Overview

overview

8

Static

static

3

BonziBuddy432.exe

windows7-x64

8

BonziBuddy432.exe

windows10-1703-x64

8

BonziBuddy432.exe

windows10-2004-x64

3

BonziBuddy432.exe

windows11-21h2-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/04/2024, 18:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BonziBuddy432.exe
  • Size 49.9MB
  • Sample240404-wrpxysfa53
  • SHA256 f1e859d99072e35f20e172d8458e3ea1baf8ba86c8c9e311a0debcd2acd5d0fc
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 37 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 62 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BonziBuddy432.exe
    "C:\Users\Admin\AppData\Local\Temp\BonziBuddy432.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE
        MSAGENT.EXE
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4992
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
          4⤵
          • Loads dropped DLL
          PID:832
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
          4⤵
          • Loads dropped DLL
          PID:3568
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
          4⤵
          • Loads dropped DLL
          PID:3188
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
          4⤵
          • Loads dropped DLL
          PID:344
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
          4⤵
          • Loads dropped DLL
          PID:4084
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
          4⤵
          • Loads dropped DLL
          PID:656
        • C:\Windows\msagent\AgentSvr.exe
          "C:\Windows\msagent\AgentSvr.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:2868
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          4⤵
            PID:2756
        • C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe
          tv_enua.exe
          3⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
            4⤵
            • Loads dropped DLL
            PID:5064
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
            4⤵
            • Loads dropped DLL
            PID:2324
          • C:\Windows\SysWOW64\grpconv.exe
            grpconv.exe -o
            4⤵
              PID:2256
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4120
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:4320
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:556
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5056
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x348
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4332
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4160
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3188
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        PID:308
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        PID:3572
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
          PID:5432
        • C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
          "C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5272
        • C:\Windows\msagent\AgentSvr.exe
          C:\Windows\msagent\AgentSvr.exe -Embedding
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4792
        • C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
          "C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:5524

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ActiveSkin.ocx
              • Path C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx
              • Size 336KB
              • SHA256 2c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              BonziBDY_2.EXE
              • Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE
              • Size 796KB
              • SHA256 1e2994763a7674a0f1ec117dae562b05b614937ff61c83b316b135afab02d45a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              BonziBDY_35.EXE
              • Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE
              • Size 2.5MB
              • SHA256 88c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              BonziBDY_4.EXE
              • Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
              • Size 3.2MB
              • SHA256 5678fd744faddb30a87568ae309066ef88102a274fff62f10e4963350da373bc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              page17.jpg
              • Path C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg
              • Size 50KB
              • SHA256 473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              page18.jpg
              • Path C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg
              • Size 45KB
              • SHA256 03f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Reg.nbd
              • Path C:\Program Files (x86)\BonziBuddy432\Reg.nbd
              • Size 140B
              • SHA256 375ecd89ee18d7f318cf73b34a4e15b9eb16bc9d825c165e103db392f4b2a68b
              • MD5 SHA1 SHA512
              Submit Download

              CheckRuntimes.bat
              • Path C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat
              • Size 279B
              • SHA256 8ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff
              • MD5 SHA1 SHA512
              Submit Download

              MSAGENT.EXE
              • Path C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE
              • Size 391KB
              • SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              tv_enua.exe
              • Path C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe
              • Size 997KB
              • SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SSCALB32.OCX
              • Path C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX
              • Size 320KB
              • SHA256 5db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Uninstall.exe
              • Path C:\Program Files (x86)\BonziBuddy432\Uninstall.exe
              • Size 65KB
              • SHA256 2288f4f42373affffbaa63ce2fda9bb071fd7f14dbcd04f52d3af3a219b03485
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              edgecompatviewlist[1].xml
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3HONFD4R\edgecompatviewlist[1].xml
              • Size 74KB
              • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ~DF5A51B6B744F96A1A.TMP
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF5A51B6B744F96A1A.TMP
              • Size 36KB
              • SHA256 38bec1ed60d7a3f59b4f78663cad2d51dd888c6938bc0ac0062d336b35630077
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0001.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp
              • Size 8.0MB
              • SHA256 803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0002.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp
              • Size 8.0MB
              • SHA256 e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0003.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp
              • Size 8.0MB
              • SHA256 5eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0004.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmp
              • Size 8.0MB
              • SHA256 fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0005.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmp
              • Size 8.0MB
              • SHA256 026893ba15b76f01e12f3ef540686db8f52761dcaf0f91dcdc732c10e8f6da0e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0006.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmp
              • Size 1.8MB
              • SHA256 7fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTANM.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
              • Size 40KB
              • SHA256 905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTCTL.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL
              • Size 160KB
              • SHA256 d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTDP2.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
              • Size 60KB
              • SHA256 c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTDPV.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
              • Size 64KB
              • SHA256 394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTMPX.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
              • Size 60KB
              • SHA256 6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTPSH.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
              • Size 36KB
              • SHA256 8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTSR.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
              • Size 60KB
              • SHA256 e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGENTSVR.EXE
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
              • Size 268KB
              • SHA256 e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGT0409.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
              • Size 28KB
              • SHA256 6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGT0409.HLP
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
              • Size 8KB
              • SHA256 e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGT20.INF
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
              • Size 2KB
              • SHA256 49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
              • MD5 SHA1 SHA512
              Submit Download

              AGTCTL15.TLB
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
              • Size 28KB
              • SHA256 3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AGTINST.INF
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
              • Size 7KB
              • SHA256 bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSLWVTTS.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
              • Size 52KB
              • SHA256 ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Msvcirt.dll
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Msvcirt.dll
              • Size 76KB
              • SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Msvcp50.dll
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Msvcp50.dll
              • Size 552KB
              • SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              W95INF16.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\W95INF16.DLL
              • Size 2KB
              • SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
              • MD5 SHA1 SHA512
              Submit Download

              W95INF32.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\W95INF32.DLL
              • Size 4KB
              • SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              andmoipa.ttf
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\andmoipa.ttf
              • Size 29KB
              • SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              tv_enua.dll
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.dll
              • Size 1.2MB
              • SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              tv_enua.hlp
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.hlp
              • Size 11KB
              • SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              tv_enua.inf
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.inf
              • Size 2KB
              • SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
              • MD5 SHA1 SHA512
              Submit Download

              tvenuax.dll
              • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tvenuax.dll
              • Size 40KB
              • SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Bonzi.acs
              • Path C:\Windows\msagent\chars\Bonzi.acs
              • Size 5.0MB
              • SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Peedy.acs
              • Path C:\Windows\msagent\chars\Peedy.acs
              • Size 4.0MB
              • SHA256 b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Bonzi's Beach Checkers.exe
              • Path \Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exe
              • Size 7.8MB
              • SHA256 821a16b65f68e745492419ea694f363926669ac16f6b470ed59fe5a3f1856fcb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              BonziCheckers.ocx
              • Path \Program Files (x86)\BonziBuddy432\BonziCheckers.ocx
              • Size 152KB
              • SHA256 9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSCOMCTL.OCX
              • Path \Program Files (x86)\BonziBuddy432\MSCOMCTL.OCX
              • Size 1.0MB
              • SHA256 3b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSINET.OCX
              • Path \Program Files (x86)\BonziBuddy432\MSINET.OCX
              • Size 112KB
              • SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSWINSCK.OCX
              • Path \Program Files (x86)\BonziBuddy432\MSWINSCK.OCX
              • Size 105KB
              • SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Regicon.ocx
              • Path \Program Files (x86)\BonziBuddy432\Regicon.ocx
              • Size 76KB
              • SHA256 07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SSCALA32.OCX
              • Path \Program Files (x86)\BonziBuddy432\SSCALA32.OCX
              • Size 472KB
              • SHA256 8e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msvbvm60.dll
              • Path \Program Files (x86)\BonziBuddy432\msvbvm60.dll
              • Size 1.3MB
              • SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssa3d30.ocx
              • Path \Program Files (x86)\BonziBuddy432\ssa3d30.ocx
              • Size 320KB
              • SHA256 7a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              sstabs2.ocx
              • Path \Program Files (x86)\BonziBuddy432\sstabs2.ocx
              • Size 288KB
              • SHA256 596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ADVPACK.DLL
              • Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
              • Size 73KB
              • SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/2184-1180-0x0000027C27630000-0x0000027C27632000-memory.dmp
              Download

              memory/2184-1202-0x0000027C26490000-0x0000027C26492000-memory.dmp
              Download

              memory/2184-1117-0x0000027C16000000-0x0000027C16002000-memory.dmp
              Download

              memory/2184-1124-0x0000027C16030000-0x0000027C16032000-memory.dmp
              Download

              memory/2184-1126-0x0000027C16050000-0x0000027C16052000-memory.dmp
              Download

              memory/2184-1150-0x0000027C264C0000-0x0000027C264C2000-memory.dmp
              Download

              memory/2184-1162-0x0000027C27280000-0x0000027C27282000-memory.dmp
              Download

              memory/2184-1165-0x0000027C272E0000-0x0000027C272E2000-memory.dmp
              Download

              memory/2184-1170-0x0000027C27430000-0x0000027C27432000-memory.dmp
              Download

              memory/2184-1172-0x0000027C272D0000-0x0000027C272D2000-memory.dmp
              Download

              memory/2184-1243-0x0000027C26B10000-0x0000027C26B12000-memory.dmp
              Download

              memory/2184-1178-0x0000027C27610000-0x0000027C27612000-memory.dmp
              Download

              memory/2184-1168-0x0000027C27420000-0x0000027C27422000-memory.dmp
              Download

              memory/2184-1241-0x0000027C269B0000-0x0000027C269B2000-memory.dmp
              Download

              memory/2184-1204-0x0000027C26850000-0x0000027C26852000-memory.dmp
              Download

              memory/2184-1206-0x0000027C26860000-0x0000027C26862000-memory.dmp
              Download

              memory/2184-1208-0x0000027C26880000-0x0000027C26882000-memory.dmp
              Download

              memory/2184-1210-0x0000027C26890000-0x0000027C26892000-memory.dmp
              Download

              memory/2184-1212-0x0000027C269E0000-0x0000027C269E2000-memory.dmp
              Download

              memory/2184-1223-0x0000027C264E0000-0x0000027C264E2000-memory.dmp
              Download

              memory/2184-1228-0x0000027C26960000-0x0000027C26962000-memory.dmp
              Download

              memory/2184-1239-0x0000027C26930000-0x0000027C26932000-memory.dmp
              Download

              memory/2272-1100-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/2272-12-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/2272-609-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/4120-1099-0x000001B2D79E0000-0x000001B2D79E2000-memory.dmp
              Download

              memory/4120-1080-0x000001B2D7800000-0x000001B2D7810000-memory.dmp
              Download

              memory/4120-1064-0x000001B2D7420000-0x000001B2D7430000-memory.dmp
              Download