hxxps://bonavol[.]info/

Analysis

user interaction
yes
max time kernel
144s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bonavol.info/
Sample260717-e22k3aay9k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4008	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287360438757129"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{C4F93E2C-B3FD-421E-B108-B97C8F44604F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DF8E309F-8235-4109-94D9-08BDC8ACC3B7}	Bonavol_lwgp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4012	Bonavol_lwgp.exe
4012	Bonavol_lwgp.exe
5152	msedge.exe
5152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4520	4328	msedge.exe	83
PID 4328 wrote to memory of 3580	4328	msedge.exe	86
PID 4328 wrote to memory of 4008	4328	msedge.exe	85
PID 4328 wrote to memory of 3580	4328	msedge.exe	86
PID 4328 wrote to memory of 2864	4328	msedge.exe	87
PID 4328 wrote to memory of 3580	4328	msedge.exe	86
PID 4328 wrote to memory of 2864	4328	msedge.exe	87
PID 4328 wrote to memory of 3200	4328	msedge.exe	88
PID 4328 wrote to memory of 3200	4328	msedge.exe	88
PID 4328 wrote to memory of 3200	4328	msedge.exe	88
PID 4328 wrote to memory of 4872	4328	msedge.exe	89
PID 4328 wrote to memory of 4872	4328	msedge.exe	89
PID 4328 wrote to memory of 4872	4328	msedge.exe	89
PID 4328 wrote to memory of 4796	4328	msedge.exe	90
PID 4328 wrote to memory of 4796	4328	msedge.exe	90
PID 4328 wrote to memory of 4796	4328	msedge.exe	90
PID 4328 wrote to memory of 2956	4328	msedge.exe	91
PID 4328 wrote to memory of 2956	4328	msedge.exe	91
PID 4328 wrote to memory of 2956	4328	msedge.exe	91
PID 4328 wrote to memory of 560	4328	msedge.exe	95
PID 4328 wrote to memory of 560	4328	msedge.exe	95
PID 4328 wrote to memory of 2236	4328	msedge.exe	96
PID 4328 wrote to memory of 2236	4328	msedge.exe	96
PID 4328 wrote to memory of 1732	4328	msedge.exe	98
PID 4328 wrote to memory of 4484	4328	msedge.exe	108
PID 4328 wrote to memory of 4484	4328	msedge.exe	108
PID 4328 wrote to memory of 4484	4328	msedge.exe	108
PID 4328 wrote to memory of 1196	4328	msedge.exe	110
PID 4328 wrote to memory of 1196	4328	msedge.exe	110
PID 4328 wrote to memory of 1196	4328	msedge.exe	110
PID 4328 wrote to memory of 4868	4328	msedge.exe	109
PID 4328 wrote to memory of 4868	4328	msedge.exe	109
PID 4328 wrote to memory of 2768	4328	msedge.exe	113
PID 4328 wrote to memory of 1568	4328	msedge.exe	115
PID 4328 wrote to memory of 4788	4328	msedge.exe	116
PID 4328 wrote to memory of 5452	4328	msedge.exe	121
PID 4328 wrote to memory of 6044	4328	msedge.exe	126
PID 4328 wrote to memory of 6044	4328	msedge.exe	126
PID 4328 wrote to memory of 5152	4328	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bonavol.info/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a0
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13987994581733387764,3376909494442800672,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,15009015141300862372,4336277835451134392,262144 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,3618470605573676016,11486913261218967818,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,13567448754085343734,12561605376402709730,2097152 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,13484878456459043872,5848049725723353317,2097152 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7352231146589657684,7421945073321149884,2097152 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,286944418421843266,13745270323439042277,2097152 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,8595792949865785792,5919013908163491491,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,16287252314839389337,17202856594262090543,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10830605332202699923,2174658630890172527,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10830605332202699923,2174658630890172527,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4268,i,15824467041627040378,5278742111994141844,2097152 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,3092892839710655604,9536872102957943807,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6444,i,1626237044450949947,1026492154369643597,2097152 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,7963014241816864833,16331873831966770492,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,9473115196181356701,10802143143996594417,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,15620127585667264595,5315612534369963548,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1885821307735858560,1740598944977556135,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2445063204756527373,328049735886791084,524288 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,13246203590026250936,1696145668265453981,262144 --field-trial-handle=2220,i,9895148711213081936,1802373005762142738,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5440

C:\Users\Admin\Downloads\Bonavol_lwgp\Bonavol_lwgp\Bonavol_lwgp.exe
"C:\Users\Admin\Downloads\Bonavol_lwgp\Bonavol_lwgp\Bonavol_lwgp.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 69861cca525f0a4187ceb66105fd41f31b282b0ec2fd0b58af5e010de025eb26
MD5 494f90b4d4b235c2162a8b52065c884f
SHA1 e2a9261487d82e451aa62a42c6d5c032d76f85b0
SHA512 b3086c3be6ea043bf1be00dd10c34dbba5d29a1f7b854edd009a7ab4719b4890ec02bc19c8faddd766830acfa0f49aa26518ee45d97a87c06fa87a8bdc60f579
TLSH
T18361D7380A12B8ADF7311373F6D03BFD37F251A94E5B5ED951A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c501.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c501.TMP
Size 3KB
SHA256 03045b21c9407f56fa5e1052eec15285eed21bb4fc6c2b715e71b95b3187eaaf
MD5 d21722cbd4047bf1ab488d0a7ffb730b
SHA1 932fb597aaed387f4b52a04e371a6961b821f4e2
SHA512 334009c9887491ba3d6b6394ceefd66f45dfbc0de5003377c0c5739e5694f771017732e06c613b48c9ca8bf02c013ab3c4a126236227a857bbf2bf10517eda33
TLSH
T1D061D9380A12B49DF3311373F5D03BFD37F151A94D5B5DD951A018BE158BF324656418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3c3b0340e1261f878aba34de8ab78db2da7dd9e5e3c329ed5e5a8b747711bfc5
MD5 88d5baf8af750cbc688233998fa3e5c1
SHA1 c116831dbda361e68aae833362897734634baccc
SHA512 a6b92d638277f110504f09c6bfaa71410dc5ca0513af349a9bcf98b49d5d8cbd7a02e623037de003895c2f9f6e02737f1dd4aa170191e8dc56a62e7a7c804b11
TLSH
T1215159B3C6E4896DCD5116F0AB14AE1BCE1E0A1583283D1DC9E4EF9BE7E2471D11158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e0461f28c02b74f965483982752ac0354a521624da93bc2850d868109def5264
MD5 5235557ba37ca51a565fcf5cae729545
SHA1 e0e26ad967fef1c3c1bba3137160d795b6123a60
SHA512 cc81aa81ba1aef588aa2cc744fde6057d1205aef2bdb0f7d99278b3587e96deb97bf2713c6ad1935e4f9a0025f7005f37cbada867bc857e21244171c572bf4da
SSDEEP 192:sxZraRTyM/jK1Ml8M9Q/fTsh6SX4IdpQlzHW6+WNnjWXpXYLyGIDsaIg5aRJ:sxZraT1Q/fTsMS5mHbIXJY
TLSH
T1D152D9126A345977CCDBD209FA55BF93D6F5146293900E48AAFC8A0C05E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7fb16808132c6dc87cc85037f40640f04a8af98ac9afe6fdf443cb07c99fcdf1
MD5 65c81ec0d7f76d6ddb19d0364c9a319a
SHA1 3b5db85f3ad5b9b44210117143e9000e57d0c46b
SHA512 2edf434b99c04329c253fa2259384f084c100928ec7fbcb6424b3de5d3d4c05520f8204340ddf816536993a7fa9297d6415965db6b29134cd0fe4595ed7bc261
SSDEEP 192:sxZraRTyM/jK1Ml8MkQ/fTsi6SX4IdpQlzHW6+WNnOF/YL7IDsaIgrJ:sxZraTMQ/fTsxS5mHb8/99
TLSH
T19052D9126A38597BCCDBD209FA55BF93D6F5046293910E44AAFCCA0C05E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dde80091d0ec00c839f93413067d23e1e183a2983ceba9f2dc77f20d69eaf3e8
MD5 bd670b33ca9cce5e6eecc5302c0ec097
SHA1 55b2b9198a1305b3f761ec768916c9ad5af29b34
SHA512 7d283a287732548b6062fa474369f0ce71d9668feba3f4fc9ec3537553aa354fa3f9263ff61369973d7b6c26c8175b5a9bb3c69d1501362a38fa05e607465d33
SSDEEP 192:sxZraRTyM/jK1Ml8UQwvjQ/fTsh6yX4Idp6lzHW6+WNnjWXpXYLyPcisaIg5aLJ:sxZradqOQ/fTsMy5sHbIXpC
TLSH
T14452D912AA345977CCDBD20DB955BF93E6F5447292500E48AAFCCA0C05E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8ef25944f3c48c7892577b0340ce299e41acc76edcf40a90eb1a403c9e7cefc1
MD5 c47b89550007465d9856c5d2d1fe2c34
SHA1 01c68b9cd300d631409af96ebcff18105a5a2eeb
SHA512 1f259b40adeebf42ae7628deb56e7c94f8d4836c83bc3c327b55a81d9ab119277dda58e0ada6607158c9cf650c363ea77c2c56f1b1b6911b6b385d46e1ea609b
SSDEEP 192:sxZraRTyM/jK1Ml8M9Q/fTsh6yX4IdpQlzHW6+WNnjWXpXYLyAzDsaIg5aLJ:sxZrad1Q/fTsMy5mHbIXYC
TLSH
T13852EA12AA345977CCDBD209B955BF93D6F5447292900E48AAFCCA0C05E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 20dbe9139cb34ac8eaed2abee11f86151b210ee430f0048c78bb5978137a3ece
MD5 5068731688ae85694c92ff02252fb487
SHA1 06e73aa217b9401d572904716e54c9c4a7730c4b
SHA512 103d977b8d3aaf6d542a6ed7b2f6a1b67dba5922116d29fd74443bb6c5704d46b3ebe6281f33e6295ae202947fb4300058a3459adcc53bd26646ba068ec80560
SSDEEP 768:nLs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNUroMa:nLs6pD1WvxzWju1jahILIsN/Ma
TLSH
T1D4D2FA3B680CCB7E4F840E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b30871d012f2a83a859e10608ce0ebaa42805171d75d8200017b0ff3377e4a7c
MD5 9a0d1afad8b3549c86d1f9e9bdc5e13e
SHA1 b4a6fb14657b4c4b8562cdc304bdd505d2f4ab21
SHA512 dec12c782ab8e7a4b4c95800050a039002acc62e6aa69ba162d776c1680afca768123c1e9287d91a229afc5a26396a670ee539bd7719d33c8dd9991d106dd914
SSDEEP 96:KUAAKtePJHohV/lR7whKKm97KeCmb7KHPCpxIJLsd5kNSKOsC9GXqW4UIg0MpzuV:iiJHohV/lR8hK19XCmbuHPCpxIJLsd5z
TLSH
T1EEC1CC1235BB47123C3E290CA35497265B82F7A73018E92B3BA810B54E67E794DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5946a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5946a4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 df47717d64e20bc66cd1619af6a268edb1e3d3a10dd85569c2723b540dc4439c
MD5 94e4164acec5e968821e50eefa7f3ed8
SHA1 b966059e3ba4d8270dafbf3e3aa913e0c7c29f0c
SHA512 d860e7a35077f78cec3e2dcbdab131a4b7f082bbd910523dee0a15e4e060859f52e8f849adcdf2224fc281de9d6ddfa37f3847969395858837b9e0fbb762f9b4
SSDEEP 384:O2QiFNtNn/s3n9SQadsNR8TUNTUlIlV4kjXua9nODaw/qlhe:OuFNj+9wUwg7/dO2w/qlA
TLSH
T1F3B209F258DB8936D9AE4747BB7E2D078EBCC067B5851990B3885A0CCD962BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1658074e7f872d08429a94f55c47f0f8455f4918851ca735a9f50f4354f45869
MD5 a5cb64f7628a14ed732e70b8ce59adb1
SHA1 7704ac9e367bd0069e1a3ce919ad20863c3da2e2
SHA512 9b8529c17903e2460fc5cc85489bf82432cd4adf62a8e9577abc3464708454e6471f6c636367f6a8a9d52b3b04438a68e22d5ad33fc3b7bc780cb3a15840da29
SSDEEP 192:qONp6O7+3hQmiUyCmGttb0mO2opgGyfU6:qONp61gGt9nOD5EU6
TLSH
T1A602F8356D7C6CB79EB2AE45FA8737179FA5103BE9962F80D6E81E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c767ee7957164f535717ee13e0cdd2f8f837080c3ab4150fa63ad1dd33afae32
MD5 b45a076daaa5e984f292efc3c4ed870a
SHA1 bb534624f74ba8a442ef586af8e67bb39151cb07
SHA512 eb23a15aa8d7c5f05a663db6779def0cb64bcca365cd80481f69a9455e3efa615c17469ddde6d0df8b4e02ceb94245c0efe437d2396901bde21f39a9c35ba5ff
SSDEEP 384:W2tNn/s3n9SBsNvV4k4Xua9nODaw6qlhe:W2j+9yX/dO2w6qlA
TLSH
T151726C3668785D735AE29588FA47361B8FB8407796CA2E80C6DC6F0D02DB7AC1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75ab4cf2ac3bf8459f01368e7bf38abb16284e1a995c4811906351c3e17f4093
MD5 2696078e15f787347ad81b40e03dc1ba
SHA1 85bdacb1f66e0771ecb6cd325d15f243b3bd29f4
SHA512 fa4c598ce829b5bd928ea06829dafacdfdc0f90d726a39b1fcd1044f661f50a91af573a8cbf15888aee23567d0fcfde52dd4e6ac7e0449ee8d0f7b6a16676680
SSDEEP 192:VONhM6O7+3OQmiUydmattb0mO2oazENcNTqDNU6:VONy6Apat9nODawqqU6
TLSH
T15E120A36687C6C775EA2A584F98736179F650127EA8A2F81D1DC2E0C01EF6AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 68e79e13af56bef21afaf660b0a63384a2061cf3ae9e9490041742fd661bfb51
MD5 4415fcf0c327d99b1b1a2580ad0d3cd7
SHA1 0d18d7231c2b5c5c7106baf9ae0c4653775b893b
SHA512 53f21962a6955f9c5de2d73122ae7aafcb5c242f63da70a9ba1eaacc05835179c0c08c3b3658084fc5e0244fef7986aaf70eee9dea7ee00d17a7d96bf4e5d063
SSDEEP 384:O2QiFqtNn/s3n9SQaEsN+8TUNTUlIlV4HjXua9nODawKqlhe:OuFqj+9VpwgM/dO2wKqlA
TLSH
T1DEB21AF258DB8836D9AE4747BB7E2D078EBCC063B5851980B3885A0CCD972BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 57cedf2717b5dd3b774167deb0128b65cd2c87a34bcfb8863476b235cb0535a6
MD5 45a76286297e18751210c5bfda3c6857
SHA1 03f0ba68f56809f854f81305344a2150f86c08e7
SHA512 09756ff3298852efbc49582edb9bb942a5c296e0949c940319c3eb7ce25675df011debe48e5398c48d5db5fd42a14d52c5feeea9c9da7735fff6f373fe5cbdae
SSDEEP 192:uhKLsNVtjlQE7+3vYPQmiU1mtXB4atb0mO2oazEVLMTqDNCR6hN1N:gosNv54k4Xua9nODaw6qlhh
TLSH
T150422B3668785C775AB3A144FA8736139FB44067DA8A2E90D6DD6F0C01EF6AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ebc4964-90fd-4fc7-bd80-46ce857449e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8ebc4964-90fd-4fc7-bd80-46ce857449e6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 116e0f6e96dda9f079f6ffa9f2bbba5825033a5f22d814af57da2f85b0068d9e
MD5 df25bbf9a461f6c42a76f3ff1d9fcee5
SHA1 225f3a40b2d2e126538cc5680b034f4764df09d9
SHA512 d12704d548855ce37a3ab4a0f93ace884ff3bb65f51c001c80f63532e3e35f300449e71880c6f7549d4949c55202ce26e934c28650c50bc16718039562a4ceeb
TLSH
T19F411658A6EA1148B3B36F16ABF6A86E487F7C272F0AD45E10110E4E0663E00D961B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4012-274-0x0000000140000000-0x0000000140053000-memory.dmp

Download

memory/4012-285-0x0000000000400000-0x0000000000AB0000-memory.dmp

Download