116a74f7e1913cab1cbc81a4aa711ff293e25ddbe78612f70f858a655b1e3251

Resubmissions

18/08/2026, 04:41

260818-fba6vsw1cx3

18/08/2026, 04:35

260818-e7rm2sej7w3

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bonavol.html
Size 5KB
Sample260818-e7rm2sej7w
SHA256 116a74f7e1913cab1cbc81a4aa711ff293e25ddbe78612f70f858a655b1e3251
MD5 d4f841804b82a1ac241d69335658e800
SHA1 b41f0a9b7338481423e8ec8cfb35fea9e94c6ff3
SHA512 fbce37d2b6d3de2ae2af4744e94d98ed6b9d853d4f371b915a4e60e038a237da202425a04ce8338699a3ca036f3c2cd49235675a4c39336b6fb39cf1f42854ab
SSDEEP 96:PNyzftoXZzIEb0EaW87mW5oDe/nSWUrXZSLSHYyhPsvIUTSR9G/RNLtYzueh8P9d:PNWtkCBPLfAXZn3oTUATKyRgw
TLSH
T199B15DF3ED34A1358FB62FD238F7B358E122F5047A05909996B09B2D97DEF0B4251581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1508	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315013270165311"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{E6EBE530-F53D-474A-903E-C3FDBD796D49}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{2B7FDAF6-05B5-4EB3-82F0-5696E467FFEA}	Bonavol.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3452	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4716	Bonavol.exe
4716	Bonavol.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1980	2388	msedge.exe	86
PID 2388 wrote to memory of 4372	2388	msedge.exe	87
PID 2388 wrote to memory of 4424	2388	msedge.exe	88
PID 2388 wrote to memory of 4424	2388	msedge.exe	88
PID 2388 wrote to memory of 4424	2388	msedge.exe	88
PID 2388 wrote to memory of 4824	2388	msedge.exe	89
PID 2388 wrote to memory of 4824	2388	msedge.exe	89
PID 2388 wrote to memory of 2656	2388	msedge.exe	90
PID 2388 wrote to memory of 2656	2388	msedge.exe	90
PID 2388 wrote to memory of 2656	2388	msedge.exe	90
PID 2388 wrote to memory of 4916	2388	msedge.exe	91
PID 2388 wrote to memory of 4916	2388	msedge.exe	91
PID 2388 wrote to memory of 4916	2388	msedge.exe	91
PID 2388 wrote to memory of 692	2388	msedge.exe	93
PID 2388 wrote to memory of 692	2388	msedge.exe	93
PID 2388 wrote to memory of 692	2388	msedge.exe	93
PID 2388 wrote to memory of 4084	2388	msedge.exe	94
PID 2388 wrote to memory of 4084	2388	msedge.exe	94
PID 2388 wrote to memory of 4084	2388	msedge.exe	94
PID 2388 wrote to memory of 4236	2388	msedge.exe	98
PID 2388 wrote to memory of 4980	2388	msedge.exe	99
PID 2388 wrote to memory of 4236	2388	msedge.exe	98
PID 2388 wrote to memory of 4980	2388	msedge.exe	99
PID 2388 wrote to memory of 1508	2388	msedge.exe	103
PID 2388 wrote to memory of 2656	2388	msedge.exe	110
PID 2388 wrote to memory of 2656	2388	msedge.exe	110
PID 2388 wrote to memory of 4968	2388	msedge.exe	112
PID 2388 wrote to memory of 1936	2388	msedge.exe	113
PID 2388 wrote to memory of 2004	2388	msedge.exe	114
PID 2388 wrote to memory of 116	2388	msedge.exe	115
PID 2388 wrote to memory of 116	2388	msedge.exe	115
PID 2388 wrote to memory of 1688	2388	msedge.exe	117
PID 2388 wrote to memory of 1688	2388	msedge.exe	117
PID 2388 wrote to memory of 1688	2388	msedge.exe	117
PID 2388 wrote to memory of 760	2388	msedge.exe	118
PID 2388 wrote to memory of 760	2388	msedge.exe	118
PID 2388 wrote to memory of 760	2388	msedge.exe	118
PID 2388 wrote to memory of 1508	2388	msedge.exe	119
PID 2388 wrote to memory of 1508	2388	msedge.exe	119
PID 2388 wrote to memory of 1508	2388	msedge.exe	119
PID 2388 wrote to memory of 3208	2388	msedge.exe	120
PID 2388 wrote to memory of 3208	2388	msedge.exe	120
PID 2388 wrote to memory of 3208	2388	msedge.exe	120
PID 2388 wrote to memory of 1092	2388	msedge.exe	121
PID 2388 wrote to memory of 1092	2388	msedge.exe	121
PID 2388 wrote to memory of 1092	2388	msedge.exe	121
PID 2388 wrote to memory of 1180	2388	msedge.exe	122
PID 2388 wrote to memory of 1180	2388	msedge.exe	122
PID 2388 wrote to memory of 4868	2388	msedge.exe	123
PID 2388 wrote to memory of 4868	2388	msedge.exe	123
PID 2388 wrote to memory of 952	2388	msedge.exe	124
PID 2388 wrote to memory of 952	2388	msedge.exe	124
PID 2388 wrote to memory of 952	2388	msedge.exe	124
PID 2388 wrote to memory of 840	2388	msedge.exe	125
PID 2388 wrote to memory of 4644	2388	msedge.exe	127
PID 4716 wrote to memory of 1508	4716	Bonavol.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Bonavol.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7fff4d27c188,0x7fff4d27c194,0x7fff4d27c1a0
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,4400771125991299651,14097028764649766462,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,5915157317089963493,17584337094824953967,262144 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,11564574374829776362,3677075454032119290,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,288416791782977983,1793075116845053293,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16540992975499458798,16651909731259898895,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,6583570034538421812,13028394293803902531,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,10591917431109246310,3050387951439778842,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16195102524894353848,11144340795086352227,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,9423358658907602146,12851346935367069979,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,3968652146417662474,9259400781319360164,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,3968652146417662474,9259400781319360164,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,7181515780367156115,12180621370277135968,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,7951702982386011324,14397252855473088533,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,16796863519670271033,3775496416501210182,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,17563350365152982141,6644204298946931314,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,4549886388654985212,1106534502979799969,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6740,i,9678410646577292341,16633866136362221408,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6900,i,6458996373772341253,9488940639191847969,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3756,i,4274267045499908332,17073297567589218409,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6944,i,2411741245327398710,619270078954324974,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6988,i,5443922186816334665,10230752441472174215,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,7087758243907041195,6208995689817468867,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,523043875130062394,1648918442364854745,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3768,i,7845830102206916003,17344507501608769333,2097152 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9286029256855484691,1557625077891515163,524288 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6336,i,16260718191675949079,9576643333954419585,262144 --field-trial-handle=2336,i,9014875490583208334,2729408355325301715,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2424

C:\Users\Admin\Downloads\Bonavol\Bonavol\Bonavol.exe
"C:\Users\Admin\Downloads\Bonavol\Bonavol\Bonavol.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1508

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Bonavol\Bonavol\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d5fa139ee15e648cf95279ab121122e6f2c97ec469af0dbfcfcbfe4cd32ce822
MD5 9130229eb493757858c65c91d233ce7a
SHA1 5c6067efbefae8a142b4bbb9e3d30486fed8530d
SHA512 b5c68c65217125ff18b7ddc88b0a9bd9fb12117b3f8cf0edfbac2076bf5e87f82b7cfe2f8fd8d6751e389b34bf663d18492d97b4c47f2c0979ac3545d1b783bd
TLSH
T162D097B062D66C11EA0C00B0982102426B9AC81434EBCB038056940E56652A0A39B0E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f1107bf1b3d22f75a220afc4ad762239945b6bfc8c65428a4ed29b54b60255f9
MD5 d50af4965bf9a3c21368ea8eaf3f196b
SHA1 14f4ef20d58323a7f4399c61021cf49710f15492
SHA512 ace4ba04df61088483c4cdc7334051248dee8bc9cc42b1cc22bcde5fab6d1a08980b5cedbb007cdc964df3aa420c5680d3f94a40188b9928cab0a634db098fa3
TLSH
T14771A154126BC98AD7201732E4E33534FCB28FA94EEFFE8511819BBE19E1F6D6126008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b0840f2d8bfd40649640a6405139b7203e9ed765f6022ead4dac17f78438235a
MD5 89746b22f699a769eb4d6fd4799eb012
SHA1 baa78f63819dafc70b13da222e4a1d7fb9c10659
SHA512 55304cb8f9307d8d463a4f573b1fb5f5f6dca07d52610231e7219e9a655b39cb9640974e68ba263aca3daea1be4656e6cb0965e2be4b932466c29782433e7b29
TLSH
T127719158126BC98AD7200331E4E33174FCF28FA90EDFFE8511815BBE19D0F6D6126408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f855.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f855.TMP
Size 3KB
SHA256 fa78c3002c81dcb44f408392eb4eadb7dde39c4d5f64da8b8e8ecdf9f845f7ec
MD5 5108bab6a12fe512c16daaf5f28e8848
SHA1 62018bdc7d9c9b094a1f827b637d1c0e420e6200
SHA512 f2ddbf73c1ac76c04cdb9afb4d4cb0c1fbc372904069883aa4b6665553483383953f7b6c425219e97bcd7ff50bc0eb0e490cb9ea967ff0fb0bcc79e26a750ed0
TLSH
T1DE719158126BC99AD7201331E4E33274FCF28FA90EDFFE8511855BBE19D0F2E612A008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8a07d516773aca53273c29c6b88fe3257b099560fc3e5e3ab168b8d462cc03aa
MD5 5297488a1bf3d47c5c861b1bd758b687
SHA1 3a976f85791c8081f60b2d6fc203cfef08d30d53
SHA512 43587f1470a0ce4d18b00493f19f33adb76312831e6933524839c6648be3d9721934e7e3b52ce2e52f900fbe95fecddc4f077e9b5875a486b599eab3da4b98ad
TLSH
T141617EB7C2E8DA6E884116F09F246E2BCD1D091886587C2DCDF5EF5BA3E2471D21164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 507e3d70c07a0a4f3a488af3451ed8b72b37d64b9363e4a543261f1d9286befa
MD5 6aed4dfa8579a727a132579b9d3c77c7
SHA1 3a111b9ec0e7cccf90aa6e6149fb1737b5deb686
SHA512 01feeb5c6d8bd79255d81578d4d9553b9f663da987f91fd367524a39f8406cc43f60cf1d8c34fc93c8438e90436faf0e657028774ef206453e63492d84792004
TLSH
T1F0718DB7C2E8DA5E884116F09F246E2BCD1D091886583C2DCDF5EF9BA3E2471D211A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 19ec1e29bf4dea7c8151f1e14b9112a435567fec7d75b3a54571d61d750e4525
MD5 57466e3507c4d4930117896e3af9354b
SHA1 691137d40c44bb80a0f1cc7da6de209af7ec4dd4
SHA512 975e43b528a537728de4529e496afc2b5325600cb5110bb738c6988cfbdd0aadfd07eb402669f93f31e67edb25d69131375f4519b740fe27d2597652be1dbaf0
SSDEEP 192:sxZVR6yM/jK1Ml8Mk5/fqsJF0YIdpdZHW6+WNGYwKo4tIgrJ:sxZVUM5/fqsJF0prHbGk9
TLSH
T14B42D7116A34A97BCCDBE309FA557F53D6F94472A2940E44ADFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 17d5d26e1e7da1fbe9761e4db9a0317c090595266d6902e604e010186aa767b1
MD5 5cc525d9d983da7450e201258775e519
SHA1 194b9056e691c691fa7da25bc3ea6e414431ee92
SHA512 bacb7f10a9845eb4146ea3dd1da3930620f2eb0a9c5e6237cb7ea787975baa6f111f5c2f52bf9cd5cc040cb71f463b1b4522127349f5a339920a5d069870a1c8
SSDEEP 192:sxZVR6yM/jK1Ml8UQJg95/fqsAWpVQqvGIdpE4gwHW6+WNpPPbdYISvRrTIgbhJ:sxZVUq45/fqsAWvQqvntHbZdqXn
TLSH
T19762C711A634697BCDDBE619FA917F53E6F5442292901E44AEFCCA1C01E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2e15941a88abc340037978475b43262d11752732daf2c1574a03b0d572d2cc33
MD5 1fadb81698971d5f76ad710d9b231fa4
SHA1 855a2cc708c40da96ff0dfc021a2c7b2399cfa84
SHA512 8cdfab81db5171bfaf5261c328c7b2403c174dea97fcc351767a47f2a13feeac44b2182fd583f1a0e084c546c8a992fd452f39ec157124a02903ff89cad70cd4
SSDEEP 192:sxZVR6yM/jK1Ml8M95/fqs+F0YIdpdZHW6+WNGYwKo4tIg5TJ:sxZVU15/fqs+F0prHbGkD
TLSH
T1F242D711AA34A977CCDBE309FA917F53D6F9447292940E44ADFCCA0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6a4bc65c7a3812bda9d68ef555b83c53f6c99a6be5f7ea5be51584828c6e7631
MD5 72ffb9386db902399ab75be8c09386ba
SHA1 9b80cfd110c7c69ebb6d07bda6c9e94c70e84e8a
SHA512 961c8ebace6923a197164469ff16e539d6926850145f1d65c204e805fcf9b7ba42c3166938412cab58c0c0c40737028a9981e20d8b4b746ff7090cf610027afe
SSDEEP 768:Lg4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dBrohRc9a9:Lg4jeXmWvmKLEu1jacPLZQd6oA
TLSH
T1F4D20A3B244CCF7E4F844E5CEC2AAE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c56da0802aa3a86fc6dd8b2a3ff04943c6d38bd10a1e321e5e4a2f23be01d809
MD5 531b959f3c321752e4cfd550bca72670
SHA1 7b6e945c19e0507aff883b585ed6e0bbee598a8a
SHA512 5e9f45fd93fb5c47b7af25a50594227aabf7a0712a4b0aee4ba4046c690bdc1f9756dfc3ce91eff5e29626e6151bf997f2b27ef5e56a7cfb8157202709f77022
SSDEEP 24:KdRtfRoR7RSaR3dRfR7Rz4RLRv+RCIjRnRzKiRchaRJRz1ER1RjSmRdMR48R7RQu:K88I7KZiEzyNdIpKGkcmpI1K6YoHyhz
TLSH
T1829152A637BF43122C3E2908A7959B27474571A33518E42B7BA800B24E67F690DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5998ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5998ac.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 74df830e23c8e75a2a24b5b527cc22343325b5675b4c0297be6269c4da68b93b
MD5 7a10b1a00ace827c31830bb88f7ef670
SHA1 f59259746bbb5bcbe9d7bbe6f40c84c61479ba94
SHA512 003e9b4acdbfe4aed017a91880a5f192755192b98a4c41c3d14d808be349b07738e39e25de9b3f8d536737a8779d02d06f37f042aa87f7b8974f0731b0b8c076
SSDEEP 3:MsEllllkEthXllkl2zExllAt:/M/xT02z9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad5a2cdc9adab592843a8f7c0d60061a3fbfc5cd7a9757526e4fee3842c1a087
MD5 cdbffe4c4f8e2d321a5f380e9cf4d505
SHA1 b59fcb04ec454cc0632630fca976a2df1c255e17
SHA512 33e93be30d4caab0380994ea4ccbd003a42c4e28130c882860173551737a211d76c9295c50583fde9506a1c6fb3a341abe96aae55435717e142f2ad3e79a2489
SSDEEP 384:NZcIhsNAlEGoujG1f+98RUlXU+2m2FdySllYJTfY81FTF1Buk:Vh+51qlUlmodZuTHtPBuk
TLSH
T197928D3258249C7799E6F681F44B36134FFCC16797D9ABC0D9FC5F1E018A9AC131A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 819ff9f52cb5d606ee36dd02fa519b865fd25836c51e75ca47e0b9373dc9a3e9
MD5 0163efe642e30442d913a4c6d74bd54f
SHA1 d90fb95c1d041fac1946db61f3c8238fe5670e5a
SHA512 c8c06e02127b5a1102a63ff5027c05c20736f9549c0877d32900817eecc9e075d775926f6eec725a64848deb864481dcef7e9b7c0690ad705f66cdff0e28d761
SSDEEP 768:+Ff71wgzo1qlUlmtbTSj0qtWZuTHtPBuk:G7Ypos7tWZcHxB5
TLSH
T1F4F27DF284D34CB6C49DA7C7A37DAD0259BCC123B1599548B7E86A2DEC4B4BFC306861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c6b1342e6b9371fca5a4125d9f2ae1b84e695def3ebf97b27daaded457037c3b
MD5 a3f827e9e661523d901a1d330ca588e2
SHA1 f008290cb86bbce68c16e8efa5669b5fce594005
SHA512 95dbe35f3e607d5732144d973090f863982cb7f7345e804c630e4d87663aee95a4b5ff8a3dbf4c9ab3db1cbea2de3890b02995b135f751bed80834d0634f9590
SSDEEP 384:TiFiZcIHsNA8TUNTUlIlcEGouja1f+98RUlXU+2m8FdySllYJTfY81FTF1Buk:+FQHBwgDZ1qlUlm6dZuTHtPBuk
TLSH
T13BD22AF248D78876D9AEAB43B77E2D034EBCC167B595A680B7D84A1DCC464BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d86d9558fc12b05d468168ef6e19b164fa88cf5c89168e92f3e2ffe350afd472
MD5 811c319047ef89f145aebc586585018c
SHA1 9f44bfbf0795288584c11d2b237eeff9dda1931a
SHA512 cd179c77d8e408949d2ef3fc52ff79bd83943cbd9dbae3c490e082e0e016b7bcf9dbe3059fe449f7e5e1084b783bedbfb6260bdbb8c621e2b3e90e781f4a7704
SSDEEP 192:EONu6hZ0QmiUykypc/+jVnjzorRUY5wOZ3zU6:EONu6oCpu+98RUn2jU6
TLSH
T13802E935A8686C778EE2AE45F48727235FE5116BA9A56B84DAF81F1D00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7662324f8e974ea85dbf78bc255e24817e38b77e2538999acf51657d68a1d7a6
MD5 1623849565c6f124e70c601cb322df79
SHA1 46f1ea52b578bc01c2952edbf80f8e226fd00a91
SHA512 4138af14a0a42c779ebd0426607799f13533c6a10298cdae56646a90d27ab379f741e5eceab66ebb243325a26223904616d2317876e6b34aa4195eee42a3022b
SSDEEP 384:mZcIhsNAcEGoujj1f+98RUlXU+2m2FdySllYJTfY81FTF1Buk:0hxA1qlUlmodZuTHtPBuk
TLSH
T1BF928D3258249C77D9E6F681F48B36134FFCC16797D9AB80D9FC5F1E018A9AC131A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb01802b9a2fe5fdbb99646f19a0b5e8941c380a0b8fc298eaac304ff9a495a8
MD5 837b69ee711d2dbdeef07f3e2e33f7ab
SHA1 bc420580d457cc36eb6b3039a5c159429bfb44fa
SHA512 e3d44edd0ee82ffe5cc22837fd86b5676770c868275ca7911ec64ec0225744fb3a4e047fe90c0057d792e96930aa70c7a7f8217e18e65f81f7bdbb2313e31674
SSDEEP 192:nONJ6hZCQmiUyzyHc/+jVnjzorRUlXU+2mB5cOqkqHU6:nONJ66fHu+98RUlXU+2mE9dU6
TLSH
T173120C36A468AC674DD2BA85F08732139FE95217EAD97B80D5EC1F1C00DE6AC230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7210550e8e9f331639f9ab632c13388a7f5aeabb423930ea2ec93f724d39a1b4
MD5 aa368177b2fd6fd5661025aae94abd96
SHA1 85e16b9681485f0fdc79f7598c506d516eb300f6
SHA512 1270d1c4fb7ce8b9613b937772d73088892368258ad074c763f756b5503b936b044070ef8fbb2ae7176accaf5bd1cf4ada25cb5782f91241394551db42cdf43b
TLSH
T164411898B6F91118B3B76F4A9BF6A86D487F7D372E0AD49D00120D4F0A66A01DC72737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4716-464-0x0000000140000000-0x0000000140051000-memory.dmp

Download

memory/4716-469-0x0000000140000000-0x0000000140051000-memory.dmp

Download