Overview

overview

8

Static

static

3

@Wanna.Bud...in.zip

windows7-x64

1

@Wanna.Bud...in.zip

windows10-1703-x64

1

@Wanna.Bud...in.zip

windows10-2004-x64

1

@Wanna.Bud...in.zip

windows11-21h2-x64

1

Bonzify.exe

windows7-x64

8

Bonzify.exe

windows10-1703-x64

8

Bonzify.exe

windows10-2004-x64

8

Bonzify.exe

windows11-21h2-x64

8

LOVE-LETTE...XT.vbs

windows7-x64

1

LOVE-LETTE...XT.vbs

windows10-1703-x64

1

LOVE-LETTE...XT.vbs

windows10-2004-x64

1

LOVE-LETTE...XT.vbs

windows11-21h2-x64

1

MEMZ.exe

windows7-x64

6

MEMZ.exe

windows10-1703-x64

7

MEMZ.exe

windows10-2004-x64

7

MEMZ.exe

windows11-21h2-x64

6

salinewin.exe

windows7-x64

8

salinewin.exe

windows10-1703-x64

8

salinewin.exe

windows10-2004-x64

8

salinewin.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    63s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Bonzify.exe
  • Size 6.4MB
  • Sample240309-vszm4sda87
  • SHA256 66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryexploitpersistence

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 16 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 56 IoCs
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bonzify.exe
    "C:\Users\Admin\AppData\Local\Temp\Bonzify.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im AgentSvr.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4704
      • C:\Windows\SysWOW64\takeown.exe
        takeown /r /d y /f C:\Windows\MsAgent
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2684
      • C:\Windows\SysWOW64\icacls.exe
        icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1876
    • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
      INSTALLER.exe /q
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1140
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2548
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3716
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
        3⤵
        • Loads dropped DLL
        PID:392
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
        3⤵
        • Loads dropped DLL
        PID:436
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
        3⤵
        • Loads dropped DLL
        PID:2740
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
        3⤵
        • Loads dropped DLL
        PID:4016
      • C:\Windows\msagent\AgentSvr.exe
        "C:\Windows\msagent\AgentSvr.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:4176
      • C:\Windows\SysWOW64\grpconv.exe
        grpconv.exe -o
        3⤵
          PID:2408
      • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
        INSTALLER.exe /q
        2⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
          3⤵
          • Loads dropped DLL
          PID:2908
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:3464
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          3⤵
            PID:4860
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3992
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x524 0x528
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1500
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2684
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2200
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4936
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3672
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4380
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1936
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4280
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:8
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2156
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:904
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:228
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4180
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4772
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3800
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3692
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4420
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4248

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                            • Size 471B
                                            • SHA256 f6b05bec7203657825a9e0c5174f19a8681d6062b3deb03e118c54f472b33aed
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                            • Size 412B
                                            • SHA256 1885ff05ea470dfa381c49fabb6ebcdbade7517bf885aa7e93d8cfc2e61619e0
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            microsoft.windows[1].xml
                                            • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4VHCF0PY\microsoft.windows[1].xml
                                            • Size 97B
                                            • SHA256 a64b8e9193f1537d2bb5f68c17018abf732832ebe4885933819f019ff9410841
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            INSTALLER.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                            • Size 997KB
                                            • SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            INSTALLER.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                            • Size 320KB
                                            • SHA256 6c630d21375c19a18d3f658a335d65772185840e39dfe04790770bba6fbc2c95
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            INSTALLER.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                            • Size 192KB
                                            • SHA256 ebed5de747dab53c60315cac1bb3056f9241817854bd62f420cc6ff5233b17bb
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ADVPACK.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                            • Size 73KB
                                            • SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTANM.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
                                            • Size 40KB
                                            • SHA256 905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTCTL.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL
                                            • Size 160KB
                                            • SHA256 d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTDP2.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
                                            • Size 60KB
                                            • SHA256 c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTDPV.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
                                            • Size 64KB
                                            • SHA256 394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTMPX.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
                                            • Size 60KB
                                            • SHA256 6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTPSH.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
                                            • Size 36KB
                                            • SHA256 8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTSR.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
                                            • Size 60KB
                                            • SHA256 e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGENTSVR.EXE
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
                                            • Size 268KB
                                            • SHA256 e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGT0409.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
                                            • Size 28KB
                                            • SHA256 6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGT0409.HLP
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
                                            • Size 8KB
                                            • SHA256 e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGT20.INF
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
                                            • Size 2KB
                                            • SHA256 49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            AGTCTL15.TLB
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
                                            • Size 28KB
                                            • SHA256 3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AGTINST.INF
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
                                            • Size 7KB
                                            • SHA256 bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            MSLWVTTS.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
                                            • Size 52KB
                                            • SHA256 ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Msvcirt.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll
                                            • Size 76KB
                                            • SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Msvcp50.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll
                                            • Size 552KB
                                            • SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            W95INF16.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL
                                            • Size 2KB
                                            • SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            W95INF32.DLL
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL
                                            • Size 4KB
                                            • SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            andmoipa.ttf
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf
                                            • Size 29KB
                                            • SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tv_enua.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll
                                            • Size 1.2MB
                                            • SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tv_enua.hlp
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp
                                            • Size 11KB
                                            • SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tv_enua.inf
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf
                                            • Size 2KB
                                            • SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            tvenuax.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll
                                            • Size 40KB
                                            • SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            KillAgent.bat
                                            • Path C:\Users\Admin\AppData\Local\Temp\KillAgent.bat
                                            • Size 161B
                                            • SHA256 e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Bonzi.acs
                                            • Path C:\Windows\msagent\chars\Bonzi.acs
                                            • Size 5.0MB
                                            • SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            memory/8-411-0x0000000004A30000-0x0000000004A31000-memory.dmp
                                            Download

                                            memory/228-417-0x0000000004D70000-0x0000000004D71000-memory.dmp
                                            Download

                                            memory/904-414-0x000002B183D80000-0x000002B183D88000-memory.dmp
                                            Download

                                            memory/4180-424-0x000001BAF5A20000-0x000001BAF5A40000-memory.dmp
                                            Download

                                            memory/4180-426-0x000001BAF57D0000-0x000001BAF57F0000-memory.dmp
                                            Download

                                            memory/4180-431-0x000001BAF5DE0000-0x000001BAF5E00000-memory.dmp
                                            Download

                                            memory/4380-396-0x0000020F5C220000-0x0000020F5C240000-memory.dmp
                                            Download

                                            memory/4380-399-0x0000020F5BFD0000-0x0000020F5BFF0000-memory.dmp
                                            Download

                                            memory/4380-402-0x0000020F5C5E0000-0x0000020F5C600000-memory.dmp
                                            Download

                                            memory/4936-390-0x0000000004740000-0x0000000004741000-memory.dmp
                                            Download