95dbd294f511335bb0b368c487abe48e8d72aa4b165cba94d32cef71a5e46916

Analysis

max time kernel
1785s
max time network
1797s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-08-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SandboxieDcomLaunch.exe
Size

149KB
MD5

04e2eb557706d98a16f3567c246ffde7
SHA1

c9880684220dfc5b6066d382f95ba3d94f2d0a52
SHA256

76125e38e18c2042f7fcdea09ac9559ec1e1c1612983d0060c584a6699274347
SHA512

9258d3dcf8ad267ed5e6180dad3f9c4ffbea6dd1bac130c272c84bead7b7474aebaa624cf08c1bb31d92b7762b9a6dc700e46a729e9e1b277a88456e9686b7e7
SSDEEP

3072:Xg9E6ACHaMH61pFtZYwYn92LB06ZerK7zV:QVAmaMHMZunQEEzV

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
764	BonziKill.exe
2876	BonziBuddy_original.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BonziKill.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBuddy_original.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziKill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BonziKill.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Bonzikill.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 632878.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
636	msedge.exe
636	msedge.exe
3948	identity_helper.exe
3948	identity_helper.exe
852	msedge.exe
852	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
248	msedge.exe
248	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
2876	BonziBuddy_original.exe
2876	BonziBuddy_original.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	BonziBuddy_original.exe
2876	BonziBuddy_original.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 2680	636	msedge.exe	104
PID 636 wrote to memory of 2680	636	msedge.exe	104
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4460	636	msedge.exe	105
PID 636 wrote to memory of 4936	636	msedge.exe	106
PID 636 wrote to memory of 4936	636	msedge.exe	106
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107
PID 636 wrote to memory of 4732	636	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\SandboxieDcomLaunch.exe
"C:\Users\Admin\AppData\Local\Temp\SandboxieDcomLaunch.exe"
1⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb8f113cb8,0x7ffb8f113cc8,0x7ffb8f113cd8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,1671081041178654445,10943347149964274861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5008

C:\Users\Admin\Downloads\BonziKill.exe
"C:\Users\Admin\Downloads\BonziKill.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:764
- C:\bonzi\BonziBuddy_original.exe
  "C:\bonzi\BonziBuddy_original.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b51911bc9f885f29ab4c6e6ee10fa930

SHA1
32b8bc5f9e017e2a39bc243ac491dfff08966ea7

SHA256
d313cd16506d9a9990bb449accb5e8b559751b8b080a4118d0b9a776ac2e20f5

SHA512
285b015ed4ee29b85586737bc18e72c412e913bf883bee9f13b2ff8ad74a144c341b56ea221a0ac04683f64bde82839030a18001be78945ae8352ca169511138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
011dd3c262b52f45813258797cdbcc5b

SHA1
ec4b68dc1bf7ab82b120df3a2c3348be74a49efd

SHA256
e16a614cd534b0ca5454f4e6b87e86276bfdabc0a4ef3f67ace9023627fa4da6

SHA512
08be434b4e668b17b9102b5ea0babdc42b5fdb371a38606737aa9ea397ad3d2025786f09a364336f1154b4331b0306159c492445175951a5584575240909c192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
fed511507947746bde57eaa1522970ce

SHA1
ee26d6f23c7d34c45484ca7044713535e95de989

SHA256
cc46b44271472376d1fded91a70912e3894ba4a313e541f5da0ddbd53b1b7924

SHA512
b46257f0e52e7de9df50b3dd1f7a9133eff7bf9baa5d1ca1267640240b92592771a1a0518796e973975d21fe8f1eb8049cd25903ce00d03da3c54f4bacd9a267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
703B

MD5
6cf17c3c8c4f913fb8e66f6943695952

SHA1
4bc795c1c2f2b3884a442fd36f800fe9818feca4

SHA256
de2babc951444769b7315e54bde7203a3cdfdd24646755b9e661b3c63209d3eb

SHA512
ff9af555595bd31387e6830ebe031ce86b8db0e5af4683716ec8682c25358ed748d38e234abc413b434bebb005538f8df0897758242f08b35dba947b841f9571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e0bf48bb7bc605d5e4dc4e21b0577198

SHA1
5afb1a7df927fef9d638fde093a130c6faa2e180

SHA256
ec8dca5ccf6671153a513340f5d2f204efa0698c0b6144b2f2be8e4499780e2f

SHA512
650c69195fed277120027ce919daf1343fb488b609ffed3601df9be551eab779df1989a058ba4364cd5a20cf179d31a6a81856e8d25b18f43e53a89589c9bb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a75b149188c0da5f88ce533323dba33

SHA1
37db23bea30582cf133dbb0fb90378ba65083b06

SHA256
1ecbe77b455bb7a9a939c45cdf1675c6ae40c393cf4a6cff4d017a260c38fcee

SHA512
bc308570baa985bfece6ff64bc462f6537f99b331a7d4e7fe4205ef7732e3c356d07f414f75e555dd0752e50fe38e61209c6cbcf06d0868d585e4f8b08b9815e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab6c8bf079e4a35aa4b545d6f5e04d73

SHA1
04339645f4d3ab12dfd5fe46a44c9ac32d1ccf99

SHA256
a8e9adc0b4192dc1585bf4a12c9d479155aeba4c646e46bdd90ff5fb1dca5a1e

SHA512
742fad643b9ab8c4b22442b906bf961e05d9c876e5055ed4e9d1479ebbc350b035bad950cd596a6fd393f1c00cc0ecc89c4c121d4abcae2bca1cde2db3f959b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39b8120996906e7f9ed319b73d38f2b9

SHA1
3791df99e86bd60bfa4122e7cfaa14b4b652a5b5

SHA256
f08dc521967fa691289a92c67a3fd2f117d679f5115ea91a38dbe73a2bfaf34c

SHA512
3d76c3e1956bda122e1719882632baab99df999bda9870b536a4f0b243d18ccf35ae62343ef098a5e64a958ba5da1898051407623c653c8534632d0b4ff9d3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
013d7ea6c3fd7ec397f8ddc213fbcb0f

SHA1
1a7d8c5c7bd924375816ea0d7950109fc798d868

SHA256
fb69ce71f38d0699641f566d57a9dfc0502062bcca4a2b41871bb1ef5fde3c3a

SHA512
1e0d3d95839b1bfbc61a8e8db49ae416469471c35943749b805c3716acc64e64aba07d1e8f90a209a86d2acdb2b42b44c86ceb188e2b6e605a4d87c7aeac591e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4b8062f45c7a1bd51845994f6ae167bf

SHA1
e94906e9027e04337dfaecc535fc42486329197f

SHA256
74e9dff031021329e1a9d1ea0360289b21b1dd4a38ae2fb647c63684426c54e1

SHA512
63afe8028bd99d343ce35b3b0e99fe2ce34222aad9c4e6e74b7d1b035ddf1e8bbe45cd98a467ca639a3a0ba5b3426a985131f3b2164c44d4ae23bfb0f8bdd10b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
790507cf74d5b353d89a8637f757cd7d

SHA1
2ad75caad766cd4d0ac561302ef24f79b500c072

SHA256
416f25717f0c490783556ebb9816daf97175cd4acdbb30a9c1af782249af4928

SHA512
f965a7e354f864c2a4846dbde694939d1cc8a331a22932ffc1fc75dbbff93337de799d01a8dc3f3d72fe3ef08e517120a1757fe223e57435b6daf04ed172b1eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a8897ce4087de791cc0750a4292e73f3

SHA1
e2fe7e48ea5ee35594b9fd3e1bef16580fe964a3

SHA256
48e782f716b9c3f64bf4d5a5a6506d06451bcce902e5cdbf71211cd3535e79ef

SHA512
a0cfe11bca163beaadf2535feb49f56f0312a720493eda6090cc5ce8c96523bd99be1a057dbad026619ab9e26d84dddec53028ba94c2464c689147deff63afb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4da24ebb4be1ed58eafbb10e0728e8f

SHA1
fd1279adb56c240b51bcfdb8863d4f7c9187400f

SHA256
45ea2dfdbca495f011f9457c092bdf7ed5c8086424d8e655c6ac640542db65f7

SHA512
54cfc551582e379d8aec2c591473e9d957aa3f7f96c333d2c3177aa09d67c2e722ac9fca553b361cc7d0aabd0aa5d2ec255f4c8bc99550a038c022c1973e0948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe6e59c8.TMP

Filesize
1KB

MD5
0b3a2b069ceb37b1af31d4fb252107ea

SHA1
060f9445e71d585a6aff4bce983199f57285357f

SHA256
fbbd0ce59322164ca89bca89276b1b3182f733899c24cc6a38bce7e532fa0078

SHA512
132e7873b19b6dc2236f46c2019304458dfee105d800578c3c57525a720f9a61fe9495a84347b122d63645c705b7a7283e7b903d2cd32942cf796b6ededdd3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b79ea03b-3435-4135-a2b6-99b14a4133c8.tmp

Filesize
5KB

MD5
9d3c7069029f9c7b50e69cfe3b9b27b8

SHA1
7b8a208cb4ba0678007ac60f5bac2b17ceb0cc83

SHA256
8592bbfd6a4060139f3cf66ccfe8d0966252b1325d98e132c0ea6f2a5fcf3272

SHA512
110ca177bfd55abbaf1f8e8e14a5730269136eef87ca4daf4d20dbd014c03ee947d7e57bf36cac3bf2fe4b4875c38aa7b26a42fd044d8b244d0f1229f227ecf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fc66d5ac60f430217327c0b8e9e3848a

SHA1
327375c68c21c79543a635cd48b7267bbd99b72a

SHA256
cc9b963472da7b24f29c21fa4eeb71c702127afe483c3ac1c08c3e705b0df793

SHA512
2baf4e9a99ba05848ce7904bd4756ce4a03a87c0094f87760416b8a1fa8f5a86a736950a620fa638823231428916848ff4ebfed9d52bd02972e94b7a9b98cf35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e8df26c7769c16e07a48cf13e12ebff

SHA1
cbe8ee532a31fd450202efd2284f3b2a98f9b5cd

SHA256
0c9eca038ff911e8640ba4375078818c3cf8ad64e41b5fbcf9c9e4b1fffd7f15

SHA512
ada7f7ac9efae0ce77b46037eca72addab67750d2b38acf136efb03625a0ffb9ee06c0df9cabffa6983b1d49b97d35d4a86a3b4cdf79d4d25d9ab8e6f6f0f69f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f3de8fffa86f03d5ed98d97cb1df616

SHA1
41c03214681873569e481dd9715e2d50c3f7111b

SHA256
c63f4a23d98b935588c1f608bac738b939d67ea1be207f4e7d872432afb32733

SHA512
396e978a15a5475c2605ce77c31a8892a2265d2e4faaaa006a0dbed364b8c17662f18be345f8c0d4436b35274c167a9c2e4d1cc84dd19b5919fbaac95ed699d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4f24235134d9ec37a4372bc8d73bffa

SHA1
6b28a6b6bc49d8f46926fc44de60c9fcdc4aa06a

SHA256
7a847f56db000c114d3e8dfb01ba9fb3b55796d1fbfed05721d725f7f49287dd

SHA512
0d22e6c46d4a5878dcf94f683014dddc8985b8e5726b207f090f1c1f9f9e98e15bf5d8773bcc3ead84e8895b5d1a425b76d54459e5f048e0d653e4cbd58cdc4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03845511d15efac4813fde26e9110c39

SHA1
8cff28aa369dcde911ce4d11e8b380801d1de6b3

SHA256
26f089616ecb49d8a222160b486feca2bc1079ae90bf1d8c451ef0a4bd44d511

SHA512
aa617033dc05a2598a8c59a2276f2a141a3d043e0c578283e0798c4aedaf99913c0316a1f5b779a2efe0320366ea3f2bf2501a7100170af333759422decf6d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f725c307ea8954cfccbde68b8c384ac

SHA1
f2247891782109cbbed5a6c4594f6a816055ab30

SHA256
479b49b7204a4ea3da049e8d844f39f4334befb50c12e28184b453826a63887b

SHA512
54cab99f2689ba5e438708c020f2a2f1c96b9057e793b32e41dd8615989c65278ebe8fe6766fd98e4ffb77009886561392450073b43c0fbe6e531681bf8c7ce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASH0001.TMP

Filesize
6KB

MD5
7eccc259af24ba7a5a0638562536068d

SHA1
acd3e0fc2e10dfb2e57efa608a60297efb32e54e

SHA256
2e682f6b72fe7f464da31c01cb4769c8fcf556957405740140394282d4fe0db7

SHA512
7fc719c7c0499efc6eff2594e1e46390a421db4ae6c36c5f8822cccca52cedf6be4d9282e49db246a9533fcb929a70cd4e7a25e09984f69db2c922f6c4ba6f8e

Download Submit
C:\Users\Admin\Downloads\BonziKill.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\msagent\chars\Bonzi.acs

Filesize
5.0MB

MD5
1fd2907e2c74c9a908e2af5f948006b5

SHA1
a390e9133bfd0d55ffda07d4714af538b6d50d3d

SHA256
f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95

SHA512
8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171

Download Submit
C:\Windows\msagent\chars\Genie.acs

Filesize
1.9MB

MD5
22bdce2c97e773a7614b34d7c1720232

SHA1
ce5c3c484a9fa32f403e4f2fd2360fd6e38b8320

SHA256
87887195179efe07ad6ee7a44fafbc0fa6b96d0990ec604f5651951c647f8f9e

SHA512
83ad39d3f83754452d557061f0792fd8af85d358ee4d279b27f2dc3a3866193b88df4d21a645baa3ebcf2b81a348af461114c61aedad554e665fadc3cb26d07d

Download Submit
C:\bonzi\BonziBuddy_original.exe

Filesize
126KB

MD5
ff8e3bef2b1c444e59d21d5291c81d96

SHA1
a838dc974a49dc0fad824cedcf794c8c9651d410

SHA256
50a65ffcb48cb6ba99ccf79d855696cfdfb28ff21d0f71666c8fae9dfedf878e

SHA512
b872737dd5f1f114785bf948fa8018aed228be99dafd07bf850bab1a4772564f59ed2cc60faedbf3eaf84f12908e1ed2bf07a526484edc6ded0692ce575e4927

Download Submit
memory/2876-917-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2876-904-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2876-905-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2876-903-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5020-0-0x00007FF4D6FA0000-0x00007FF4D6FB0000-memory.dmp

Filesize
64KB

Download