Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 11:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://bonzi.link
Resource
win10v2004-20231215-en
General
-
Target
http://bonzi.link
Malware Config
Signatures
-
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation Setup.exe -
Drops startup file 1 IoCs
Processes:
nssBED8.tmpdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PC App Store.lnk nssBED8.tmp -
Executes dropped EXE 8 IoCs
Processes:
Setup.exeSetup.exenssBED8.tmpnssBED8.tmpsetDRM.exePcAppStore.exeMSAGENT.EXEtv_enua.exepid process 3052 Setup.exe 3908 Setup.exe 1272 nssBED8.tmp 524 nssBED8.tmp 2264 setDRM.exe 4580 PcAppStore.exe 3852 MSAGENT.EXE 2240 tv_enua.exe -
Loads dropped DLL 40 IoCs
Processes:
Setup.exeSetup.exenssBED8.tmpBonziBuddy432.exeMSAGENT.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 3052 Setup.exe 3052 Setup.exe 3908 Setup.exe 3908 Setup.exe 3052 Setup.exe 3052 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 3908 Setup.exe 3052 Setup.exe 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 2248 BonziBuddy432.exe 3852 MSAGENT.EXE 1536 regsvr32.exe 1144 regsvr32.exe 716 regsvr32.exe 4556 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
BonziBuddy432.exedescription ioc process File opened for modification C:\Program Files (x86)\BonziBuddy432\favicon.ico BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\p001.nbd BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Runtimes\actcnc.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\registry.reg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\uninstall.bat BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page0.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page16.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page5.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page1.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page20.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page11.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page6.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\Thumbs.db BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page6.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\book BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page10.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page16.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\AutoDirPatcher.vbs BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page11.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\sstabs2.ocx BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb008.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb010.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page0.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\book BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page12.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Uninstall.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page19.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\empop3.dll BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page6.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page15.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page9.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\sp001.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page3.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\ManualShortcutsMaker.vbs BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp003.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\j2.nbd BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\j3.nbd BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page14.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Regicon.ocx BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page11.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page16.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page6.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\MSINET.OCX BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb007.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page3.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp006.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page5.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Runtimes\spchcpl.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\menu.bat BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page7.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb001.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb011.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page4.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\t2.nbd BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\AutoDirPatcher.bat BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb003.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page3.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\BG\Bg1.bmp BonziBuddy432.exe -
Drops file in Windows directory 41 IoCs
Processes:
BonziBuddy432.exeMSAGENT.EXEdescription ioc process File opened for modification C:\Windows\msagent\chars\Peedy.acs BonziBuddy432.exe File created C:\Windows\msagent\SET93BA.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET93DE.tmp MSAGENT.EXE File opened for modification C:\Windows\help\SET9413.tmp MSAGENT.EXE File opened for modification C:\Windows\help\Agt0409.hlp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9434.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentCtl.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentDPv.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\SET93BC.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentSR.dll MSAGENT.EXE File created C:\Windows\msagent\SET9400.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\mslwvtts.dll MSAGENT.EXE File created C:\Windows\msagent\SET93DF.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentAnm.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\SET93EF.tmp MSAGENT.EXE File opened for modification C:\Windows\INF\agtinst.inf MSAGENT.EXE File created C:\Windows\msagent\SET9402.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET93BA.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET93BD.tmp MSAGENT.EXE File created C:\Windows\INF\SET9401.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\intl\Agt0409.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\chars\Bonzi.acs BonziBuddy432.exe File created C:\Windows\msagent\SET93BB.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\intl\SET9423.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgtCtl15.tlb MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentMPx.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9402.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9400.tmp MSAGENT.EXE File opened for modification C:\Windows\INF\SET9401.tmp MSAGENT.EXE File created C:\Windows\msagent\intl\SET9423.tmp MSAGENT.EXE File created C:\Windows\msagent\SET93BC.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentDp2.dll MSAGENT.EXE File created C:\Windows\msagent\SET93BD.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentSvr.exe MSAGENT.EXE File opened for modification C:\Windows\msagent\SET93DF.tmp MSAGENT.EXE File created C:\Windows\msagent\SET9434.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET93BB.tmp MSAGENT.EXE File created C:\Windows\msagent\SET93DE.tmp MSAGENT.EXE File created C:\Windows\msagent\SET93EF.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentPsh.dll MSAGENT.EXE File created C:\Windows\help\SET9413.tmp MSAGENT.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 64 IoCs
Processes:
BonziBuddy432.exeregsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FD4-1BF9-11D2-BAE8-00104B9E0792}\ = "ISSButtonBase" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A45DB49-BD0D-11D2-8D14-00104B9E072A}\TypeLib\ = "{0A45DB48-BD0D-11D2-8D14-00104B9E072A}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53FA8D48-2CDD-11D3-9DD0-D3CD4078982A}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BD33B25E-E99D-40C3-B5C5-7F5C3F130777}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FD8-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSPanel\CurVer\ = "Threed.SSPanel.3" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}\3.0\HELPDIR BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37DEB787-2D9B-11D3-9DD0-C423E6542E10}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FEA-1BF9-11D2-BAE8-00104B9E0792}\ProxyStubClsid32 BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE1-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D42-2CDD-11D3-9DD0-D3CD4078982A}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FD7-1BF9-11D2-BAE8-00104B9E0792}\ProxyStubClsid32 BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A45DB4D-BD0D-11D2-8D14-00104B9E072A}\TypeLib\Version = "2.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83C2D7A0-0DE6-11D3-9DCF-9423F1B2561C}\ = "IComMoveSize" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F55ED2E0-6E13-11CE-918C-0000C0554C0A} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\ = "INode" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}\2.0\0\win32\ = "C:\\Windows\\msagent\\AgentCtl.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D44-2CDD-11D3-9DD0-D3CD4078982A}\ProgID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B976287-3692-11D0-9B8A-0000C0F04C96}\TypeLib\Version = "2.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D0ECB27-9968-11D0-AC6E-00C04FD97575}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveTabs.SSTabs.2\ = "Sheridan ActiveTabs Control" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE1-7DE6-11D0-91FE-00C04FD701A5}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB52CF7D-3917-11CE-80FB-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{74179610-5A56-11CE-940F-0000C0C14E92}\TypeLib\ = "{E8671A8B-E5DD-11CD-836C-0000C0C14E92}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB52CF7B-3917-11CE-80FB-0000C0C14E92}\ProgID\ = "SSCalendar.SSDateComboCtrl.1" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0A45DB48-BD0D-11D2-8D14-00104B9E072A}\2.0 BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A45DB49-BD0D-11D2-8D14-00104B9E072A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.COMScript.1\CLSID\ = "{4F7AE601-0142-11D3-9DCF-89BE4EFB591E}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7AE600-0142-11D3-9DCF-89BE4EFB591E}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{916694A9-8AD6-11D2-B6FD-0060976C699F}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FDE-1BF9-11D2-BAE8-00104B9E0792}\ProxyStubClsid32 BonziBuddy432.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}\ = "IButtons" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B1BE80A-567F-11D1-B652-0060976C699F}\1.1\HELPDIR BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}\3.0\FLAGS\ = "2" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FD3-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.COMScript\ = "ActiveSkin.COMScript Class" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D41-2CDD-11D3-9DD0-D3CD4078982A}\MiscStatus\1 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE6-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00E212A0-E66D-11CD-836C-0000C0C14E92}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8671A88-E5DD-11CD-836C-0000C0C14E92}\InprocServer32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{916694A8-8AD6-11D2-B6FD-0060976C699F}\TypeLib\ = "{6B1BE80A-567F-11D1-B652-0060976C699F}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FD8-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FD2-1BF9-11D2-BAE8-00104B9E0792}\TypeLib BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83C2D7A1-0DE6-11D3-9DCF-9423F1B2561C}\ProgID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53FA8D4B-2CDD-11D3-9DD0-D3CD4078982A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368C5B10-6A0F-11CE-9425-0000C0C14E92}\InprocServer32\ = "C:\\PROGRA~2\\BONZIB~1\\SSCALA32.OCX" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F55ED2E0-6E13-11CE-918C-0000C0554C0A}\ = "IX" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{643F1354-1D07-11CE-9E52-0000C0554C0A}\InprocServer32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "237969" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14E27A73-69F0-11CE-9425-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB52CF7B-3917-11CE-80FB-0000C0C14E92}\InprocServer32\ = "C:\\PROGRA~2\\BONZIB~1\\SSCALA32.OCX" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B976287-3692-11D0-9B8A-0000C0F04C96}\TypeLib\ = "{0A45DB48-BD0D-11D2-8D14-00104B9E072A}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95A893C3-543A-11D0-AC45-00C04FD97575}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CFC9BA3-FE87-11D2-9DCF-ED29FAFE371D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B1BE804-567F-11D1-B652-0060976C699F}\InprocServer32\ = "C:\\Program Files (x86)\\BonziBuddy432\\Regicon.ocx" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07D0E280-EF44-11CD-836C-0000C0C14E92}\ = "ISSMonth" BonziBuddy432.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 107631.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeSetup.exeSetup.exemsedge.exenssBED8.tmpPcAppStore.exepid process 2684 msedge.exe 2684 msedge.exe 5024 msedge.exe 5024 msedge.exe 3752 identity_helper.exe 3752 identity_helper.exe 1660 msedge.exe 1660 msedge.exe 2812 msedge.exe 2812 msedge.exe 3628 msedge.exe 3628 msedge.exe 3052 Setup.exe 3052 Setup.exe 3052 Setup.exe 3052 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 3908 Setup.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 524 nssBED8.tmp 4580 PcAppStore.exe 4580 PcAppStore.exe 4580 PcAppStore.exe 4580 PcAppStore.exe 4580 PcAppStore.exe 4580 PcAppStore.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
Processes:
msedge.exepid process 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exepid process 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
Setup.exeSetup.exenssBED8.tmpnssBED8.tmpsetDRM.exePcAppStore.exeBonziBuddy432.exeMSAGENT.EXEtv_enua.exepid process 3052 Setup.exe 3908 Setup.exe 1272 nssBED8.tmp 524 nssBED8.tmp 2264 setDRM.exe 4580 PcAppStore.exe 4580 PcAppStore.exe 4580 PcAppStore.exe 4580 PcAppStore.exe 4580 PcAppStore.exe 2248 BonziBuddy432.exe 3852 MSAGENT.EXE 2240 tv_enua.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5024 wrote to memory of 4212 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 4212 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2764 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2684 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2684 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe PID 5024 wrote to memory of 2260 5024 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzi.link1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe963946f8,0x7ffe96394708,0x7ffe963947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6688 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6788 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4544 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6260 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\Setup.exe"C:\Users\Admin\Downloads\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Setup.exe"C:\Users\Admin\Downloads\Setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://pcapp.store/installing.php?guid=54283972-31EB-44BB-ADBA-4E057460C33CX&winver=19041&version=fa.1089fj&nocache=20240328110734.417&_fcid=17116240316858253⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe963946f8,0x7ffe96394708,0x7ffe963947184⤵
-
C:\Users\Admin\PStre\Temp\nssBED8.tmp"C:\Users\Admin\PStre\Temp\nssBED8.tmp" /verify3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\PStre\Temp\nssBED8.tmp"C:\Users\Admin\PStre\Temp\nssBED8.tmp" /internal 1711624031685825 /force3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\PStre\setDRM.exe"C:\Users\Admin\PStre\setDRM.exe" 17116240316858254⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\PStre\PcAppStore.exe"C:\Users\Admin\PStre\PcAppStore.exe" /init default4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3260179734667196070,18075106086136308188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3408 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x318 0x4fc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "2⤵
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocxFilesize
336KB
MD53d225d8435666c14addf17c14806c355
SHA1262a951a98dd9429558ed35f423babe1a6cce094
SHA2562c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
SHA512391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXEFilesize
796KB
MD58a30bd00d45a659e6e393915e5aef701
SHA1b00c31de44328dd71a70f0c8e123b56934edc755
SHA2561e2994763a7674a0f1ec117dae562b05b614937ff61c83b316b135afab02d45a
SHA512daf92e61e75382e1da0e2aba9466a9e4d9703a129a147f0b3c71755f491c68f89ad67cfb4dd013580063d664b69c8673fb52c02d34b86d947e9f16072b7090fb
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXEFilesize
2.5MB
MD573feeab1c303db39cbe35672ae049911
SHA1c14ce70e1b3530811a8c363d246eb43fc77b656c
SHA25688c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
SHA51273f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXEFilesize
3.2MB
MD593f3ed21ad49fd54f249d0d536981a88
SHA1ffca7f3846e538be9c6da1e871724dd935755542
SHA2565678fd744faddb30a87568ae309066ef88102a274fff62f10e4963350da373bc
SHA5127923556c6d6feb4ff4253e853bae3675184eab9b8ce4d4e07f356c8624317801ee807ad5340690196a975824ea3ed500ce6a80c7670f19785139be594fa5e70f
-
C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocxFilesize
152KB
MD566551c972574f86087032467aa6febb4
SHA15ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9
SHA2569028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
SHA51235c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089
-
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpgFilesize
50KB
MD5e8f52918072e96bb5f4c573dbb76d74f
SHA1ba0a89ed469de5e36bd4576591ee94db2c7f8909
SHA256473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82
SHA512d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f
-
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpgFilesize
45KB
MD5108fd5475c19f16c28068f67fc80f305
SHA14e1980ba338133a6fadd5fda4ffe6d4e8a039033
SHA25603f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b
SHA51298c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a
-
C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCXFilesize
1.0MB
MD512c2755d14b2e51a4bb5cbdfc22ecb11
SHA133f0f5962dbe0e518fe101fa985158d760f01df1
SHA2563b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
SHA5124c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf
-
C:\Program Files (x86)\BonziBuddy432\MSINET.OCXFilesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCXFilesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
C:\Program Files (x86)\BonziBuddy432\Regicon.ocxFilesize
76KB
MD532ff40a65ab92beb59102b5eaa083907
SHA1af2824feb55fb10ec14ebd604809a0d424d49442
SHA25607e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
SHA5122cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.batFilesize
279B
MD54877f2ce2833f1356ae3b534fce1b5e3
SHA17365c9ef5997324b73b1ff0ea67375a328a9646a
SHA2568ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff
SHA512dd43ede5c3f95543bcc8086ec8209a27aadf1b61543c8ee1bb3eab9bc35b92c464e4132b228b12b244fb9625a45f5d4689a45761c4c5263aa919564664860c5e
-
C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCXFilesize
472KB
MD5ce9216b52ded7e6fc63a50584b55a9b3
SHA127bb8882b228725e2a3793b4b4da3e154d6bb2ea
SHA2568e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
SHA512444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7
-
C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCXFilesize
320KB
MD597ffaf46f04982c4bdb8464397ba2a23
SHA1f32e89d9651fd6e3af4844fd7616a7f263dc5510
SHA2565db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
SHA5128c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002
-
C:\Program Files (x86)\BonziBuddy432\Uninstall.exeFilesize
65KB
MD5068ace391e3c5399b26cb9edfa9af12f
SHA1568482d214acf16e2f5522662b7b813679dcd4c7
SHA2562288f4f42373affffbaa63ce2fda9bb071fd7f14dbcd04f52d3af3a219b03485
SHA5120ba89fcdbb418ea6742eeb698f655206ed3b84c41ca53d49c06d30baed13ac4dfdb4662b53c05a28db0a2335aa4bc588635b3b205cfc36d8a55edfc720ac4b03
-
C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocxFilesize
320KB
MD548c35ed0a09855b29d43f11485f8423b
SHA146716282cc5e0f66cb96057e165fa4d8d60fbae2
SHA2567a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
SHA512779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99
-
C:\Program Files (x86)\BonziBuddy432\sstabs2.ocxFilesize
288KB
MD57303efb737685169328287a7e9449ab7
SHA147bfe724a9f71d40b5e56811ec2c688c944f3ce7
SHA256596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
SHA512e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0Filesize
471B
MD587ccae6ea2099fb0a7b4ecaf4c12da28
SHA186c231936028a40f254a50967a07d36a330759b1
SHA2563c3b7cc525518282f944d8fc95eaf09e3b95d240d1b49fd933babb4505646651
SHA51250f0312615db48bcb535d967cacd72b7808502fb5e30eba70cd6621d0041b5e2232f0682623b3c7a87ada9f6b189f7032ec5c915511c537a50cf7fe177ef5f75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BEFilesize
471B
MD56fb0c322c12588c325e326e966731cde
SHA1c4deb2304272b747d10f6a86848ef7ce4d21f855
SHA256b470edf9d56f703b3c6564eb5bc732d9822232fa812b76015aba5f4e610d2efa
SHA51261f94b34fc3569afaaa52055985880a27ac0c6dd3f7e79fe807fd1bd5296be10f845d6752b0915b74e350b274e8851ecba8a1627344b2f3d83deabaaef2075ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0Filesize
404B
MD55105ba1eefc8c65d1d4d45199f1fa21a
SHA10500d419fdde60f1307f42e7587c02c7ae46c3e9
SHA25684f434478905e3a4e86050897c6fcd4cb34d6945ae0d4af80b416700288e4575
SHA5129973bc5c0a602ce0d2dedc3923271ac1bab639d4f23662ce9fd7aadbd07b726a5e0a5473cfed29748b2d04523ebcd6087f3f0c4756ff0cac74fc063dcf026f42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BEFilesize
412B
MD5d17ad2e2bb211ed00902010a8b3cd470
SHA198220701e48d9902c963b7211e9105138af98b3c
SHA2560bead5fb63c81b543e2f94219cb9531162523cb8d67af79d1bebe33a441efdbf
SHA5122d22fc32b5035bd8841bc2a50d1059db2987fadeabc3e84b3ee84f579a122d1a28b4b94132b11c38d21ae4368681292d8d3d97972cc459a0fa5cfe3784fea76d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007Filesize
52KB
MD55c77f87f8ceb9c24ac9ed55151aaccc7
SHA11ed0a122cf0a6c32272f1939a3d72c5ed64160cd
SHA2560338658d4c0b3cf7d1a5f658cc442f693e311eb1ecedc2cd8986bb9739195ac3
SHA51256eec3d82fa54bc80612e54585a3835d50681d1c520c7572ea2a99882e8724eb9a2fdff70e5e6dfcfe02b80bc790b1f6e8a30f7592c223df0cd1cb428c02643f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010Filesize
64KB
MD5b3cecdb68c56273a9a559a2d966d7e67
SHA19ae2157fde228d8571bb5ec3a4d3e2ac3ae3218b
SHA25669cbf6f57cae1af820ffa152a0ef459f25647175c7567f662205cbbc80e4aa85
SHA512ab09ffdb889facaa1dc09e811cdc1ac1d1e875037572774e4df80b7d6118150f0a9baedf06b283d1c4fa9772ca9826a80e3f5cd8b2dec5e25463a77431b67f57
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013Filesize
19KB
MD5ce2bdc9ee291575700acedaca2d1a2c0
SHA1817f29c93540b36b63dbec76ae0be774b6d2f4d0
SHA2561ee77085d6e13fcdd5355d7167157d4671e3d3d96f75164d95dcfa6318e86d07
SHA5120736e870fbd29fd1ff93a65cc07fc148b1350126d778b989570cdf01316b7eeebfafd4c3932dfd885d95c325e2a4664bcbeebc10f3b5e668bf164f692778fbdc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018Filesize
19KB
MD548f1bb392d4cf86123e80420497fd7f9
SHA1d93e1b87852b3664d4863aba65691772e9b516a2
SHA25667dffef53ad5c00c67b5ec3a9f4e603ff710cfe14588087c2703074eaa223369
SHA512dc986587ed25b08b194e1232313e6499af0576857786ddb39bdf2a066c36ce654aaa5355d920319d2a46d28735318d471db91c32c316ee426601e9c3506b2d08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ba785d22d8a95a5_0Filesize
3KB
MD53bb417b87d443e6135de1378b778a2bb
SHA115a778eab3d1b44487e132798a4706719bdc4f12
SHA25617628b4d2e2ad9b65b416c15485576bc8655d5de6d6541bc2f0c8732ff017160
SHA5120a3daa441a52fdfdc70ca669766efee1bd187bb729482b1507ef4a854ef0f8bfa3a1e41664195b6fbc7bd781e8baa2b8400d90f8820dca88e82da10ce09e7b05
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1008B
MD52a66412545b75b2d892b3a71bf9ea4a4
SHA1a9ab74a18c0b2504ff850e8659f9252e62e69929
SHA256586bbf2be91e6197c3f124b9ae5f26e131f38289456cffa4857252bb0fb84547
SHA51273b48a309bda427f3a3444b3741e37f1945054a84deb39158a98f8af0391277293b5cdae39f4f4fa8597da5c3f8b15cadfe204a093c3a005f83347e451cebd66
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5c635362ec1351b38e73590607c8f44f8
SHA1bb2e1ca8fab3b149d7b5b6503cb436b839c3fb3a
SHA256eb8cf3f42e585eb86a817c5841c87ce2ca4f00720655b41defca0c366e8449b2
SHA51209cc5232b48c45c8c8550b07f840c7ffb423b55ccaea1b1a9c5d6100b7214cdb0542645773feb1c9c2a4fda1a1fac307324323ac63a79350c84c70df31592e6e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
744B
MD56f552995fd8175d4057804492c82189f
SHA19b8066eb8d268151743c1fbad2fff7f376e711f5
SHA256f5ad0ac483ac2b69d35e84eb7745ad873983b71c46b102d7d228341f8433686a
SHA512978a029be09465f756f27524fe6e07c9f160be022ff13a2b6539bcbda0a3331bb835970c2e19456c61846a8417b81a9631f064ae1a1bcec0a6c9ae364c519a31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5aa88f12ad8685a5a8096a91d5ecbd15f
SHA1a55a05e949667f7032fb8b5770f0cc255f1cccee
SHA256f0934192f9200d21b8ef759024c46d5a161ec2046f7fb6ae64371e11b4d9c5b9
SHA512a3351114e808074009a98d262015d77c84b6c44595715ff2bdf9556e63ea4fe01bc8f5da078e3741865eb48a8174babd3f85db829c732c8b725cdbb4c0a67dc4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
3KB
MD572a70eb529b66931e51a593ba7300d0d
SHA19f855b2b64e5a1df6b6e69d0c47f70804e102a4f
SHA256fbdb89cf8f0efd6739afba44f309f307c7ed6e92837d93ee33f6c59f7dbb709d
SHA51261ea9c621f332358a8de663b20657d346f98a047d867d94dad391a72c9edf6c0e7c53ceba3b938b076f8923cccd6f17727d54f1b5a6af99c48e6e583841269cc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
5KB
MD54111d46f50e04ed5e8f8e8a60510d692
SHA1687551c6b09bea76d6018044b166add2b30889c5
SHA25697b9771418f2df74bcb6ac733c14992980c133c72ad84f1f196de535c5d00eb0
SHA512c0fd2054c48cab7bf62d489b6d3b81b7535d353ba3d7481c19fe3d2f0a72911dd96ef80a63cc5a41b82277c2a53325c4492fca184f863f017096de3973d48327
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD54639d21aff00de81d7f1a8df3a68508c
SHA1fa18ae213d62df05fa364763f3c7e5182fc747e1
SHA2563dcc34c69e44a063925c3f6113071f6d633c5d68db75caca65220e44a3501fe8
SHA512f4c7df32faa8bc874fd9e35c552f3f4eb72eb556d49cfaec4f8ec098c738b67f8269a89b97f37f84441ccf5d6834b2adf8b47a91295ac0fc691c4dc7531d4ec6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD553cc5acb9f99a22f8953e6fd2776a1b5
SHA1ae9d628cb6d52e02284c346c472a5fb42896dde6
SHA256b319b242ca4c13a50b7e843caa30c7e1b1ac71c4378edbfb45156390122e24c7
SHA51268ebdee0db7c2a56bef02a755ff5b93edabb343e1ab4ed69758a0f93089171808d77bbd799381aad519da890d02a4c7bc42e9d47367310d7b0c9468b5de0e487
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5de712540430430a26650955909e77969
SHA1c9193426b3fe51d170f438dc19d1466b9b66b9d6
SHA2564e57fdd552017ec2ab1547570f7aafb31e7f4ea21932143ab1b0584af382df43
SHA512490d3e43749d243ce57f68931d3a1bea2c3b6415a102f105551da83c3fcc83eeececf3e6b42aa57c7b4e0cbca05958926ad00f945e293381675c4f73fb541403
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD51de065c29a01d384dbc799ff8212851f
SHA11d67822673f31e93eea12244d43abb1e65c1abae
SHA256198b0e1277efe233fc0b7003cfdbf2345dd5421a5ced80f533c9fe9e43816938
SHA5122091902a3bf195509aafebc3a97b01ba7db6ad82b48bc900b400054316f5d03fbfd812813eb2afe30c9d2641689ee25710f8fcf522ed211e4063825fb68e9546
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
10KB
MD52784a2cdecac0526fb9929d1b63bbbf6
SHA1570ff6c12d6859349dc10a56b6c4e1e97f711253
SHA256619388471dc3e14fb8b3b7c4defe850dc1ac1b809886d3fd6ec681eda7ec2c70
SHA512dae55238a59136b07d07b86b64905ce1314f7acc071925c6aae6b111c274f86d5c91da04173ae202efa1612af43769393d5afe9ab1426e3e181b151f614f5994
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5040260a6a684aecc8128e8b5e3699dd6
SHA124486c39a96c9bd9a203466d1eeaf94330a69114
SHA25628053cffb8712c13c99559f7ff366354990fd9ef2fe399e1c90f54ecbce74b34
SHA512631ff14906bb3673ecfa509d44f74a172bd37ae55afd28dd2ef27f048b172f69c2b3af6c84274876f6efccfb025c7196c6336e57eb552b2bd5cb4b5a0ab966c7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5c2ef1d773c3f6f230cedf469f7e34059
SHA1e410764405adcfead3338c8d0b29371fd1a3f292
SHA256185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA5122ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
538B
MD54e76c240d758f5c3177610ec46d5116c
SHA1f6d80fdf911bd43483f65f24d88d1e8efceb0cc4
SHA256211ddfc560882d151160c8311a3f799aeefc90a53d493116655129ff57d855af
SHA512e3a701dafe10cef7e92d7a9535d995a971416d7108e8615a5ee2bbe0eb9fcf6bea7adb796e5286450dd7fcff6f1152992c5deca4c659e028fcdbe396bb507885
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
538B
MD5c364501a0ea8d6af0fa5990066c6b593
SHA1cbfb1526125560f4bd36aa3b46bb06093578324c
SHA2567728222573975418eaf875ae8571d0513f191743abb5a1151827cc3dcf259313
SHA512d4085079bf6d9470a567f8b18cd15c105b572cac4e51564e9335798d0bd9e8947b04a52905708b7496e18627faf61c19bcc34fe796dde8f89687e6cb16bf1dc2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
202B
MD57a47082da6c54246271a87fe383cae5e
SHA12d50988283ce0d0b48ea48a9cbb415a90abd08f5
SHA256724e9c4d47bd04f414ee733c49f3892995d9f6207246bee92fbe86d0ecc02c95
SHA51226d842af0116bd145b6c345777564ed12e1218bdeae685b527d660cc2a4953e673f4ec9292f6294a73605fa2fab29f63ef71b8824b869ae2d75e76ee17c26e30
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
538B
MD553ff9b18d61accdc98f586bff8fb6ea5
SHA1d363c1ec6ed78864eb503a69121879ee6ee03077
SHA2564fbb62dd3f92c94fb67bbb6a4df56bce376fe82323c9876d842aeef7f29ccd14
SHA5126dea92f730be50526c59425c9e51e2f7324e8bfee718e0add7318165b355250c688b4f20c5068f10bea7132891039480a012966e0fcc63949c848ea21c63b4c7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581aa7.TMPFilesize
202B
MD5b6e69389b0e0c06f393a18c5d932ca5a
SHA1b31392a8f5ccc51087f182ca3eacdb71f7aeb0b3
SHA256454a8e94ed3fcca132d2997e9f986be2d088f6b1f93926c92502f57c4c19c9a9
SHA5122d328b6ea8be2b8f767d6392f4ba215ec4cf6ce1bf1a8cb002f7be55d6cf88377d53bac71af78d5c31158b29e0876d60c39e4d0027d16095d186dc68930b7941
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6b248d9-567f-4244-ad2c-d81102b75c77.tmpFilesize
7KB
MD56b2822df3f70d52294f744c344bd6db7
SHA155cc45da9004234f32a6472c1054bcd4b041472e
SHA2563086ace13c9ddcec67a86a693cfc0a3d64dfcae639257998ab7b0a7c3409966d
SHA5122d05daf2684d72935b4f1f9bb10a6316258b195c4aaad5f3672e21e7b80b484829cc809becaeb7900238d456bdc804ea79bdd04c1142ac7a4c4a69850af31646
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD507e2d9ddd8e9fe78d6cfae742e0d7ba0
SHA16a37bf2c32b729644d6a982f14454a84756352f9
SHA25670e50621ad8a8171925e84c8497e79d8d77d8f07d9fb6ddbf723d777866f2d4e
SHA512e54cfe9dc7b7e855ac93c7edd41ee42583a0ecdab257563e8d916e00ae51a7ad4d60e9ac57ecb110c087e4a7f53ad7753d69ddbde195a58c59abc56d56ff31bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD59fbb9a85ced03c0e544720106055db9b
SHA1b086da2f60da483bf742f79b543d418eb846b74a
SHA256b32e0a6500f78a1241313807dbfdc6b68f4c9c9de209de809114fe520b815c69
SHA512a0b395110be74d5efb4b0b8156f230b854a5a7c39490381fe2384e5ac36d0b90801870de277a1d4de99de73b341c295738ad4c42c3b3f75e26f61231ae91db61
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5d0f9442a6a9ab52c689f129b0f358959
SHA118615bb9ee3485d6ad06b59b0ab019be891dcd49
SHA256431d8bbd709fec2268e38c5a4208a7433840331290887ac684df30ad70f48f93
SHA51224897fe3f0db573554b9082888132f53c9a6e770261ac468a8c5d7fe1aa05b4f87493e38a539bdc9117add157b4097c0a804ef0bf0c348b30330bffbc9488980
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5af897a5874f3cc345ffc7311a3d1f2dd
SHA1973739950f0513757ca13b3277150ac8e4b6d403
SHA2563579b886745431eeef330e1937f9b99aa50f1bdc834a32779202837a2a598cce
SHA51227dddddc1ab594a5661e0ddfc13c87367aa398c6c801154aeffe1376ef3d28e7d1b09a2fe73710e7c718ed0d3ddf95f44291ceca1045911efc9088fb31ac8f91
-
C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmpFilesize
8.0MB
MD58e15b605349e149d4385675afff04ebf
SHA1f346a886dd4cb0fbbd2dff1a43d9dfde7fce348b
SHA256803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee
SHA5128bf957ef72465fe103dbf83411df9082433eead022f0beccab59c9e406bbd1e4edb701fd0bc91f195312943ad1890fee34b4e734578298bb60bb81ed6fa9a46d
-
C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmpFilesize
8.0MB
MD5596cb5d019dec2c57cda897287895614
SHA16b12ea8427fdbee9a510160ff77d5e9d6fa99dfa
SHA256e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff
SHA5128f5fc432fd2fc75e2f84d4c7d21c23dd1f78475214c761418cf13b0e043ba1e0fc28df52afd9149332a2134fe5d54abc7e8676916100e10f374ef6cdecff7a20
-
C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmpFilesize
8.0MB
MD57c8328586cdff4481b7f3d14659150ae
SHA1b55ffa83c7d4323a08ea5fabf5e1c93666fead5c
SHA2565eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc
SHA512aa4220217d3af263352f8b7d34bd8f27d3e2c219c673889bc759a019e3e77a313b0713fd7b88700d57913e2564d097e15ffc47e5cf8f4899ba0de75d215f661d
-
C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmpFilesize
8.0MB
MD54f398982d0c53a7b4d12ae83d5955cce
SHA109dc6b6b6290a3352bd39f16f2df3b03fb8a85dc
SHA256fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2
SHA51273d9f7c22cf2502654e9cd6cd5d749e85ea41ce49fd022378df1e9d07e36ae2dde81f0b9fc25210a9860032ecda64320ec0aaf431bcd6cefba286328efcfb913
-
C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmpFilesize
8.0MB
MD594e0d650dcf3be9ab9ea5f8554bdcb9d
SHA121e38207f5dee33152e3a61e64b88d3c5066bf49
SHA256026893ba15b76f01e12f3ef540686db8f52761dcaf0f91dcdc732c10e8f6da0e
SHA512039ccf6979831f692ea3b5e3c5df532f16c5cf395731864345c28938003139a167689a4e1acef1f444db1fe7fd3023680d877f132e17bf9d7b275cfc5f673ac3
-
C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmpFilesize
1.8MB
MD5b3b7f6b0fb38fc4aa08f0559e42305a2
SHA1a66542f84ece3b2481c43cd4c08484dc32688eaf
SHA2567fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b
SHA5120f4156f90e34a4c26e1314fc0c43367ad61d64c8d286e25629d56823d7466f413956962e2075756a4334914d47d69e20bb9b5a5b50c46eca4ef8173c27824e6c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLLFilesize
73KB
MD581e5c8596a7e4e98117f5c5143293020
SHA145b7fe0989e2df1b4dfd227f8f3b73b6b7df9081
SHA2567d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
SHA51205b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLLFilesize
40KB
MD548c00a7493b28139cbf197ccc8d1f9ed
SHA1a25243b06d4bb83f66b7cd738e79fccf9a02b33b
SHA256905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
SHA512c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLLFilesize
160KB
MD5237e13b95ab37d0141cf0bc585b8db94
SHA1102c6164c21de1f3e0b7d487dd5dc4c5249e0994
SHA256d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
SHA5129d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLLFilesize
60KB
MD5a334bbf5f5a19b3bdb5b7f1703363981
SHA16cb50b15c0e7d9401364c0fafeef65774f5d1a2c
SHA256c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
SHA5121fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLLFilesize
64KB
MD57c5aefb11e797129c9e90f279fbdf71b
SHA1cb9d9cbfbebb5aed6810a4e424a295c27520576e
SHA256394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
SHA512df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLLFilesize
60KB
MD54fbbaac42cf2ecb83543f262973d07c0
SHA1ab1b302d7cce10443dfc14a2eba528a0431e1718
SHA2566550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
SHA5124146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLLFilesize
36KB
MD5b4ac608ebf5a8fdefa2d635e83b7c0e8
SHA1d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9
SHA2568414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
SHA5122c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLLFilesize
60KB
MD59fafb9d0591f2be4c2a846f63d82d301
SHA11df97aa4f3722b6695eac457e207a76a6b7457be
SHA256e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
SHA512ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXEFilesize
268KB
MD55c91bf20fe3594b81052d131db798575
SHA1eab3a7a678528b5b2c60d65b61e475f1b2f45baa
SHA256e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
SHA512face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLLFilesize
28KB
MD50cbf0f4c9e54d12d34cd1a772ba799e1
SHA140e55eb54394d17d2d11ca0089b84e97c19634a7
SHA2566b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
SHA512bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLPFilesize
8KB
MD5466d35e6a22924dd846a043bc7dd94b8
SHA135e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10
SHA256e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
SHA51223b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INFFilesize
2KB
MD5e4a499b9e1fe33991dbcfb4e926c8821
SHA1951d4750b05ea6a63951a7667566467d01cb2d42
SHA25649e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
SHA512a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLBFilesize
28KB
MD5f1656b80eaae5e5201dcbfbcd3523691
SHA16f93d71c210eb59416e31f12e4cc6a0da48de85b
SHA2563f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
SHA512e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INFFilesize
7KB
MD5b127d9187c6dbb1b948053c7c9a6811f
SHA1b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9
SHA256bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
SHA51288e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLLFilesize
52KB
MD5316999655fef30c52c3854751c663996
SHA1a7862202c3b075bdeb91c5e04fe5ff71907dae59
SHA256ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
SHA5125555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44
-
C:\Users\Admin\AppData\Local\Temp\nsdA564.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
C:\Users\Admin\AppData\Local\Temp\nsdA564.tmp\image.gifFilesize
997B
MD51636218c14c357455b5c872982e2a047
SHA121fbd1308af7ad25352667583a8dc340b0847dbc
SHA2569b8b6285bf65f086e08701eee04e57f2586e973a49c5a38660c9c6502a807045
SHA512837fa6bcbe69a3728f5cb4c25c35c1d13e84b11232fc5279a91f21341892ad0e36003d86962c8ab1a056d3beeb2652c754d51d6ec7eee0e0ebfe19cd93fb5cb0
-
C:\Users\Admin\AppData\Local\Temp\nsdA564.tmp\inetc.dllFilesize
38KB
MD5a35cdc9cf1d17216c0ab8c5282488ead
SHA1ed8e8091a924343ad8791d85e2733c14839f0d36
SHA256a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df
SHA5120f15b00d0bf2aabd194302e599d69962147b4b3ef99e5a5f8d5797a7a56fd75dd9db0a667cfba9c758e6f0dab9ced126a9b43948935fe37fc31d96278a842bdf
-
C:\Users\Admin\AppData\Local\Temp\nsdA564.tmp\nsDialogs.dllFilesize
9KB
MD56c3f8c94d0727894d706940a8a980543
SHA10d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA25656b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
SHA5122094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
-
C:\Users\Admin\AppData\Local\Temp\nsdA564.tmp\nsJSON.dllFilesize
23KB
MD5f4d89d9a2a3e2f164aea3e93864905c9
SHA14d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA25664b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
SHA512dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
-
C:\Users\Admin\AppData\Local\Temp\nsh2E6B.tmp\Math.dllFilesize
67KB
MD585428cf1f140e5023f4c9d179b704702
SHA11b51213ddbaedfffb7e7f098f172f1d4e5c9efba
SHA2568d9a23dd2004b68c0d2e64e6c6ad330d0c648bffe2b9f619a1e9760ef978207a
SHA512dfe7f9f3030485caf30ec631424120030c3985df778993342a371bf1724fa84aa885b4e466c6f6b356d99cc24e564b9c702c7bcdd33052172e0794c2fdecce59
-
C:\Users\Admin\AppData\Local\Temp\nskAA65.tmp\modern-wizard.bmpFilesize
25KB
MD5cbe40fd2b1ec96daedc65da172d90022
SHA1366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA2563ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
SHA51262990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
-
C:\Users\Admin\Downloads\Bon.zipFilesize
49.8MB
MD565259c11e1ff8d040f9ec58524a47f02
SHA12d5a24f7cadd10140dd6d3dd0dc6d0f02c2d40fd
SHA256755bd7f1fc6e93c3a69a1125dd74735895bdbac9b7cabad0506195a066bdde42
SHA51237096eeb1ab0e11466c084a9ce78057e250f856b919cb9ef3920dad29b2bb2292daabbee15c64dc7bc2a48dd930a52a2fb9294943da2c1c3692863cec2bae03d
-
C:\Users\Admin\Downloads\Setup.exeFilesize
180KB
MD5089ed3a6fe8074c292b51e200b00a26a
SHA17ccc358d05c2ca3e0c76ab86446ad49c593dfe4e
SHA256f425625723cf59cc78a5b14533089807a366e7f805427ab4d00831604899dfa0
SHA512cf1c6039791df2fa723dd8379a5c37f118db526a9adf375498fb93bc616075c59644a0e3cb2a45c2a1ca435efa27b4e5119a8e9565dd4f916e4596fb63953574
-
C:\Users\Admin\PStre\Temp\nssBED8.tmpFilesize
85.6MB
MD56f3e37baf6e73633229dbb27be22c1ab
SHA1a722a70a8602927ad8b7cb1518771e44db9befbd
SHA256c8d98b0e2f127effdd5e40d206b7afbcfac6b1b96a60f2f8e0987f0c93e571e0
SHA512d9369c63e4c8ed8c9402ae80c51ebea6d1454202532a97d1b86ddb8ce9b5e32953d1bcc5bf691ecc714c856eb1b4c4e039b0e64caa68fd127f74b81005de7b56
-
C:\Users\Admin\PStre\nwjs\locales\bg.pak.infoFilesize
831KB
MD5f2a134d21e79420e0e025b2f5d0e0564
SHA1e4f6ead92945b87c3b980878c707467dc84cd616
SHA2564c125a498bd06dd1cbbe3e4f05dca6fa47ce19297ad9f92df3af65eaf0a05d67
SHA512032e8c44c1edbf6ba3effce1d67e5355e926b5509c8aa3dcf15677efe9fe3a2bf27d81d7d7ffae3a5caae1755830ad016a11f1417dddbf49977bd52083aaee1b
-
C:\Windows\msagent\chars\Bonzi.acsFilesize
5.0MB
MD51fd2907e2c74c9a908e2af5f948006b5
SHA1a390e9133bfd0d55ffda07d4714af538b6d50d3d
SHA256f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
SHA5128eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171
-
C:\Windows\msagent\chars\Peedy.acsFilesize
4.0MB
MD549654a47fadfd39414ddc654da7e3879
SHA19248c10cef8b54a1d8665dfc6067253b507b73ad
SHA256b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5
SHA512fa9cab60fadd13118bf8cb2005d186eb8fa43707cb983267a314116129371d1400b95d03fbf14dfdaba8266950a90224192e40555d910cf8a3afa4aaf4a8a32f
-
\??\pipe\LOCAL\crashpad_5024_SORYKZFIOQYBRYTJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2248-1936-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB