Overview

overview

8

Static

static

3

3.zip

windows10-2004-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    360s
  • max time network
    338s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/10/2026, 15:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3.zip
  • Size 13.5MB
  • Sample261017-str9bahs3j
  • SHA256 03555b6cf592067f1073f81a7cc4efc481bc4b79725c8870286f296b94311245
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\3.zip
    1⤵
      PID:612
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3204
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\3\" -spe -an -ai#7zMap7981:82:7zEvent9645
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4800
      • C:\Users\Admin\AppData\Local\Temp\3\uninst.exe
        "C:\Users\Admin\AppData\Local\Temp\3\uninst.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2224
        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
          "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3\
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4776
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\3\" -spe -an -ai#7zMap18624:82:7zEvent7733
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4704
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:752
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4544
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4692
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:884
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\MSAGENT.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\MSAGENT.EXE"
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:936
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:452
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4728
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2100
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1144
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2548
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3044
        • C:\Windows\msagent\AgentSvr.exe
          "C:\Windows\msagent\AgentSvr.exe" /regserver
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1156
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4260
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\tv_enua.exe
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\tv_enua.exe"
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2184
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5064
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3760
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1776
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3968
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4312
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1496
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2676
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2780
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:220
      • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
        "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
        1⤵
        • System Location Discovery: System Language Discovery
        PID:5072
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3840 CREDAT:17410 /prefetch:2
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1596
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3840 CREDAT:17414 /prefetch:2
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3104
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:752
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:908
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Bonzi\run.vbs"
        1⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:4348
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4848
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3560
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5036
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4996
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4392
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\tv_enua.exe
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\tv_enua.exe"
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4232
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4776
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
          2⤵
          • System Location Discovery: System Language Discovery
          PID:908
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3928
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\MSAGENT.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\MSAGENT.EXE"
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4928
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2084
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1148
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:980
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3100
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4616
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3420
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2976
        • C:\Windows\msagent\AgentSvr.exe
          "C:\Windows\msagent\AgentSvr.exe" /regserver
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4828
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          2⤵
          • System Location Discovery: System Language Discovery
          PID:552
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\3\$TEMP\" -an -ai#7zMap24555:118:7zEvent618
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4176
      • C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
        "C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2416
      • C:\Windows\msagent\AgentSvr.exe
        C:\Windows\msagent\AgentSvr.exe -Embedding
        1⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4704
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\3\$PLUGINSDIR\modern-wizard.bmp"
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1304
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
        1⤵
          PID:1568
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:224
        • C:\Users\Admin\Desktop\3\$TEMP\BonziBDY_35.EXE
          "C:\Users\Admin\Desktop\3\$TEMP\BonziBDY_35.EXE"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3432
        • C:\Windows\msagent\AgentSvr.exe
          C:\Windows\msagent\AgentSvr.exe -Embedding
          1⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3004
        • C:\Windows\system32\pcwrun.exe
          C:\Windows\system32\pcwrun.exe "C:\Users\Admin\Desktop\3\$TEMP\BonziBDY_35.EXE" ContextMenu
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Windows\System32\msdt.exe
            C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCWCD45.xml /skip TRUE
            2⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of WriteProcessMemory
            PID:4888
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\3\\BonziBDY_35.EXE"
              3⤵
                PID:3880
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\3\\BonziBDY_35.EXE"
                3⤵
                  PID:5032
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\3\\BonziBDY_35.EXE"
                  3⤵
                    PID:1504
              • C:\Windows\System32\sdiagnhost.exe
                C:\Windows\System32\sdiagnhost.exe -Embedding
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:808
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pnrtyglu\pnrtyglu.cmdline"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4308
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD227.tmp" "c:\Users\Admin\AppData\Local\Temp\pnrtyglu\CSCEBCA10B865F8476B8238CF5B3B177630.TMP"
                    3⤵
                      PID:5048
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3em4ahce\3em4ahce.cmdline"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4356
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2B4.tmp" "c:\Users\Admin\AppData\Local\Temp\3em4ahce\CSC4AB65E154FA24EAD9649CCE19C22E8A.TMP"
                      3⤵
                        PID:3796
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4w0clcju\4w0clcju.cmdline"
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2820
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD573.tmp" "c:\Users\Admin\AppData\Local\Temp\4w0clcju\CSC9FEC2C8A66D40C28493B672B1F44290.TMP"
                        3⤵
                          PID:3372
                    • C:\Users\Admin\Desktop\3\$TEMP\BonziBDY_35.EXE
                      "C:\Users\Admin\Desktop\3\$TEMP\BonziBDY_35.EXE"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4528
                    • C:\Windows\msagent\AgentSvr.exe
                      C:\Windows\msagent\AgentSvr.exe -Embedding
                      1⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2644
                    • C:\Users\Admin\Desktop\3\$TEMP\BonziBDY_35.EXE
                      "C:\Users\Admin\Desktop\3\$TEMP\BonziBDY_35.EXE"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2740
                    • C:\Windows\msagent\AgentSvr.exe
                      C:\Windows\msagent\AgentSvr.exe -Embedding
                      1⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3512

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          ResultReport.xml
                          • Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2026101715.000\ResultReport.xml
                          • Size 1KB
                          • SHA256 73b12fc874d4b02acaf1282c37e05fc8192e51bde584b750992cac2554677c10
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          suggestions[1].en-US
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8J9OU7H5\suggestions[1].en-US
                          • Size 17KB
                          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          System.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$PLUGINSDIR\System.dll
                          • Size 11KB
                          • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          UserInfo.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$PLUGINSDIR\UserInfo.dll
                          • Size 4KB
                          • SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          modern-wizard.bmp
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$PLUGINSDIR\modern-wizard.bmp
                          • Size 25KB
                          • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          nsDialogs.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$PLUGINSDIR\nsDialogs.dll
                          • Size 9KB
                          • SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          nsExec.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$PLUGINSDIR\nsExec.dll
                          • Size 6KB
                          • SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AUTPRX32.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\AUTPRX32.DLL
                          • Size 137KB
                          • SHA256 0563e77b6bd63eb0561f6264badb5d07dacb7287ce029dc3ca3279a964ea6a6d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ActiveSkin.ocx
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\ActiveSkin.ocx
                          • Size 336KB
                          • SHA256 2c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Bg1.bmp
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BG\Bg1.bmp
                          • Size 868KB
                          • SHA256 e4843ab74d29d608e406d137892afced0661ee56c3cd899cf49bc863dfc9e99a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Bg2.bmp
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BG\Bg2.bmp
                          • Size 868KB
                          • SHA256 2066f7ede6410b790ee3446b6c27470526969eb837ab9187f61c10c611bdcc5f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Bg3.bmp
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BG\Bg3.bmp
                          • Size 868KB
                          • SHA256 d983ff82ee546e5706da39531aff69721b9896fc99eacd59bfaeefdd0bef0147
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          BonziBDY.vbw
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY.vbw
                          • Size 53B
                          • SHA256 4dd98f95113b70772308a4671a482b9b59bba5fbf41e928f2a833366c54424e4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          BonziBDY_35.EXE
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziBDY_35.EXE
                          • Size 2.5MB
                          • SHA256 88c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          BonziCTB.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziCTB.dll
                          • Size 28KB
                          • SHA256 f85525a3ebe334f7403f031ec47c2b32461650224223ee728107dce0e879ea93
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          BonziCheckers.ocx
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\BonziCheckers.ocx
                          • Size 152KB
                          • SHA256 9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          run.vbs
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Bonzi\run.vbs
                          • Size 124B
                          • SHA256 b2959e49361d8d68b7ea82e42a03dd8c281764f1a2ad66a4019e84412c1653c7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          page0.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Polizoof\page0.jpg
                          • Size 58KB
                          • SHA256 4b0d3ac6305c56e814e87734d3798a4534b639fe7752a20bb398fa9eaf59bfd7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page1.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Polizoof\page1.jpg
                          • Size 52KB
                          • SHA256 bc48c07bc245bb7a7561c983c72851bc2f48cae594472c48d3447456dcbea804
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page10.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Polizoof\page10.jpg
                          • Size 51KB
                          • SHA256 58007307843f33234f44cdb0b89d91d0d12d07401a9c31ea7d64d5b6688d71df
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page11.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Polizoof\page11.jpg
                          • Size 48KB
                          • SHA256 1eec3c97c806459052a98661e0bfcdac4eafef0df5fd2af6c4c53916156e5eb1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page12.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Polizoof\page12.jpg
                          • Size 49KB
                          • SHA256 2f52d995e111b8c9ac693663a03ca0545861e94c53c7110270d21ff10cd4876b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page13.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Polizoof\page13.jpg
                          • Size 51KB
                          • SHA256 43f4e85f1c60b73fa8252dfc755e38649e8d23ba8a666a83d0cf859b0920f4a1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page14.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Polizoof\page14.jpg
                          • Size 55KB
                          • SHA256 aa9acde92741388db556b92bb3b3c7052faf78984835d4e05f3ff1bb44c07a3c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb001.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb001.gif
                          • Size 38KB
                          • SHA256 ab33039db90f44dbb3c9967ab157f40805dd68311a441ce5e819c286a3569ddd
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb002.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb002.gif
                          • Size 42KB
                          • SHA256 d68e785094c2f0016c735ad9ac891e2ea2b0b30b4f30d800446759ba0134b7ac
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb003.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb003.gif
                          • Size 51KB
                          • SHA256 95cbcbd9c41c128ae03b8536ee229771a8a42e3cbf57faf4697aaabe98c11108
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb004.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb004.gif
                          • Size 49KB
                          • SHA256 9f93891fe6aeeea23b10ae5aa680fd44e408b97ffd9df65cf0434fef1b049af0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb005.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb005.gif
                          • Size 39KB
                          • SHA256 0d177be82265d4458b9ab22efc15418128742dcd60488a5bdecd5d334164dedc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb006.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb006.gif
                          • Size 43KB
                          • SHA256 3f5adbc7bef95ac98d78d9b2e2f25c1b89dd6a14b02ad0c6801de51fe1e48843
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb007.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb007.gif
                          • Size 26KB
                          • SHA256 292ace5abc773d1dbe3db5c3a51d42b11a360e22b17643209b30f5988e437761
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb008.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb008.gif
                          • Size 35KB
                          • SHA256 bdae04f6d7694e1981771c0a76fc555009dae6e56f2f11f8fdff87b2d9dd0797
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb009.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb009.gif
                          • Size 39KB
                          • SHA256 b5cb2f91a884e832c0eecfffbc4b0f6920a67e0513f3e2ac9130bf6b744ad146
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb010.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb010.gif
                          • Size 43KB
                          • SHA256 a16ddc10725a33dd91e617de97cfad7372ee33bbdf195312b70b1d10194b68c7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb011.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb011.gif
                          • Size 47KB
                          • SHA256 741f4194e099e387d5b81753972074c2ec9944b36b442ee90f02f2e05a49e2f0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb012.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb012.gif
                          • Size 52KB
                          • SHA256 47f4755a428995775089a622f33eb54c4505d8a6ad7963c6de646de0b2156017
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb013.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb013.gif
                          • Size 47KB
                          • SHA256 f7eebb0ae58ea8e64160bf2bf8bab0955603c0208c3bfb760d89d01088f042c5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb014.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb014.gif
                          • Size 55KB
                          • SHA256 963bb112090949111b885ab790c9e032784d9dc6c0fb3388f47d011f5bdf6c7a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cb015.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\cb015.gif
                          • Size 32KB
                          • SHA256 84f12116cfbeeee6373bb94a0d878e134fff50d598d6f1578f4131d23be3703d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page2.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonz and the Treasure Chest\page2.jpg
                          • Size 45KB
                          • SHA256 d0a1151ef42147b7ab8c9e88bf3b926c7249ddedf72bd1515303085bdf34fdd0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          book
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\book
                          • Size 9KB
                          • SHA256 486c7e2d25096d871171fff1906c65f98e8c1fa888cc5c18558140f999274d4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page0.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page0.jpg
                          • Size 35KB
                          • SHA256 0b4aa121fea4ff7a39bc48136ec58799026d6ead1a41672832ca92d9dd8e5c7b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page10.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page10.jpg
                          • Size 65KB
                          • SHA256 dc60db3b80e4c049bf870b2ce9981fefba35fba7afba5e60d75b9c0dac8ee141
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page11.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page11.jpg
                          • Size 62KB
                          • SHA256 6a584c706ff3383b476fc4e55e7c16f0661c30c622237094f302db2f6cc7238a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page12.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page12.jpg
                          • Size 66KB
                          • SHA256 01006d2e7052d985101f0bce9c901c04fd55cd1cfb5e2d23385396f7e88e8fc0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page13.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page13.jpg
                          • Size 82KB
                          • SHA256 013fec11189038bc36ed28631b90433284e839188c5d1e69c5533ea8e1048879
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page14.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page14.jpg
                          • Size 61KB
                          • SHA256 8882f1cf6f0cae626f8677ff3d1b415a5df88f32b7e6f94690a5997823b4916b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page15.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page15.jpg
                          • Size 65KB
                          • SHA256 e71359b05df80c15916fb273710c8a87702af891b11734663cf538a6baf0a32d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page16.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page16.jpg
                          • Size 55KB
                          • SHA256 0f36eb4f571237452098816d03de25c9081625391a2295a5db4cd0a01933ddfc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page4.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page4.jpg
                          • Size 66KB
                          • SHA256 d635654cda3fff19815d46e1ea912291adb2c553933709826c1a167b6b77dd53
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page5.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page5.jpg
                          • Size 60KB
                          • SHA256 38be8805a0cf6c7d34cfbb7256242d3e0aea0f3d36185ce6e73c7284bdd87e24
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page6.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page6.jpg
                          • Size 67KB
                          • SHA256 42a92022a12be3db39db1ed564edec32f031ec177da4db128d207cf9a9a83f35
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page7.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page7.jpg
                          • Size 70KB
                          • SHA256 db7027e0f7d02fe75874ab15de847352099e36bf10650c54c860e4fdd301d418
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page8.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page8.jpg
                          • Size 68KB
                          • SHA256 d8333b0964148b5263793ca0493f40c373a47ea53fb3fd637f1431f44c414b7a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          page9.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\page9.jpg
                          • Size 66KB
                          • SHA256 c64ce0ded53d511f9a6deba02741d37e5c96e760bc34b294f546931c14d8137a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sp002.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\sp002.gif
                          • Size 37KB
                          • SHA256 92d4e729520977fe8c3cee533c7e259ab5ab67810f36c557c747ca821bc19ca0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sp003.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\sp003.gif
                          • Size 54KB
                          • SHA256 6078f5e78caa39fa31eaa23ab37e6939003b99e67a0c843335581cb8ec7c824b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sp004.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\sp004.gif
                          • Size 71KB
                          • SHA256 e113e023fc04095434a417689f7b436a4e4120427c0f7368beb89e48e6ad6616
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sp005.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\sp005.gif
                          • Size 58KB
                          • SHA256 f30c86b0ffc248ab421f3d2cdf6dbfa1d7c3504400a8026b8548d8161c4fb081
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sp006.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\sp006.gif
                          • Size 63KB
                          • SHA256 1341f0db796d31c7382655362a682a45f00d5160ca149ddb0e13444bb622d9c9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sp007.gif
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Books\Bonzi and the Alpha-net\sp007.gif
                          • Size 48KB
                          • SHA256 4e7c34f76e045cf1acdc64071a7fe2d31fec2864d89fdd87e3d79e37dabf30fd
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          CHORD.WAV
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\CHORD.WAV
                          • Size 17KB
                          • SHA256 1cdb5e4d203f61e94c02f5eea5008289fb463c02174879887fc62574b34c12d3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Intro2.wav
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Intro2.wav
                          • Size 151KB
                          • SHA256 1d648a27a0209959027567f793f8b3fd18a103b64e62eda3f20f11192bd0dfaa
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          J001.nbd-SR
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\J001.nbd-SR
                          • Size 147B
                          • SHA256 56ac8a4f90686b433297712de577ba68e0970458dee218764ed3acb3b3560f7b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          MSCOMCTL.OCX
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\MSCOMCTL.OCX
                          • Size 1.0MB
                          • SHA256 3b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSINET.OCX
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\MSINET.OCX
                          • Size 112KB
                          • SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSWINSCK.OCX
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\MSWINSCK.OCX
                          • Size 105KB
                          • SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ODKOB32.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\ODKOB32.DLL
                          • Size 16KB
                          • SHA256 c4b58c78dc14e247ba303f630e42e9e56667dafef7aba1f0fdfd058b658f0a36
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          P001.nbd-SR
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\P001.nbd-SR
                          • Size 231B
                          • SHA256 3e8554436a52336c84117905b7b2383fe1aef01d613440d4cea70f035aaee28b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          RACREG32.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\RACREG32.DLL
                          • Size 32KB
                          • SHA256 054fbd3c3a31cea5c69c78c1455d19d2f3486e07428ea951f107d5dac3e58d25
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Reg.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Reg.nbd
                          • Size 290B
                          • SHA256 3b4213745416a6a1ff0774c17addb7b32134932bb20f5d05d7fe75277965b61c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Reg.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Reg.nbd
                          • Size 290B
                          • SHA256 03b3858e5766b07b919d176b541a105faf76e1a28ba01e3593cc319ad87dc3b6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Reg.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Reg.nbd
                          • Size 140B
                          • SHA256 375ecd89ee18d7f318cf73b34a4e15b9eb16bc9d825c165e103db392f4b2a68b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Regicon.ocx
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Regicon.ocx
                          • Size 76KB
                          • SHA256 07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSAGENT.EXE
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\MSAGENT.EXE
                          • Size 391KB
                          • SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tv_enua.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Runtimes\tv_enua.exe
                          • Size 997KB
                          • SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SSCALA32.OCX
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\SSCALA32.OCX
                          • Size 472KB
                          • SHA256 8e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SSCALB32.OCX
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\SSCALB32.OCX
                          • Size 320KB
                          • SHA256 5db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SSubTmr6.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\SSubTmr6.dll
                          • Size 40KB
                          • SHA256 48bb226b418dae999d66731599996e042c5592d845ea11548a15ccd3a00fb5ab
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Snd1.wav
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Snd1.wav
                          • Size 27KB
                          • SHA256 11863d5b7fec50e3ca69f74066b68ed389a18b6990394f3ed21d6ea0e67262e5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Snd2.wav
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\Snd2.wav
                          • Size 38KB
                          • SHA256 d59c9bc27494b2e68d5efdc1798dc5442f364bef46cfb1fcdf4b3b032358ac26
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          T001.nbd-SR
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\T001.nbd-SR
                          • Size 319B
                          • SHA256 2f3d5ac26d4345be684f81cae8aa51f116334394680e9e6ac6a6ec49f58f3bac
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          empop3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\empop3.dll
                          • Size 148KB
                          • SHA256 f198ec842cf9b9d1e9e3f4bb6864fae7eea98d6919e0c6609e139e00c262d6bc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          emsmtp.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\emsmtp.dll
                          • Size 116KB
                          • SHA256 743857c8be216893265c231ad45f4ffd3babb67c024ef8ceb5a698e292464263
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          favicon.ico
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\favicon.ico
                          • Size 3KB
                          • SHA256 d5343ff39d29ecd9b60fd31cc60321b2d4a36001d5d1ee24f6c766b10eef0095
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          j001.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\j001.nbd
                          • Size 10KB
                          • SHA256 e312728e0491e1a15405566c8f591cf3ca6128ca17e5e022a7550494a600ad27
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          j2.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\j2.nbd
                          • Size 44KB
                          • SHA256 c032c71a49e0cb05072602c99251e6b1d76ca2db57120fc402b93d3392df7c3c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          j2.nbd-SR
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\j2.nbd-SR
                          • Size 907B
                          • SHA256 1837a9f0653a4093e448de37fdbf2bb0e4c3e98abb1414b8e60793a2863208a9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          j3.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\j3.nbd
                          • Size 48KB
                          • SHA256 197cd5e9b3bdec70314d3b3e5ddb5ee41578907a8a50d9ad2fc3683ff271656f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          j3.nbd-SR
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\j3.nbd-SR
                          • Size 1KB
                          • SHA256 2a9cbdbd1459111eac43d2d505e7828108c68cc5042c97b4e93d235962f8ad59
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          msvbvm60.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\msvbvm60.dll
                          • Size 1.3MB
                          • SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msvcrt.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\msvcrt.dll
                          • Size 288KB
                          • SHA256 d7cea69a98579d928e534070f5293e80ed7df38baf611b20717ef55aa1344a18
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          p001.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\p001.nbd
                          • Size 22KB
                          • SHA256 6e39e8b14ac5a0dad47279595406a49c61c6748f16f4e69dd48738653e50882f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          s1.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\s1.nbd
                          • Size 188KB
                          • SHA256 abad946feed68057f15569c0df432790b0c19a21149c8f07ecfc99fac2311616
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sites.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\sites.nbd
                          • Size 888B
                          • SHA256 5a8749440d441766dba442097d5956cd7bfc0f3bb1fb46d431df341bba1a2778
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          speedup.ico
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\speedup.ico
                          • Size 23KB
                          • SHA256 aebda70076ae40f99896ee71d5a476444e91974a215663161b6b1d89faa3ab2c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ssa3d30.ocx
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\ssa3d30.ocx
                          • Size 320KB
                          • SHA256 7a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sstabs2.ocx
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\sstabs2.ocx
                          • Size 288KB
                          • SHA256 596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          t001.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\t001.nbd
                          • Size 29KB
                          • SHA256 b30e7a66488327c0cf090ae98eece036f326c7f5b2ffa9f9cac3bf7df3e7af47
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          t2.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\t2.nbd
                          • Size 65KB
                          • SHA256 87d531d27e9987f39934b0f093542790f25882c9e6e20ca554ca0405a16a4acf
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          t3.nbd
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\t3.nbd
                          • Size 54KB
                          • SHA256 94c638be958f83325f9b96303e050383881959f509bc6c4afacd890db3755672
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          t3.nbd-SR
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$TEMP\t3.nbd-SR
                          • Size 903B
                          • SHA256 a994e2ea053542543b647dc81d6e0aa7fc7585311b77f5fd76e13b1bd73a67cf
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Bonzi.acs
                          • Path C:\Users\Admin\AppData\Local\Temp\3\$WINDIR\MsAgent\chars\Bonzi.acs
                          • Size 5.0MB
                          • SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          uninst.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\3\uninst.exe
                          • Size 75KB
                          • SHA256 f01ecaaa5bfb32d500a79ea28a64c5a25ec81c03f7cbf4206706e7580508ce4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ADVPACK.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                          • Size 73KB
                          • SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTANM.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
                          • Size 40KB
                          • SHA256 905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTCTL.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL
                          • Size 160KB
                          • SHA256 d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTDP2.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
                          • Size 60KB
                          • SHA256 c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTDPV.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
                          • Size 64KB
                          • SHA256 394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTMPX.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
                          • Size 60KB
                          • SHA256 6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTPSH.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
                          • Size 36KB
                          • SHA256 8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTSR.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
                          • Size 60KB
                          • SHA256 e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGENTSVR.EXE
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
                          • Size 268KB
                          • SHA256 e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGT0409.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
                          • Size 28KB
                          • SHA256 6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGT0409.HLP
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
                          • Size 8KB
                          • SHA256 e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGT20.INF
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
                          • Size 2KB
                          • SHA256 49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          AGTCTL15.TLB
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
                          • Size 28KB
                          • SHA256 3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGTEULA.TXT
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTEULA.TXT
                          • Size 13KB
                          • SHA256 225d227abbd45bf54d01dfc9fa6e54208bf5ae452a32cc75b15d86456a669712
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AGTINST.INF
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
                          • Size 7KB
                          • SHA256 bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSLWVTTS.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
                          • Size 52KB
                          • SHA256 ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Msvcirt.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll
                          • Size 76KB
                          • SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Msvcp50.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll
                          • Size 552KB
                          • SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          W95INF16.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL
                          • Size 2KB
                          • SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          W95INF32.DLL
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL
                          • Size 4KB
                          • SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          andmoipa.ttf
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf
                          • Size 29KB
                          • SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tv_enua.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll
                          • Size 1.2MB
                          • SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tv_enua.hlp
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp
                          • Size 11KB
                          • SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tv_enua.inf
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf
                          • Size 2KB
                          • SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          tvenuax.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll
                          • Size 40KB
                          • SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          PCWCD45.xml
                          • Path C:\Users\Admin\AppData\Local\Temp\PCWCD45.xml
                          • Size 732B
                          • SHA256 c7f9c14df9e33cbd3b9af7e0879c92c4abd2f6a8821c3cdf1b08e5b92f448f14
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          __PSScriptPolicyTest_e3or3ans.1t2.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e3or3ans.1t2.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          UAC.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\nsx6E42.tmp\UAC.dll
                          • Size 14KB
                          • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OLD8088.tmp
                          • Path C:\Windows\Temp\OLD8088.tmp
                          • Size 63KB
                          • SHA256 6da6ccebf7e1d9656e43e74ffae8d44ba8edebf043dd61b35b36079527305c36
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DiagPackage.dll
                          • Path C:\Windows\Temp\SDIAG_2a806ec0-2a97-4f55-9422-e8c7b31184b8\DiagPackage.dll
                          • Size 65KB
                          • SHA256 9d6e3ed51893661dfe5a98557f5e7e255bbe223e3403a42aa44ea563098c947e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DiagPackage.dll.mui
                          • Path C:\Windows\Temp\SDIAG_2a806ec0-2a97-4f55-9422-e8c7b31184b8\en-US\DiagPackage.dll.mui
                          • Size 10KB
                          • SHA256 51d06affd4db0e4b37d35d0e85b8209d5fab741904e8d03df1a27a0be102324f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DebugReport.xml
                          • Path C:\Windows\Temp\SDIAG_2a806ec0-2a97-4f55-9422-e8c7b31184b8\result\DebugReport.xml
                          • Size 3KB
                          • SHA256 fc74690cc2b383987e9d58215bb6801841df8a58054ddd7fde4f66fedcaa19ad
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          results.xsl
                          • Path C:\Windows\Temp\SDIAG_2a806ec0-2a97-4f55-9422-e8c7b31184b8\result\results.xsl
                          • Size 47KB
                          • SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/224-1357-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1354-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1355-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1358-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1359-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1351-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1352-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1350-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/224-1356-0x00000219AD150000-0x00000219AD151000-memory.dmp
                          Download

                          memory/808-1513-0x00000219F8190000-0x00000219F81B2000-memory.dmp
                          Download

                          memory/808-1537-0x00000219F8430000-0x00000219F8438000-memory.dmp
                          Download

                          memory/808-1529-0x00000219F81C0000-0x00000219F81C8000-memory.dmp
                          Download

                          memory/808-1521-0x00000219F7280000-0x00000219F7288000-memory.dmp
                          Download

                          memory/4232-935-0x0000000000F60000-0x0000000000F80000-memory.dmp
                          Download

                          memory/4848-872-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-873-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-874-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-868-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-869-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-871-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-870-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-864-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-863-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4848-862-0x000001AE6D560000-0x000001AE6D561000-memory.dmp
                          Download

                          memory/4928-1092-0x0000000000BE0000-0x0000000000C00000-memory.dmp
                          Download