c946d32c77c280a828fcef9ad491f6c8c6052cb96d7ce8cf71f6bfc743933123eb5087815
SSDEEP 1536:Mdi1MYreQhnQncTYBUDCnILADKZr2tQHyejsqYHT0c2xVJ3u4p8x1ew:M0S0gnPDK3HLspHT0Fxr3uewew
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 21KB
SHA256 8aa82c5ca6cd5a1ea574c57431a6576fe11ebbce1452133080b5d64c1c8e15d5
MD5 dc090df9ebf2c0f757ec8ebd8c27991f
SHA1 3d79c2be12ee25de2daddca348e4281d84169316
SHA512 0632569391abb437ee3bea19876bcecf8a07fda0bb1dc18619b65f4f662902adead79bd9be95e98326bc573d19c097784ac69fa2b5cf6dc14bc2e57244857d65
SSDEEP 384:Ss8Y3Dj8NMC3k+ZBzvhqGA1D2QDzURKRGxi2GgNxhxgIg178ty0NoLl2H73Cw70L:SYaZ3F3cYKMxi7g9WI+7aNil2H73C9O4
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 83KB
SHA256 367cf7d2562aae0ef6136bd2de89ad3230ac335ef501b3cb23678a41827b59b8
MD5 a57ffc034f88453dae4d7be2f5d4d9ba
SHA1 507a9469256d54b15a4f430aded43ab812ff15cb
SHA512 c185ce761b6e800541a60f47f94daa8bceca795d502a641b60f0bc6fabd4293e31e7e9eac4c8e56c6f5f07a11c4e129cdb97aff3fbda86f7122b51249f0f3631
SSDEEP 1536:wJdRxseHk96rT0ZFrtx6DfE9Ylzfc6gfR9oxJIdOcgsSVH9XbThQLAZp4W2HJP:wHRaF6r9Eozn8RyJTc5SVHdbThBZ12B
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 63KB
SHA256 4251be475051f4b763056038b4c15c48b9f749245e7ccc0d95a00dba0cb38a58
MD5 e86108928062fe20b25bd7af5aa11bb3
SHA1 344643354c47bdecc6f7bf114cbd4131467db28d
SHA512 26b69f79b6c4e1c9279d1d155063a4893a1a019d17b9420194d8725c834c2ae67f01d9f972df1dbe88fe3dbf63700c0189ace647a5afabf452b6ea9d9393a52f
SSDEEP 1536:nDfSWLnaTGhvSeFdVthJptG2d63mBex6TtKOfon/kIAo:D/LaTGh6c1pA2d63YkrOfon/kIL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 22KB
SHA256 534d6ba8455f4511cc0634d819ee19b35cc771f802dcbab9d2817be0c2a93ad1
MD5 baf8dc12d0df9d43ed3c300fc74c8066
SHA1 3b695acc657260f3d84256284e0b91b0315afad8
SHA512 1acf55c4a8d1d17fd92c2983e3de02d8351acd4bed80217daf97741bc108933920cfe03008e9f105dea18cfc74c383cbd4171aa8ae106c47ce6048930dd55eec
SSDEEP 384:GbjrNbFZh79d27S+b0x2jBoGMNYSuTxhEry7RjpREUBO/j04CxaRutvafkyQnclF:6R79d2RbzjBXMSTxuxQa6QkyYcl5Cw
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 21KB
SHA256 c3f8c3da4430d08cda67d76bb22d139eb22bc7f85fb703e2121163dd2ffac787
MD5 9f69c29ae87e4f66a6d4af08393ad5ce
SHA1 6907f618b8ffb57910434b99d0c2cacd826442c9
SHA512 e9ad138e598e95a4ca6cef01b14ea8459076a9fe6c84b1db4902c8893a499f55323ffd00673971158ed031f725439b07c2165862ee6f8d38a9a0c1cc51e957c6
SSDEEP 384:82KjdxJ00LlUZK0liA97m64/pGls/EA0YNR20n4fnl3C59Xr:MnJ00u7997o/cdAvNR9n4/G7
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 370f827384aaf4a9b77732a2cb54cfc1cc4cbb7cde008fcceb3abf7fc5775302
MD5 c9f3ae75f30188d42fae853017e92532
SHA1 47a68d95df3845bd2d3f242cc77fe992e2d36615
SHA512 37f18280c99c857a3c9e813391a7f8ecd588638bc8118b70f71310810690b2dce31708aa34ddf3fc8b1b06b5c35ba550483052f2ef58c25f47fc77c8aad329ed
SSDEEP 48:IEO2hVwAGWk5qeaamtD0cKXFgpswO5qlJaXrzFFzoNQSlkU2+:/TK5WzeaamjYgpswOQSr03p2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0692eddc3d1bb55e3e20a6450e98e4dee4947e3f7a29a043e1ec0779e930e8d2
MD5 14a798c4c322ef9077606069687f42c1
SHA1 9c6b799f7601f7e82059782145fb7644ffe8ca5b
SHA512 fab9c984fb3f4a77409ad5086bd8615160e7060c1b795431f635a978a22b795053c147b0d56a2d272692a29489a1ac85d9c7156605b17f340d1aae115d27333b
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58a553.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a553.TMP
Size 3KB
SHA256 41dde1bb8f09bce5e705ed2d20055a5726a20eec2291362ebdad48ba18c3a615
MD5 70e64950f3b4943155a8c8fe4566143b
SHA1 91819c32cd321704f5845b4941879bdd362d1da3
SHA512 cec22ccc8f7c4a0c7bc305a1b6ff046e26674e7fb35890dfb77834b8a9b2904f250811778a8ebf5332a59e0d50d3ae53f6b7c32fa9f4ab7b9c4986f5fe5ddaa6
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 4adc74389eb57b226f666264402f684ec75a63715f2d342b58878b546d8c0862
MD5 28900f474fe8777563fd1e6df4acca5e
SHA1 6be94b3e7d1cdf598c2debce249d8215fc17acb6
SHA512 f1145161bca6a0260b996f6276de74c2d8bf046a11acca7dc895c94c58d54e2b81ada5f6b7d65f117a2cfe06e823216484f4937fbb7962a57382be4277ba1d8e
SSDEEP 192:DkmbJDaWTwebNWJIEjQJbJoJFuuj6xBJpq4GTeAXPMnGHqRAGyY0PCLPtaWAP1OP:DkmNDaWTwebNeIEjcbJoJFuuGxBJpq4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 9d76388283042fa6f5648ad1c1d28560f7275b716f9ccdc861f3d3af4e44c4ec
MD5 2c467a20dfb2a0c8c7bdb8f652d02365
SHA1 999aaad5db76b222a344f336d8f7136199a90be1
SHA512 f17e52d2ede6b7df1881e90a92de18904e84b5513c14d396bef31ebf66bab7978598a4cb8e34394cf428c898e4fbe12f6490fe9415ec4e53a27cf58a715147d0
SSDEEP 192:DrP9JVgjE1e8Ruuj6xBJpq4GTe2kMXPMnGHqRAGyY0PCLPtaWAP1Od:DrPLVgjE1e8RuuGxBJpq4GTe2kMX0GK3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 902eacfcff4482113ea2062393e0e58d18ff51d757f1b120d4dafbf970ca8425
MD5 c2c48cc569811e5de49f3103ee9552fc
SHA1 5942d75d4aefed8914406598fe42d9c076cbd030
SHA512 b5b60115da5e16f662cea28559970a392b89f881c7888661a5e1ded8e16ddd2a6a8719d664227e6993d4826475537c03b7b7689614f8669829bddcfb6d77371c
SSDEEP 192:DrP9JVgjEHemM9JjPC1J0J/Ruuj6xBJpq4GTe2OXPMnGHqRAGyY0PCLPtaWAPqdI:DrPLVgjEHemMLjPCD0J/RuuGxBJpq4Ge
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 8e4d933f4f53b7be2e8a61ececc1296abd17522041d83da925fbd771d19c8800
MD5 bc1012515545ce8fb05a570e226f53c1
SHA1 b104326de657ab61c3c12035556df30a3ffad31a
SHA512 50ed91d8d6b2942dea28319a0253fcdacdb9e699d3b3ceb28b5b93cb43643e633035dd0c6257c428429ed40f95adca1fe5ac03d3d3341711cb35afdbdd67090c
SSDEEP 384:sVQnWTjpdsPWcF+EPJvYva/PMJVvQPj/hk7hZF:s0WBSzlPOC/PYvQb/hk7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 2f72240172b7991d20a183a397a57e2b70db42e5aead262ad9778237698e43ca
MD5 801d27d4f70bfd6fbd7e0e133408db53
SHA1 159991c16731f1a020afb23f6d7125ca4d054ef5
SHA512 0588d211cf01319af335e3bd11eec88e3988f611411d9b4709f1f3b55a538a19a7620c3f0ac8e8075114a3734f05f8d93552c3cf49c7d5d9963d01ceaf6d0d05
SSDEEP 192:sVOQUnWRLyMqv/K1hl8M3pbRsuvmE3fxh9aAgQozzpoZ8pTot/xz+WNtfYAqLmVv:sVQnWTPpdsu+E3JvYva/P5TVBrhk75ZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 d204177f5bd2b4375f16ea4c57c81411979b4f433aa2c243381c65ab679e54cb
MD5 03740b29335acc6d04a108d0a9559e85
SHA1 06e56eea1cecf5f20948abd5add5a92cdd140bcd
SHA512 001d717fd51cd992b6adcf6f6565ba2d0d720881b742ac7ef91b06c2ea492dae6f64bd2caef24cb22071d2a50d5840b868328020240325ae1dd9e9ff0f14bbe6
SSDEEP 768:KXHuZ84t26E7pL5LZrMWRWY0Qgo8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3/OO3LLp:KXHuZ84t26IVZrMWRWY0Qgou1jaK/OOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 9f7ad8671e01d96645896455b1b8b9528edce9ea5c2037a2964cfa7a6994f901
MD5 09432c8eab3d860b790945ad52bd2fb7
SHA1 c7f33be1a974430da84f8e7fbe8cecc0efd7faa8
SHA512 7de36ad1db20abc4ca52ee8c61424eeea294dc3c19c8201124efb8fba8ba2d2f77c6c3b874fc2e2478d8d2567877df29f1689938d7fb9d9663ad77b22d2faa13
SSDEEP 768:KXHuZ84t26E7pL5LZrMWRWY0Q0o8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3/OO3LLe:KXHuZ84t26IVZrMWRWY0Q0ou1jaK/OOe
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 d265ac1c76acad1d52e9c7d91cda0229443e9923b4aa8cc62a6e5a2286b1769b
MD5 85fbb4c806d9ad38ab09098af7815824
SHA1 0768945fad293a1d5ea024c14a96a67f24a2fb06
SHA512 9a8b87983bf61281acda2118840c71529061af7957d64b45a0eb124fc3dac9093272911b518511811f6ad84ffd16fa8981087ae33d5d61057d6b5c52ccc9a58b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 7363a1e5eb9e4c2ed48e8c5d822aad6b28473414765385f26a014d3a32f062f9
MD5 d247c064cf39ded68fdf96483ef6acfc
SHA1 9469cef500a9c0ae3123f471ae503349ad7b3a2b
SHA512 14d3a02ed6db2fe77e1be79a756ffb41d16fc793842b7ec5dc0b9785ceb220173f2a45a1c36314b0ee9333930bee781b13eac2729bb1957dcca3181f73d3f71c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 75f408aeac20b6c80b39fdb75fa9cbbfd970f412a3001c89ab1bb9d71c3f5b5d
MD5 2f3376220248344ac33de428fa6202af
SHA1 73889f6900ae27b6dfadc9dc500e73d3649a798c
SHA512 d5b25e0de139c676ac054b09c56a7f2ee37defb7f02a4f248fe51898bb72390ff022695e4b04158ec750c45549ff4f8f216a91035c92c168ac1ddcf56a715102
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 2cba8502dfc2ab4da36692d30886fa146e87a5f54f3daf364f37170843b3dba8
MD5 c79e69d1ce64c36ddfd02b296c3ccbcf
SHA1 1f74e470b98a335697ed8d6c75b8fa5b1c5a2cca
SHA512 f29af29e5dc90803bfe11986b24a9a6dea40096fed2c08b05240ca309b271ecf98d135fd179f908b0555e2155a8d7213cc158a7a9a441b7afff5e45d1791176c
SSDEEP 96:dvKP2QKMmKF2aKSYKlSlKxKKZcUF2aUGmxH632ixKVq0Efi9AFKbqHKzTKXGsK87:GN/bcUF2aUGmR632iIq0Efi9zAI7ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 462B
SHA256 9e6de8086b09b399f424de54601e0ecb08fc4f1c5cbbda72709efba96f71fecb
MD5 8be927bb19b6c0b5e071cdbf1f509d9e
SHA1 a24d1175175071e404cf3ee6a2c95901308bfa1b
SHA512 e81e377b013e7e1ff105176962275b1f56d1de1ee93784e973ef29a0cfdc754deaec9e171176666a82c68b8a344bfe706c4bd320543748db6ea43930721270b2
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 466B
SHA256 9218d1f970483758bf4fdbee7fdc845d1c7b0141a6e1a5d7c9e4c0e3c2a82461
MD5 287b1d7edbbf9ff48329ac258288ac0b
SHA1 3db0254b28565fbd0c0266695e53a6b09a54dc47
SHA512 d0ef0a80630c059551c1e8552f1396a8e5ec29e586da40b258513bcb741f88e3fc856d434e70e5aff9e20f99b51fad6d9188bb70a8e92978ca6b1988aaa3fdbc
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4d1df4427a1027bde47b9cb09e249fa7b1d65ec5e186e79cc085fd0c9e2ea05f
MD5 adc00d0676e857323ddd86bef772bf82
SHA1 68eb94aa892c77a3a2066a5a1f2d0b5f399325e5
SHA512 bd5518f9882143ccdd75ed766bc29fea937bc110af637aeda419d024d7b322701f18069d21e6942bc2aacaaee2130f7a0723490e6609ee89c43e25cb7e088b1b
SSDEEP 768:qFZYfJSJLdOuDwLAP/CgF99xyg/DHn52KsKfE9Gx+rpocB1Jfw6:cYfEhOu7Z/FsKpxwlf3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f312f35edcc80f5e68f25bf8170b333dac4005ba96f608b1a952fdc36dbcad5e
MD5 80c81da7b9549a66412bb5d36f5d0075
SHA1 10a5e765b445d9092f68c312086883c10438fd11
SHA512 92ca8d4308c304e32cfcc756316aa1c7ddaefad779d9a51f2135185fcb88554acf2c0cdb653f79e535f2576ba9638597f68fb5c0962d60b75e87696dc09f6003
SSDEEP 768:/FhYfJSJLdOuDwLAo/CgFI9xyJDHnJimbPy1mojBr3j4ocB1Jfwo:XYfEhOucVtJOPjFjWlf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 8dd897b130524cfa243e903985de120182f7153a4f1a93981a0517e8723e7c83
MD5 b30fb09f13c5f82c5e2464da2c6e6db0
SHA1 a0eef9a6667eade5a2feeaab85dccc447ee9e0b3
SHA512 2ab40e22bec7b76993b065b84ff1d987fdb9c110c81317f474a5563f0e8893b87817bac4e2587bfeb959003a3a5e0cf9501d83f4dd2d5550799844eda9293e2a
SSDEEP 768:IFhYfJSJLdOuDwLA2/CgFo9xyJDHnJimbPy1SojBr3j4ocB1Jfwo:sYfEhOuyRtJObjFjWlf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 d720546b11c1b01b087f791b5cbf15f08ba4e3f66a472350c08479de54e625ac
MD5 705d60a33983accdf39fdfbd86565dfa
SHA1 e96d5ad293e27828f5500d62f7d1b7eded75d2cb
SHA512 6e45f8f7413e49a903135aa646164a367219cee15045d8b030acb5b5ed4fcd51f8f08857c0cb4a9b43cb468b8c13555357a0d0f2931a02d036497e125adaa1f0
SSDEEP 768:IFZYfJSJLdOuDwLAP/CgFw9xyg/DHnJimbPy1Sh+XXqvb4uWscBr3j4ocB1Jfwo:GYfEhOu7E/tJOvXgMhXFjWlf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 fc1405bd297c0894654e377365218ec1960e84965313e8b438a92b7c1132be13
MD5 de95ae5877bd8c2d50cc594d203102a2
SHA1 7faf7f253d1dd5ff891ff3d42946146176e27146
SHA512 6170f1a4f5c71a95241a754a57a131509457cebdadf9b5faeb2fa2802fd24cefe1b624545444f2f9a97e02fc3a9c158120318d6554a8c48ee5caaa8ddefcf227
SSDEEP 768:IFZYfJSJLdOuDwLAP/CgF79xyg/DHnJimbPy1Sh+XXqvb4uWscBr3j4ocB1Jfwo:GYfEhOu77/tJOvXgMhXFjWlf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 12b60db6c2355052c569c41fff447ee72c05e26865ec30505de8b9383c40d23b
MD5 a97d4fb95adba40983e0adea85bc4219
SHA1 d9c72c39d9aa01614779dfe6425d06e054044ee9
SHA512 db1183b718022ac5d88f7ac361189f24ea87d2ddffc346eab4497441b0266a65688b0e9b1ee84482400a97e7eff819c7df9334b486993f00580283fe00f80a52
SSDEEP 768:/F6YfJSJLdOuDwLAo/CgFR9xyJDHnJimbPy1mojBr3j4ocB1Jfwo:MYfEhOucKtJOPjFjWlf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1b3be97a7bc30cb6aa34a32933ba16b72b1756c4aa6c6acc1f54d50cc46918ba
MD5 5b4c1182c0d29cd14030cad36cb397b4
SHA1 38cbdd55f04a86385cf99723095bdadb19bd70b5
SHA512 ced85069aacafd8fa586236c006b2e4b9a289d7867bad276034cb5ea43d5c3369b74b348328b240da3cbc6fc6e435a44059eebc105c2e4e41c0075c5f4b53103
SSDEEP 768:JF5BLv7I5wCPFdV6Zi63UCgU/cxyJDHnJimbPy1mojfocB1JfXjJ:BJUV6ZL31tJOPjNlfXjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4447d962e8fd04b69589aa3801348df4b201007bc10d0e3ac7a3ee272ebb28b9
MD5 a20260b3838b1a5fc82d784b8d3f44a6
SHA1 6c0d4425956ccf4cc5f054e159f45075b42ffd65
SHA512 534be3c6d2999f83b8852dc20e6c304eacccb0055784cd92e32dd388cb9ac8796e34a7a5bc3d32f6cca238cd3eca2b7648a935c2133e2e6ed25eee3045c3e558
SSDEEP 768:oF5BLv7I5wCPFdV6Zi63UCgUFy9xyJDHnUvvjuRO5ocB1JfXjJ:gJUV6ZL3HjGjqOLlfXjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 101c5e1db72b5646271b5a93200f71bd9a1756ab384e3ad0bc2647fe76f17026
MD5 07f6afed5571f581538b8d4f9b03b954
SHA1 5ef486c345b4acbc2c8cb3916f3fa99b4d4318f7
SHA512 8e9676138480ac69bcf230326563df5c8a4a23693042dfc5155c3075c6ec8ac9b390a848a2ef84e1abdb8096bda93bf53d0c31eb10a18b403a46cdf4f39d99d2
SSDEEP 768:/FqYfJSJLdOuDwLAo/CgFR9xyJDHnJimbPy1mojBr3j4ocB1Jfwo:gYfEhOucKtJOPjFjWlf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\28.0.0.1\crs.pb
Size 251KB
SHA256 576d77d3085ff9156298e60dee868364cabab7911edf6f9a4d3ad5f351d5059f
MD5 3ef7a7be0ecfef355a5d5d6e77ebddfd
SHA1 5c6e47340a710019b97b1fd58624f714420b79f1
SHA512 812f5a4e1f572b7a012add71bc210281fd362f48ba5a863b2e5a7d7b6405dd08632dc39ce650a0d032f926d1e41acd8f1c84d5b60552ad9ac98ad6d2abb7f265
SSDEEP 6144:q6ik4li77VpRldVW+J2i/P66k8LyST+uUX:q6XnVpRN2GZQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\28.0.0.1\ct_config.pb
Size 12KB
SHA256 b42799f862739fed511f2527d4796690e23014ecdc02489074df4c44c60f272d
MD5 b83d9c00b73ffd5b6945370fee4bdb26
SHA1 dc5e7ab71b439abe18cde2c4309ef4452220d0de
SHA512 fff0baa29fcb0253be4f916dd6fde7efdf6b20c49c851e4ff6a027b055a7a48a8dbb74827d55b525c3b1e7e53e27f84e2563f8cb5b7092911d651f4cdbb967ba
SSDEEP 384:UtJEmWpvtJvzm9DQyvgd2VtsiEXMhszncjKik6/1zNA8ATkLDJCj:UvLdyMhszeKizAJTkLDkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\28.0.0.1\kp_pinslist.pb
Size 11KB
SHA256 1b9ee7a3aec303937fd884335b23591b55e0d5901d1ee25aa25800d1c202a24b
MD5 269f13e71015d2f9da1fc0e0e22b27c7
SHA1 67b35f4044517ec8b169d27d354a61e2f095895a
SHA512 039d3f870a4475ded4f972891059a4ebc467588f349d0310e47c9c975c793fbfe4179dc64f5c2616914aa97bcd5e83d6333f5de113f5c56c2fc3f2b7bb012dec
SSDEEP 192:xTZvK5yka1IDCrBngQ5jlMUfFwnIl3+Lm:xTpK5yEDCBngQ5jlMUfFwnIlOLm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 36123803abecd1bff0fd58cfc949d55d0fafae5d095d10da76cfd7e245eb6f5f
MD5 e9cc432582de31ce38bcf37549a90819
SHA1 2ae5d62501acaf5450923765cbf39ab266b29586
SHA512 286097bfc946e57caeb2a4f063fff24c6e5ce6991e3c52272a9309b907fe8d6fddd99f369ebe97b187c3732389efe8fa1188fd2de35fcb6d5a452a830e55235b
SSDEEP 3:MsEllllkEthXllkl2zEKAu:/M/xT02ztF
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.11.22.5\typosquatting_list.pb
Size 1.4MB
SHA256 286b76c97dee844dc860a5f918d478087c8d22259eee5b7ef0573f162086a5c1
MD5 c38931342171129beeb09afd417d93d8
SHA1 c9be3dd2696f67a9370dd6b6b849f5e93d00aa10
SHA512 988c6ea7da01123a0632e358353b1a7bce6c2d7c9114829ab3caa90d73fd38c565d424ef8376b0271b137284c5128067d1ad467302dc3124d7fed945028ac89a
SSDEEP 12288:2Ok223Fk85IHRG85ZNVpXRrNAIArejy8i2e7:kqiIHRGeNV1N+jre8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

butterflyondesktop.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-966BB.tmp\butterflyondesktop.tmp
Size 688KB
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
SSDEEP 12288:YRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyc:yObekYkfohrP337uzHnA6cHswHE/6gU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_2129866821\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_2129866821\manifest.json
Size 176B
SHA256 3e4c1b4b8dda29ed41f066d52ed35694e70f4b8a583efcbce12f661a49b57ba3
MD5 43c5775bc9bc99578d9a96958edc8864
SHA1 580dcf0609fb7931c7b5b7f8b787279bc1f6ec13
SHA512 0ab77a360635d032eb96b5d107626d24504e42522c0fb6f5bdabcddbc80129d05ac240b0ddcf21718308340676836d14feb677f8c0f3ed9d721bb0f623eef940
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1269043536\manifest.json
Size 102B
SHA256 8ee8a2fb7167ad2dcf2dd6f56074509dedd711b1825dcba2629af48c89eeebbe
MD5 50558b365ad40a8213fb79e84d42ffa3
SHA1 497d5ad94af7cecd6457fbd5723b6635ccd67c6b
SHA512 165a117c8f8247263c3328def089e5bc159895e1d4375bd3df93df8f9208c571dc7e3fb98389fa36952c6f3d8f3add4fe5c97b22bddc01ef7c4ac37477cc608a
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_396321307\manifest.json
Size 119B
SHA256 1f18892bc153b41fc9e1ce95d417d0ea0dc7676ec2f17e01de8931fed1cae670
MD5 7a3c8e2b8b70bdfdcc1db549b5b0a4bc
SHA1 28a7308a6ad5843219018855b51e49bcb4853b17
SHA512 15d67d22808482a9ce23b3fed2856b9917aeef01007f5b476740550f7c504f39203bc1a811c7309416af0438fee5ef0749f5c9696f42ae740c7f35405977f9f6
MD5 SHA1 SHA512

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
MD5 SHA1 SHA512

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
MD5 SHA1 SHA512

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_474683033\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_65070740\data.txt
Size 140KB
SHA256 f5e72faee9cd1aef917e12d005c7dca11035ea169e6a02417fbefb1f164051c2
MD5 d1248dc5d70652412468a4aab1913a30
SHA1 5725a0c9f9c0a69a2ee6e4fba309854aaadaec33
SHA512 60489e3424c4b50bda523da3f9ffd995decc1daf3408a19a31d48ee99e2d52a3ce29a10edcf15d7165247db68bd67aee3f2e95bd0d80089ec95d092e88eaf4ef
SSDEEP 3072:Uy4byvwQpaFzpRKXu9XmkfFTVZKuuGtgh8kGq2MR6gLAqcvn:U5byvw8aF9ou93rZKuuMDqDdLVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_65070740\manifest.json
Size 53B
SHA256 d1768a411f8308d2e53bda32bfb0d9c293b7d18c3d8c1c266febd6bb8d2a2ae6
MD5 5e2b168d39a2c48bcfdfceac3cdada96
SHA1 e60397bd2e1f55bd5e8c62e415f7908db0fd32a6
SHA512 8f06183c9444f1ae3a11c2b63926a35147587e33b137f18bd1f88d06817fc033f46ba69b2392ef3dfb6d6d06e1b6f1aecd8e7e83b53440f73881e1445b531769
MD5 SHA1 SHA512

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_985556268\edge_checkout_page_validator.js
Size 983KB
SHA256 2c8350d8437bc6ac9733fbeea46641e770f4580bfea00bd11b6a9158ab7253ed
MD5 3ee8425fd862d8079ee5a7a05bab0840
SHA1 c75330a17cd23425414f4a588744680037de4d42
SHA512 bd01aabc0fabc8d0344c02894abdb1419896f0fcfa411c1762b5148cd8b4dbbc120fccd385716226e4eb332aba7d5f2a7aa3ebbf07ee5c9c18427b90252653df
SSDEEP 24576:cs4/mRApB6vGKkrQAfHQQMlwaEBvE9kPL4w60w2xuV6oapGq9KLRzHEiJsfasuP7:cs4/mRAL6vGKkrQAfHQQMlwaEBvEiPLM
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_985556268\manifest.json
Size 145B
SHA256 e45fa543eb157657b8412c09b044fbf2ca9aa0ea3e6d36cab08f5deaad08ca8b
MD5 35857645c0a3072cc783beb4f1e60c26
SHA1 a9847d50c0bcb33a926b94f93dddfb863787fb68
SHA512 6592f8f347824150631c01f0dc0e0421e7c3f8a0e1dd238c12dc954ae990521e9f9ec3165a741be312c7f56cc53fa7137eb1b47241ec8b7d50f70a0aef250c68
MD5 SHA1 SHA512

Submit Download

memory/1920-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1920-46-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1920-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1920-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/2040-439-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-480-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-865-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-884-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-893-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-894-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-911-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-912-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1360-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-593-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-743-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1313-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-941-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1312-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1013-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1303-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-43-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-42-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-571-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1047-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1056-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-438-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-463-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1071-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-1080-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-500-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/2040-483-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/3020-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3020-45-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3020-22-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3020-20-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3020-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3020-16-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3020-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3020-8-0x0000000000400000-0x00000000004BC000-memory.dmp

Download