hxxps://itchio-mirror[.]cb031a832f44726753d6267436f3b414[.]r2[.]cloudflarestorage[.]com/upload2/game/1186924/4412630?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=3edfcce40115d057d0b5606758e7e9ee%2F20240803%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20240803T052413Z&X-Amz-Expires=60&X-Amz-SignedHeaders=host&X-Amz-Signature=3434fef49d18f045d18fe2cac996ae6a8eaee4e55723a911c3cfc7a7f6873cc3

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-08-2024 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://itchio-mirror.cb031a832f44726753d6267436f3b414.r2.cloudflarestorage.com/upload2/game/1186924/4412630?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=3edfcce40115d057d0b5606758e7e9ee%2F20240803%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20240803T052413Z&X-Amz-Expires=60&X-Amz-SignedHeaders=host&X-Amz-Signature=3434fef49d18f045d18fe2cac996ae6a8eaee4e55723a911c3cfc7a7f6873cc3

Score

8^/10

aspackv2 defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000100000002aa07-640.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
2012	BonziKill.exe
2176	BonziBuddy_original.exe
4920	BonziKill.exe
3304	BonziBuddy_original.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BonziKill.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBuddy_original.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBuddy_original.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 273741.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BonziKill.exe:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2932	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
3948	msedge.exe
3948	msedge.exe
904	msedge.exe
904	msedge.exe
952	identity_helper.exe
952	identity_helper.exe
548	msedge.exe
548	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
2176	BonziBuddy_original.exe
2176	BonziBuddy_original.exe
3304	BonziBuddy_original.exe
3304	BonziBuddy_original.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
2176	BonziBuddy_original.exe
2176	BonziBuddy_original.exe
3304	BonziBuddy_original.exe
3304	BonziBuddy_original.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2176	BonziBuddy_original.exe
2176	BonziBuddy_original.exe
3304	BonziBuddy_original.exe
3304	BonziBuddy_original.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3272	3948	msedge.exe	78
PID 3948 wrote to memory of 3272	3948	msedge.exe	78
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 3492	3948	msedge.exe	79
PID 3948 wrote to memory of 2756	3948	msedge.exe	80
PID 3948 wrote to memory of 2756	3948	msedge.exe	80
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81
PID 3948 wrote to memory of 5004	3948	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://itchio-mirror.cb031a832f44726753d6267436f3b414.r2.cloudflarestorage.com/upload2/game/1186924/4412630?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=3edfcce40115d057d0b5606758e7e9ee%2F20240803%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20240803T052413Z&X-Amz-Expires=60&X-Amz-SignedHeaders=host&X-Amz-Signature=3434fef49d18f045d18fe2cac996ae6a8eaee4e55723a911c3cfc7a7f6873cc3
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fb063cb8,0x7ff9fb063cc8,0x7ff9fb063cd8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Users\Admin\Downloads\BonziKill.exe
  "C:\Users\Admin\Downloads\BonziKill.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2012
- - C:\bonzi\BonziBuddy_original.exe
    "C:\bonzi\BonziBuddy_original.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,5512064416996902691,991198587959292681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3824

C:\Users\Admin\Downloads\BonziKill.exe
"C:\Users\Admin\Downloads\BonziKill.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4920
- C:\bonzi\BonziBuddy_original.exe
  "C:\bonzi\BonziBuddy_original.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3304

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\BonziKill.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
161698db6cb7d727252c859f1d0c5120

SHA1
72671c4ed27e62c90b9ec4d23f07271786508d7c

SHA256
d447fb89f26e4314551bab167e77ac55817f6141a955619ae77e19ca76db43b1

SHA512
3eae273c47eb9fc2602cbc367ea0193ea71a2c0c7f6e9f4b2a298e4118b789338377845350e09d34e5b9ef5362032103204624b9598cf042f327b5046648dd45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87a60ef51d599124ea636c1603f7dc79

SHA1
4b1df99cace5baa3a15b0525126f8b692bbb545e

SHA256
7570653ad08a39bd004773c2158d831e96d8fe869dd731bf1ec6b5e66ce68e3d

SHA512
98a6ee6321016615a6195535b20446e1b57c1bc27a3101574430e5996d0a65686a6e70dcea23a9e9984e6d39729d5ade5053b6531ec5bcfdc1b7fa07f322b879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba0dce2a2b0f0fda2869aaa5b17450eb

SHA1
41bf49bac9748e8ba9164eeda60b954a26d64cf2

SHA256
bab2659bbfc383f953c41a402a4d04ce71ad8d5f9cd49ea61052fddc1ca1c555

SHA512
1f2653247812c636468b0dbd649c2498c6d8a5172dc82b52a34e446b82c1a47664a74a2badd5a81f2a9a1cba8b8112aa5d09f1761ab1844f3f4d27cbd13411c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d788c482076b5252f73baf4af589054e

SHA1
7fa007080d3bed631368b3b0ce6ca23032905505

SHA256
a41855d1a888fa392d28976ab02aa282ca33ea84fb7736a023db8e70ba91aa2c

SHA512
4f2b3809aa52dd9d55905160fa26327a8c7dd4c33238941da67aeff6e95d75cbbc5b40536c390b6a03eff1b896f81fd48ffba8ca403a23bb989ffd48644a8031

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASH0001.TMP

Filesize
6KB

MD5
7eccc259af24ba7a5a0638562536068d

SHA1
acd3e0fc2e10dfb2e57efa608a60297efb32e54e

SHA256
2e682f6b72fe7f464da31c01cb4769c8fcf556957405740140394282d4fe0db7

SHA512
7fc719c7c0499efc6eff2594e1e46390a421db4ae6c36c5f8822cccca52cedf6be4d9282e49db246a9533fcb929a70cd4e7a25e09984f69db2c922f6c4ba6f8e

Download Submit
C:\Users\Admin\Downloads\BonziKill.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\\bonzi\BonzVir.msh

Filesize
6KB

MD5
0cf59661f4b25d7bce496b51264cf6ef

SHA1
b55d3d5326f38f3f7d3ed6595754fa69113843cb

SHA256
14ed561155ef917214695a958392fe53295e1b972bd247da7672e7d38cc4eab2

SHA512
b0115fb134a145df36fae74791f30f4e43d24a049b0ad290e807a82574cc0d12ed5ccc1824e6a241fd0346b326493c359978071bf820d30bcb6bfe33f486902a

Download Submit
C:\\bonzi\LimePro.exe

Filesize
14.8MB

MD5
a6ba111c7ea638edac79ce34bb7a3de3

SHA1
903d1af04439189479bbaa8eee77f1503f1c54c2

SHA256
6c87657cfe2d7576333c2887d90f543c8fd4241e50f653b2c3a95efff2c4a268

SHA512
2b32ca91b42884cbd134d3471db74995321c1edcf1b2d579e1f0da4acbdf70ad08e05407bf93d711d966e2c3c5a0e25bc5338de5fd878a5bb0823010cdcdf9cf

Download Submit
C:\\bonzi\bg.bat

Filesize
397B

MD5
74a195bcfa20e10e672d8681831cf280

SHA1
b6a75cbce94c208c6d7f13280788b0f4183b6b7f

SHA256
c40a459f38ec341892f062db191889353b039efc613ce1870da6591f27952e3a

SHA512
e800011130350a3df02d406bfd002f92eeb2575cc5d314ea08111ffb347c64a9e8e04dcbdcd217f8c7d176998d4b4b804437b221d5a945fa5e65942366c3e2b3

Download Submit
C:\\bonzi\blue.exe

Filesize
120KB

MD5
c3c1f4ff433df26b896deddacb5817f0

SHA1
45152ae046f3e2d5e274feb6a04fa6af59a68740

SHA256
bc8f7334495c673dd646d092afdabbfb84edb5282a25d9d8b1d3ceadc019478b

SHA512
faecab59d8ab00cead2037ee30435fffb25494b5889ac5dd003fec5f3a0244a2e450425838456ff5ef11b8c674eb85b21ca68c636cdec593bbef5ecf2aba0561

Download Submit
C:\\bonzi\bob.exe

Filesize
37.5MB

MD5
a7bec276ba3a17576158a93d459b5949

SHA1
63d6d8bd7b09afe34147dff20791deac219d71f7

SHA256
407c9900fe5190df594a3ec97b17fdea941fe801e644013544b52a6b5afc6b4b

SHA512
f93da09998f257965ebed2e8d95f3f4728bbb61ee9eac5e1f428841a23f69eb122d0fc43700165d9a6dc6f3cb22c8cfa8f5953768366697bd00b63964addac1c

Download Submit
C:\\bonzi\boi.bat

Filesize
1KB

MD5
e3fb07dba9803c1f174b725d2a05ea51

SHA1
98fa2129f93fd56493914d527f07f727c2b45ebe

SHA256
a7a14afe50ac26962f92bafbcadead48ca2e8fcb546cb259819bacd8156fae84

SHA512
ab3e817ad01e94ff8a6c58ca89d64a45077f0de49ea8a9e7059509cc7d694a005deb9043897caf060d0a78cfb8cce54ebdb9b3cb0653975771b23340d548dbfc

Download Submit
C:\\bonzi\china.wav

Filesize
2.7MB

MD5
54c052f317d02d6129afd7c565b046a9

SHA1
5ab2014eb65fddb8a5f9c68a6b375dccc45916a2

SHA256
b1ed856b9ab097c8ec91778a241443a660a7e0ed5e3157a181a22dba1e31d55b

SHA512
200b66da2aeaf9c7502857e4e6d2d5d2294e3932f2fb7c3dacc9e161093c479028a3cead0dcbd9acefa46652406928f659b51e95d8bb2f0b0d93ce17eee6b2d7

Download Submit
C:\\bonzi\clippy.exe

Filesize
228KB

MD5
038bf1f54a35164fedb79e2319e1bc49

SHA1
e92cdbb5bab92ea3f2d6b0f8f40a5b5df199c6a9

SHA256
655a8c2bed8e2d85b24525aa426e5d647f15ddfa156967d64f144c497e8c9665

SHA512
5928082b8fef2a491eb84ed4ba01c8428cd96425c8c2d433dc6ef80d9c0d4866bb9c20871c6d1268824e435f42526e4e1eb468fe451f0ef02710edb35c08f1c6

Download Submit
C:\\bonzi\dicks.wav

Filesize
5.0MB

MD5
fba01dbcd05f71566cae1e56928ee875

SHA1
0e387de1ad68776f610e8a352cdb4034420500c1

SHA256
af11d1bf70e77336bc59cfaeaa0ff6f916d3be3154185ac80df59861eb19a99e

SHA512
a6586e6fc7c765d77fdbdfb474408648df5f54707530614e097e06e23320eb610e38768415db3d3d1f6e19e48413d8993983b6fe48c445af5f0df26fb6714003

Download Submit
C:\\bonzi\end.bat

Filesize
73B

MD5
83f1281124f33a31fa88e6ca1c7c503f

SHA1
35f7824bfa87a40083e57991f41abe01dbc6fd94

SHA256
e923637d148d84c9f99bf50e1b1ce8c262c3a40ee2a043d90650e7334cb862f6

SHA512
0d903d914b548969476f541794312febb72e56fb9a0dfc6e563d16ff2e8a74c6b13e184729d1f2254974e0625e032483470172b6cc270c416416fea93bac0906

Download Submit
C:\\bonzi\midi.bat

Filesize
73B

MD5
27d92ebfadfabce5ab3fa8f842e6a2e8

SHA1
2fbbe766c10820436a34ac47dcc49909a52228ca

SHA256
2acb21881a9c9625c653dcf43a79c6f5fb81d65bec36d290f12e1f2a6a7763c7

SHA512
703031215f5b282d9e4889cbfe69a80098a9663d2fe056e05ef58a9f431fd38afc12f6165b1417173856c9bcd263ff92ec985d1624044df2fe64316b2a18c021

Download Submit
C:\\bonzi\netscape\AccessibleMarshal.dll

Filesize
8KB

MD5
41d1f3a566f660af54961e766f7b62c0

SHA1
136f8911db5e2260d21be242c12be32b2f39cd36

SHA256
c10e9e5064cebe3da1e5adac75e7c5275a1887c7f26aeda77b977c5e67498f0e

SHA512
c8d05d38dc7bd1e60c6f157e2b9aa7e0312bbdb6efe6da150060695108204907948f4a33976ae2aa4e50110a35db6c9cc83cf20b272643890e1761ecc91f118b

Download Submit
C:\\bonzi\netscape\browserconfig.properties

Filesize
161B

MD5
2071861c3bcc63421c4552ee2bb7adc7

SHA1
c2cf21a40fa560436999987b0e5b03a30cc11892

SHA256
c80fea75a41531da6b48b13419d358a00adaf622849db5024c0dde020e260be7

SHA512
f7e002e839bc691fa70f27ba432be8ab7683548c29a2144292d1de63fc57da4c953a2ab012832e3a475504f64a71c9f735637a967993b611750be4286389d775

Download Submit
C:\\bonzi\netscape\chrome\browser.jar

Filesize
1.6MB

MD5
c8395710f824ec9e881a4d16fd6b98ec

SHA1
f4f873cc1e21d4e52aa4d94b1a74b18c4293be20

SHA256
3e975f38a5d95932bec15dd8180af717a6bf76206aacf937a0dce94251c8a567

SHA512
9a210c79022140f5a24a921a8514407f964444231d62300270f1eba318e2494ee20eae86445c1c9efae6623b57c5c70e04900c5594fac402890a3f5992f44e62

Download Submit
C:\\bonzi\netscape\chrome\browser.manifest

Filesize
550B

MD5
78f8ac0d911444edd41ee4c91bb6739d

SHA1
66da36d602e7e774043a8b47df762bda13eb0088

SHA256
e94a3fe979e6fbe23ebb0061dec47ffad95e054fe0284ea5f30d544267f409a4

SHA512
8621e082f28ea28fee03fb8e38c9a8df64e1f0dc5046069bdf8d162f06896b83a91f722b338e6f37bd5c0c37d96fa17870b5be2d9bca03fa4954059f893c4f82

Download Submit
C:\\bonzi\netscape\chrome\classic.jar

Filesize
618KB

MD5
23624d88c9a71f0c366b7da0c986c74f

SHA1
1fb9c47c58a497974bf142106136c0a3de3d884b

SHA256
55818d24c66b15a04650bc4158068e5d02329a34d1c270fe1d219e2f53086b21

SHA512
025dc050fa19dba690a135adfd1215c306719243e52e3f71f830517e58351381dea614b4cbddfd7c3ea4c397225d2201bf5b52f86b6d33c88eb4a39a9901b367

Download Submit
C:\\bonzi\netscape\chrome\classic.manifest

Filesize
322B

MD5
13089bf20fa0f5a0161947e2ea68ccf9

SHA1
7b118a78b1d2a6dc39e3bbc819e2fec1fa38d064

SHA256
edc130d9baed6516f1b1c268cdcc9fa7f604728da700f4ac73eec32800c5a8a1

SHA512
48e1ab07a1c90b478aa3b6b362f762464c0e002c2c3bff4322a369076539e29046ef9ef83ce8908239d970e5adacca22ea8ebc8a62735c218ded4937074475aa

Download Submit
C:\\bonzi\netscape\chrome\comm.jar

Filesize
31KB

MD5
6f1b9ce083df442d2aa5fa03f6cb6f60

SHA1
8afe52d7ec7f49df4a4ebf2f2cbe83005e8dc6c7

SHA256
0ff2af2df6107236531d54f9ad6c81c60b4c66293c910c077a153ebbe66bd2dc

SHA512
d50e70367a706c0f11001e10432ea3564d2294fd6150706ac5b910275ce5d4ef857257bb33bb68a62a6a8616dd91d0b6c072d768e786e4bb77b758357eab1934

Download Submit
C:\\bonzi\netscape\chrome\comm.manifest

Filesize
144B

MD5
940eaa4676d333fc76e2c37e7e7e3a85

SHA1
7f4a87a6a08ea398704225a2e5483a98a01cd622

SHA256
28c245f1be3a0865ff3b6898f78c87408a43ea37aa53ee74cb18805c4eddeb58

SHA512
4f233b8b662ed8a4e3aec5c19d3b7ebc479f59b4344c877d97eb4925f25a16e324875e76ee266d653ccc9612b8131cac6bbdefa9e8a74fd1733c3f70961ee247

Download Submit
C:\\bonzi\netscape\chrome\en-US.jar

Filesize
610KB

MD5
4b5e8d0c4a9388ef045c60eb9870fc40

SHA1
6e2c1852aac68ae8240ddbd9f2c8f1f82f6c0f90

SHA256
f6f452c736639acc1bd75a83aeacd10ad0f83af7dcb6e47ce6dd32a26a2a0343

SHA512
85a9a675a245eee03d6a6cbe33f8522a3c8c22f42b70e3ba57dedc7e49670f050f7e4152ec6fef29428b17e765f870d02f097954eeaa634f1583b84c9a22bccd

Download Submit
C:\\bonzi\netscape\chrome\en-US.manifest

Filesize
894B

MD5
a9fae4b2673d3754b89c9d3ba508ba47

SHA1
c201a0696a9dc04597da29502bc5252502c2661c

SHA256
b9cdf76c02a0e1f31094e9c61d1eda54a3bf4c287ad95f7df1d4d285de95ca63

SHA512
e0d1a1911653aff992be54d957bb31e5ef62649958a1c06c2e206718208496547bb9ba851414f9fffed8e5b9a8b2f6d3485dc23a69fb92f059998709dc3310ba

Download Submit
C:\\bonzi\netscape\chrome\pippki.jar

Filesize
292KB

MD5
9a7d55620c9f1780441fce11a443e402

SHA1
5fb1cba9cf23512bbddb07dda8564798ecb07c72

SHA256
485b27b406a07a19195af81285067919da3e5165747bf01b2f7a90b6527038f8

SHA512
832bb408758b9d803aef5ab175f80242ec10c99405611d5f9ca93d0b40b247d58c3a875f88767c8893f992d2d3ccba1ea205f181ce963f18e61ac7067a7f0ecd

Download Submit
C:\\bonzi\netscape\chrome\pippki.manifest

Filesize
69B

MD5
433dbb4921ce78024add72a778754702

SHA1
4608e7571ad013787dcd68f23ae385b29c5691d4

SHA256
c249df4bc8fadcceed1dad278a96d7915af54f0ae97ae0f23fc8eb4175731880

SHA512
59cd550765f633b2a94443c31edc3740053470c4408b31c9b28bae307b27d030a1edaa3c6974eb82fb454704eb0e46286cd454e7401cead18b1694f81bc5344f

Download Submit
C:\\bonzi\netscape\chrome\reporter.jar

Filesize
43KB

MD5
3e2d14577cd76484e53588a18e2376f4

SHA1
9c119cb9d64109a1a56b11ca0fa54e5331e891cb

SHA256
65905b0497281fd57dcda8eb5c47eb41dde577c2d2c40239e0c9d8d383963f33

SHA512
b8cd63fe2522763c3207d89f66a71b07fa8b2e568a3a9f7f55183c7d4aabfc6979aa6ee6e60c507ef1c2b720cc43e817d4dfe193f8df09b3e22f51c32956bb5d

Download Submit
C:\\bonzi\netscape\chrome\reporter.manifest

Filesize
340B

MD5
5e0bf4f3dd0617b0b195312bcb7abb62

SHA1
acfb78064edc2999c06eac8b56cd31fd52bbe6d8

SHA256
e7e01f5a59a1e1e4d7c56f40395167d3b14890661b87f5129d57ae5c2b10114a

SHA512
c6e5ff17ed9861ea55d70cf89bd8385b91159c17313cb7fa807aa06b4836d9c12466c6a4d849ff588f745d522242af060575a8d0ed26985d4115297071d59af8

Download Submit
C:\\bonzi\netscape\chrome\toolkit.jar

Filesize
1.8MB

MD5
0d87ef638abeced11511a63c5731e501

SHA1
4e238a4ccf5f6a349215a242cc1df1d2cf71c49a

SHA256
acd04082faebeaaf75956db33e8c57e4909e6f8822477268835d3bcece15d85b

SHA512
5ab5599c59bcbf9a7638dd3debd12f890776e843d9679a25742a183dd7ae663425a9ebf5e2de012183b2040949335d3ccdc99505fc79346ae7b1b6dd2e121511

Download Submit
C:\\bonzi\netscape\chrome\toolkit.manifest

Filesize
469B

MD5
991394a770c6e55b97cba3cc51e53de2

SHA1
6de9da3b00576f99d746aedd8e5e13da41f174de

SHA256
7d3386c5ddc9ef60e780464f6431614072f12a0bef1a1081e21559daf3c7e503

SHA512
f41ff4eb874abf493833acd3558351529c1fe79acddb04f612d7ab808e92adc93033a2be0cf79cdaefc4708fe78345c2cac0bb7bb583e003fa9adbb6ffd689a6

Download Submit
C:\\bonzi\netscape\components\FeedConverter.js

Filesize
20KB

MD5
20f8a15b1e1021dffe52ce936399b849

SHA1
59f59c8d662e59cf960f12864e932b09d28e1f26

SHA256
b23290d66cd0b26375e032d2c6c7578b874e379c6ca8907cf1a7cf122b74efa5

SHA512
4a0f86f0ee4b33c9f6ecb88093f81143fea0f90ad767b06d1440743f22c8d7bbfcf5bf79160add79334f22b17b9a629db77d4983bb6f581ca5356dbfe3746c7d

Download Submit
C:\\bonzi\netscape\components\FeedProcessor.js

Filesize
59KB

MD5
84d2257da1551d5ebd09fc7bb97d3134

SHA1
4ba59d1389710f004742f67ff154aa4c95294aaf

SHA256
fb879ce16c7382e3a562def28f46c240a86a942aff2cf29b8cdbc779e1644461

SHA512
071340c38074cf019f328476c6026db05e0ab0374a7f8f4122c8ceafda55e2667a7ee35abc41f35a88480890df674edf9add59dd40680efa10fc25c7c356fc24

Download Submit
C:\\bonzi\netscape\components\FeedWriter.js

Filesize
39KB

MD5
a7206d0b86a66f8d3818f8398a0a72a5

SHA1
fd8adef12b8f73fdde0662a028297244ed4ea9ad

SHA256
0fcae6b535f8af369989cdb3646f63245720d3ad8b10dd15d736b02ee3bfdd26

SHA512
31eab727e151c7ef14f006b78ba0b7b6dc02c55966a388577c55b1a897a2f997cc8870b54840d231cf44c4632420e9373bac9bea0a9458c45c14603af6400b2a

Download Submit
C:\\bonzi\netscape\components\browser.xpt

Filesize
315KB

MD5
1ba3ad31f3c642ef5cefd10f72f8275e

SHA1
876ef9b6e990caa864d344f52d517f5d7c430747

SHA256
eab3322f9c4146cea91f06b25ca8713f087a4ddd0b2b39ad1739c974728c3750

SHA512
efb5489bf619c45ceedc37b98645bd420fa5f7f52a752801268d10c12b079e086ae091e70d8c4a38331fa5d322c8c2d7df49e4eb40b65dc8c9021a900efd58ca

Download Submit
C:\\bonzi\netscape\components\cache-module.js

Filesize
8KB

MD5
9389b62b97d5620aa4445635e96fdfe6

SHA1
781f260c6b74cc579c7f88029688c8a1728ef6fa

SHA256
1f9fca3df0162b0ebe0179210928f99b9db35bf13741760a56b34261d86d5d15

SHA512
62fbf011fa02674086ca2058f69eab8857f381c3c199e7f7b4045ffbe42374915bfeccabdc305b17b5a8b9539d7a01555d7cf34f978e201a2407aed913580137

Download Submit
C:\\bonzi\netscape\components\compreg.dat

Filesize
145KB

MD5
f7487c8a3abd34c22ccd8481d08d8199

SHA1
2da738409048fbd3159a4047e5ca272891e4182f

SHA256
213a117f2ee10391a28e75a4e3a9f9a1eb6430b86bb54a982ccb063c7f70ba9f

SHA512
cfaa363b6fb3255335192c43b2362d3b55c0dd3cc2db79f9804debd0ab8c911fb0df50981b5ba960f28fa8fa95eca54f18703e01b09da32c6d1538a15f504a96

Download Submit
C:\\bonzi\netscape\components\jar50.dll

Filesize
76KB

MD5
eb78d8af60119fda6c2e15655e791ea6

SHA1
71dbac8bfc1e839c5dc7c70f84348efb6cc55838

SHA256
caab06ea40310d202a5a44c64221a2f920d4f3a12be6dbcc0a59362c2aca9364

SHA512
45c6e975e7366df1b8bb52e6bef820553f129e251c1a268c4e5014095000107680ddddc06aa0317d864b6c96f49550bb80a4d7fe99abe456f2da15b23841450c

Download Submit
C:\\bonzi\netscape\components\jsconsole-clhandler.js

Filesize
6KB

MD5
0987ed598b945dfa32853c4a30b757df

SHA1
5ba15d5d912aa77e8028b89b65eb1a8756f74f13

SHA256
bdafc44ec1ffc146fa1fa0432cebab3e0180b19e1bca67288a2f7642fa4256a8

SHA512
5c377974c5d193c53b4ad235a80412eea122f26da32d247e6ac6b60034696b2fd54ae8eb2260fd942c66ed94e8cc682e380995a03ce77c7a2d1a5a81e93dc404

Download Submit
C:\\bonzi\netscape\components\jsd3250.dll

Filesize
60KB

MD5
1a6924f35fa615987df6fcb1356a5f82

SHA1
0f964d2be3a471964d8b0e98695085361af0ed02

SHA256
ac6bd5690942ce2a1d9d0396bf3cb07d6657cf4bcf361c541fcc00a884324259

SHA512
7bc030694316895a9fc3919c3d9c14fe77f536f0128ab70bb3e67fd8f9775d5a86e42808e333ab390b924ae45b1c513db1ab3e945451b462f3b3021ce7b4ac36

Download Submit
C:\\bonzi\netscape\components\linkpad-module.js

Filesize
13KB

MD5
70fecc49fcd20479309d9adc05078830

SHA1
833f0d0f8cb3a0bacb11819c8a7662590006f7f1

SHA256
a3ba21168f4f8b6a828ad0f0ac72aa2f60cfdc541ee7de6ba5fdb86d17ac86a4

SHA512
fe4f1cf24ed680f5a06fc84da6075ffe0d404a2acb6eaf99a353bcc3a28392a393f281ca4cff700ab700aed738417fce7ee35971319157a221ba6eadd5f73b0d

Download Submit
C:\\bonzi\netscape\components\myspell.dll

Filesize
29KB

MD5
08fc5c471d479fdcfbf20b69c0bd0d68

SHA1
b885d66100a04cfb8da0ea2ca0915650bce2b0cf

SHA256
ceaf58967aa34778d5bc35eb5a3bc7df7e61f5daf55bbc411bb50579169a37d4

SHA512
e6c096412a8366e43761c3e360b9bf1313420292ba217ac75a55c4620cce27eea81560d121de5ba49562453c48d423bb7829594cfd46dd9cb73a739da36f60e5

Download Submit
C:\\bonzi\netscape\components\nsBookmarkTransactionManager.js

Filesize
13KB

MD5
c24c287db46c59c71561c1b1690322b5

SHA1
181ad97c6339d5e32fe2f54e5018a3c5ec5fd35a

SHA256
de39cacd8f59edceacc27b1808bd0dd1508b809f5e65c6522d2261940055d364

SHA512
3a45e6cf727bb20cfe0df6d2958674b3e344e056d6c56c8cce6c2df6438c81cad876fced141e88fa12911c09804582f69ba06657598fbdf882cf797a1df8724c

Download Submit
C:\\bonzi\netscape\components\nsBrowserContentHandler.js

Filesize
31KB

MD5
f707c6650ef895f4b9246ee1e43f86b3

SHA1
9d1432ab58cdae7f35e91fd24695191554d9a6d9

SHA256
e1e497a942d7a903b6556d511485d76457c7ba2855f897eebe9c0b3734c76b52

SHA512
3b7994420c9fac1f5a44af5b2120f514794e0f21dc45d1b715d326ed46581c954f3b6c4c314db11098e59a17ad48170210b7e53123826c83c9d31145020857bc

Download Submit
C:\\bonzi\netscape\components\nsBrowserGlue.js

Filesize
9KB

MD5
eaec1d6852c10f66a9ab3024ed40860b

SHA1
9996913f95f9ade98363c59821740baefac7eab9

SHA256
3c4ad7e846618277ba373e2173593deac7f9ef0739655b017756a8a43d02bb87

SHA512
28662134ffafe9e5e5f4e56501f4a7f035752b72bf8e96ed248db3a7c8d924fa86a78dfca01e950eb2a8c41d3ec352b94ad44b620ab03fd31969fbb32fec625e

Download Submit
C:\\bonzi\netscape\components\nsCloseAllWindows.js

Filesize
5KB

MD5
4f9abffba5d2e45acd75ea2e0505d049

SHA1
1ad99436b0cafafe31907f4754abbd34ff2361b1

SHA256
11f85a992ea0489490f305e7ac05757b5a2a10b8d04fe5ce362c6605b5aeeab7

SHA512
f1c7cb6f1e91dc6ced7ab15a82eb72860672334552fe521d694916ef2a5582280c38d3d40839c24ed52a2702eeb47940ec354997f98c0dfd6c5ca641f0b5cb97

Download Submit
C:\\bonzi\netscape\components\nsDefaultCLH.js

Filesize
7KB

MD5
741a764eead0827df6f9734d1f1633ce

SHA1
7f2c38a82e089e84778b6dbc1bc1066ca3dbaeaf

SHA256
df4d5a2d4f82b24c73d71e57c9647bc02286decc704c10df37d393292dcc8660

SHA512
4b74c9680a9bac47afa1a3476b536973c63895ba6a94ef9af4e915ba3d2e58089a14a9f7e87892018293ba1335009a43bc7a5f82312f2c19b717837f8dbbb534

Download Submit
C:\\bonzi\netscape\components\nsDictionary.js

Filesize
4KB

MD5
0b22332c1cf81bcdd9255d6685d69047

SHA1
98a5472ed96bee490d0520b26824eb7a85ab1e62

SHA256
29a878a841e231390d7a393d694494717094e8a98a7998523a2e61d233af8d18

SHA512
138afdf38ce07ac7f81295a13697cdf1a16d1d6517fa5feb11a6d7ab84c4bb9c4d48ed93e8e74c9e1f308669148c9e0ff436935b29f28e4ded412a617e2cefae

Download Submit
C:\\bonzi\netscape\components\nsExtensionManager.js

Filesize
317KB

MD5
64b4361af9504b0c370ff17478ae5a92

SHA1
a874649072bb1a86d622122a3f61d2d02edb7dc3

SHA256
5503b110f211e94a5c171e563641b77bcf12bc6643131fbc8b73fe08860bc7b1

SHA512
c9fcf51b5b19a8bf8b2e7f45eff02b6b79b8822b2745dcb9e11b86c91071c9f77e62a8fcf3d68a5298a21a763b888e163395394538132d8a82eb4891d8ac8360

Download Submit
C:\bonzi\BonziBuddy_original.exe

Filesize
126KB

MD5
ff8e3bef2b1c444e59d21d5291c81d96

SHA1
a838dc974a49dc0fad824cedcf794c8c9651d410

SHA256
50a65ffcb48cb6ba99ccf79d855696cfdfb28ff21d0f71666c8fae9dfedf878e

SHA512
b872737dd5f1f114785bf948fa8018aed228be99dafd07bf850bab1a4772564f59ed2cc60faedbf3eaf84f12908e1ed2bf07a526484edc6ded0692ce575e4927

Download Submit
C:\bonzi\netscape\res\html\gopher-audio.gif

Filesize
163B

MD5
0c428f6883c912e150ce42c954b1bd36

SHA1
bcfcdc2946c6e8113083d57538de5713aa033e9a

SHA256
39c501d97b098136e6d3ef487ebc2a04b00b367af8bf04a16ce183064656dc2e

SHA512
d809489178b96dafd4a0c95edd56fac21625aabb2b7dc8260345eb96b9c3c7ecb1b18505746bed15581ebfa1265cf96c8aff3953dbc6d69d56b31fcf54db228c

Download Submit
C:\bonzi\netscape\res\table-remove-column-active.gif

Filesize
835B

MD5
cdeeb11aaefc565b7e2e6de6c5122adb

SHA1
67c0bbae8ac6dd12cb66621f3539fae6971d91e0

SHA256
1ba095a2abd0fd53efb16480111e199cb06cdc0f7205c73691ce83e302af1c03

SHA512
b123401eaf3d0407638c1e0f3a17d102987b769139d83f2af346d5f5c3a1f16a7aab17bd9c046583542d15fbdcf11d24206a4bdf62885bf87b2aca4ecacb77a9

Download Submit
C:\bonzi\netscape\res\table-remove-column-hover.gif

Filesize
841B

MD5
f6f8b831f31c8a4081e61403b258d944

SHA1
389daf6bcd0ba84a413dce4aff02ae9800eb1061

SHA256
f19d34969cef9b58e845f4f3630ec3df5a3cc054831f3880c1b68a34afa431d8

SHA512
01bb9b06927083d052b11a76ce147073bc25d7c95308d189dbc5598776f83ba26c22a260450f41c2d18e4c3ec86aa24719a90bdeae1417ebd4b1066b80c8fbab

Download Submit
C:\bonzi\netscape\res\table-remove-column.gif

Filesize
841B

MD5
90ef7ea72f363d421c608e37141f0e29

SHA1
891c963cb3c26628dcb18db5653eaca5275b0f9e

SHA256
dd6549e0c43acaa44bba371928f96cb02f71440149f6ae4d2e9ad4706cbe2231

SHA512
6a05229fd5e33ccab5b5e4f185395fb77447384c83b2d0ca5379106e3a06296a6e372acf8c3be7b7d1e8046d5b3002ec5c4c4c22ea186fdff828acd2aa5702d5

Download Submit
memory/2176-609-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2176-579-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2176-578-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2176-576-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3304-1155-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3304-1175-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download