File name:

bonzify.exe

Full analysis: https://app.any.run/tasks/5a48e826-18d4-4fc0-bcdd-83adcd69d50a
Verdict: Malicious activity
Analysis date: March 26, 2025, 15:52:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

FBA93D8D029E85E0CDE3759B7903CEE2

SHA1:

525B1AA549188F4565C75AB69E51F927204CA384

SHA256:

66F62408DFCE7C4A5718D2759F1D35721CA22077398850277D16E1FCA87FE764

SSDEEP:

196608:adAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3m:OaWedh+Idx75QYub//73lc6u7bLMYxDm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • bonzify.exe (PID: 576)

    • Executing a file with an untrusted certificate

      • INSTALLER.exe (PID: 2960)
      • INSTALLER.exe (PID: 1548)

    • Registers / Runs the DLL via REGSVR32.EXE

      • INSTALLER.exe (PID: 2960)
      • INSTALLER.exe (PID: 1548)

    • Changes the autorun value in the registry

      • INSTALLER.exe (PID: 1548)

    • Changes the AppInit_DLLs value (autorun option)

      • bonzify.exe (PID: 576)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • bonzify.exe (PID: 576)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1336)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1336)

    • Starts CMD.EXE for commands execution

      • bonzify.exe (PID: 576)

    • Starts a Microsoft application from unusual location

      • INSTALLER.exe (PID: 2960)
      • INSTALLER.exe (PID: 1548)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 1336)

    • Executable content was dropped or overwritten

      • bonzify.exe (PID: 576)
      • INSTALLER.exe (PID: 2960)
      • INSTALLER.exe (PID: 1548)

    • Process drops legitimate windows executable

      • INSTALLER.exe (PID: 2960)
      • bonzify.exe (PID: 576)
      • INSTALLER.exe (PID: 1548)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3876)
      • regsvr32.exe (PID: 2416)
      • regsvr32.exe (PID: 1416)
      • regsvr32.exe (PID: 288)
      • regsvr32.exe (PID: 1472)
      • regsvr32.exe (PID: 3160)
      • regsvr32.exe (PID: 2388)
      • regsvr32.exe (PID: 1504)
      • regsvr32.exe (PID: 2356)

    • Creates a software uninstall entry

      • INSTALLER.exe (PID: 1548)

    • Creates file in the systems drive root

      • fsquirt.exe (PID: 2968)
      • wuauclt.exe (PID: 3328)
      • xpsrchvw.exe (PID: 996)

    • There is functionality for taking screenshot (YARA)

      • AgentSvr.exe (PID: 2872)

  • INFO

    • Create files in a temporary directory

      • bonzify.exe (PID: 576)
      • INSTALLER.exe (PID: 2960)
      • INSTALLER.exe (PID: 1548)

    • Checks supported languages

      • bonzify.exe (PID: 576)
      • INSTALLER.exe (PID: 2960)
      • AgentSvr.exe (PID: 1400)
      • INSTALLER.exe (PID: 1548)
      • AgentSvr.exe (PID: 2872)
      • cmmon32.exe (PID: 3160)
      • WPDShextAutoplay.exe (PID: 1788)
      • BdeUISrv.exe (PID: 932)
      • TRACERT.EXE (PID: 3372)
      • dispdiag.exe (PID: 2760)
      • ehsched.exe (PID: 2196)
      • aspnet_state.exe (PID: 3168)
      • wuauclt.exe (PID: 3328)
      • PresentationHost.exe (PID: 3284)
      • xpsrchvw.exe (PID: 996)
      • MediaCenterWebLauncher.exe (PID: 3640)

    • Reads the computer name

      • INSTALLER.exe (PID: 2960)
      • INSTALLER.exe (PID: 1548)
      • bonzify.exe (PID: 576)
      • AgentSvr.exe (PID: 2872)
      • WPDShextAutoplay.exe (PID: 1788)
      • BdeUISrv.exe (PID: 932)
      • dispdiag.exe (PID: 2760)
      • ehsched.exe (PID: 2196)
      • aspnet_state.exe (PID: 3168)
      • wuauclt.exe (PID: 3328)
      • MediaCenterWebLauncher.exe (PID: 3640)
      • xpsrchvw.exe (PID: 996)

    • The sample compiled with english language support

      • INSTALLER.exe (PID: 2960)
      • bonzify.exe (PID: 576)
      • INSTALLER.exe (PID: 1548)

    • Reads the machine GUID from the registry

      • bonzify.exe (PID: 576)
      • AgentSvr.exe (PID: 2872)
      • BdeUISrv.exe (PID: 932)
      • WPDShextAutoplay.exe (PID: 1788)
      • wuauclt.exe (PID: 3328)
      • MediaCenterWebLauncher.exe (PID: 3640)

    • Manual execution by a user

      • fsquirt.exe (PID: 2968)
      • cmmon32.exe (PID: 3160)
      • osk.exe (PID: 2960)
      • sdchange.exe (PID: 3624)
      • dllhst3g.exe (PID: 3012)
      • expand.exe (PID: 3816)
      • rstrui.exe (PID: 2268)
      • BdeUISrv.exe (PID: 932)
      • regini.exe (PID: 2608)
      • BitLockerWizard.exe (PID: 4072)
      • TRACERT.EXE (PID: 3372)
      • diskperf.exe (PID: 3844)
      • SystemPropertiesProtection.exe (PID: 532)
      • dispdiag.exe (PID: 2760)
      • WPDShextAutoplay.exe (PID: 1788)
      • mqtgsvc.exe (PID: 2428)
      • comrepl.exe (PID: 916)
      • wuauclt.exe (PID: 3328)
      • ehsched.exe (PID: 2196)
      • msoobe.exe (PID: 2396)
      • snmptrap.exe (PID: 3580)
      • PresentationHost.exe (PID: 3284)
      • cipher.exe (PID: 880)
      • xpsrchvw.exe (PID: 996)
      • MediaCenterWebLauncher.exe (PID: 3640)
      • aspnet_state.exe (PID: 3168)
      • dllhst3g.exe (PID: 1816)

    • Disables trace logs

      • cmmon32.exe (PID: 3160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (80.4)
.exe | Win32 Executable MS Visual C++ (generic) (8.2)
.exe | Win64 Executable (generic) (7.3)
.dll | Win32 Dynamic Link Library (generic) (1.7)
.exe | Win32 Executable (generic) (1.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:10:13 11:42:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 4096
InitializedDataSize: 6696960
UninitializedDataSize: -
EntryPoint: 0x16b0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
48
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bonzify.exe cmd.exe no specs taskkill.exe no specs takeown.exe no specs icacls.exe no specs installer.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs agentsvr.exe no specs grpconv.exe no specs installer.exe regsvr32.exe no specs regsvr32.exe no specs grpconv.exe no specs agentsvr.exe fsquirt.exe no specs cmmon32.exe no specs osk.exe no specs sdchange.exe no specs dispdiag.exe wpdshextautoplay.exe no specs expand.exe no specs dllhst3g.exe no specs rstrui.exe no specs bdeuisrv.exe no specs regini.exe no specs bitlockerwizard.exe no specs tracert.exe no specs diskperf.exe no specs systempropertiesprotection.exe no specs comrepl.exe no specs mqtgsvc.exe no specs ehsched.exe no specs msoobe.exe no specs snmptrap.exe no specs aspnet_state.exe no specs presentationhost.exe no specs wuauclt.exe no specs cipher.exe no specs mediacenterweblauncher.exe no specs xpsrchvw.exe dllhst3g.exe no specs bonzify.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
288regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"C:\Windows\System32\regsvr32.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
532"C:\Windows\System32\SystemPropertiesProtection.exe"C:\Windows\System32\SystemPropertiesProtection.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System Protection Settings
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\systempropertiesprotection.exe
c:\windows\system32\ntdll.dll
576"C:\Users\admin\AppData\Local\Temp\bonzify.exe" C:\Users\admin\AppData\Local\Temp\bonzify.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\bonzify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
880"C:\Windows\System32\cipher.exe"C:\Windows\System32\cipher.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
File Encryption Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cipher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
916"C:\Windows\SysWow64\com\comrepl.exe"C:\Windows\System32\com\comrepl.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM+ Server Replication
Exit code:
1
Version:
2001.12.8530.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\com\comrepl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
932"C:\Windows\winsxs\x86_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_647c0a30066b1ab5\BdeUISrv.exe"C:\Windows\winsxs\x86_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_647c0a30066b1ab5\BdeUISrv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BDE UI Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\winsxs\x86_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_647c0a30066b1ab5\bdeuisrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
984grpconv.exe -oC:\Windows\System32\grpconv.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996"C:\Windows\winsxs\x86_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7601.24024_none_17a13a8ec59fb44d\xpsrchvw.exe"C:\Windows\winsxs\x86_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7601.24024_none_17a13a8ec59fb44d\xpsrchvw.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XPS Viewer
Exit code:
0
Version:
6.1.7601.24024 (win7sp1_ldr.180112-0600)
Modules
Images
c:\windows\winsxs\x86_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7601.24024_none_17a13a8ec59fb44d\xpsrchvw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1336C:\Windows\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\KillAgent.bat"C:\Windows\System32\cmd.exe—bonzify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1400"C:\Windows\msagent\AgentSvr.exe" /regserverC:\Windows\msagent\AgentSvr.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Agent Server
Exit code:
0
Version:
2.00.0.2202
Modules
Images
c:\windows\msagent\agentsvr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
2 113
Read events
2 019
Write events
78
Delete events
16

Modification events

(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Control
Operation:delete keyName:(default)
Value:
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus\1
Operation:delete keyName:(default)
Value:
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus
Operation:delete keyName:(default)
Value:
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Programmable
Operation:delete keyName:(default)
Value:
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ToolboxBitmap32
Operation:delete keyName:(default)
Value:
(PID) Process:(3876) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\TypeLib
Operation:delete keyName:(default)
Value:
Executable files
54
Suspicious files
17
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
576bonzify.exeC:\Users\admin\AppData\Local\Temp\KillAgent.battext
MD5:EA7DF060B402326B4305241F21F39736
SHA256:E4EDC2CB6317AB19EE1A6327993E9332AF35CFBEBAFF2AC7C3F71D43CFCBE793
2960INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLLexecutable
MD5:A334BBF5F5A19B3BDB5B7F1703363981
SHA256:C33BEABA130F8B740DDDB9980FE9012F9322AC6E94F36A6AA6086851C51B98DE
2960INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLLexecutable
MD5:237E13B95AB37D0141CF0BC585B8DB94
SHA256:D19B6B7C57BCEE7239526339E683F62D9C2F9690947D0A446001377F0B56103A
2960INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGTEULA.TXTtext
MD5:7070B77ED401307D2E9A0F8EAAAA543B
SHA256:225D227ABBD45BF54D01DFC9FA6E54208BF5AE452A32CC75B15D86456A669712
2960INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLLexecutable
MD5:B4AC608EBF5A8FDEFA2D635E83B7C0E8
SHA256:8414DFE399813B7426C235BA1E625BD2B5635C8140DA0D0CFC947F6565FE415F
2960INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLLexecutable
MD5:9FAFB9D0591F2BE4C2A846F63D82D301
SHA256:E78E74C24D468284639FAF9DCFDBA855F3E4F00B2F26DB6B2C491FA51DA8916D
2960INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLLexecutable
MD5:316999655FEF30C52C3854751C663996
SHA256:EA4CA740CD60D2C88280FF8115BF354876478EF27E9E676D8B66601B4E900BA0
576bonzify.exeC:\Users\admin\AppData\Local\Temp\INSTALLER.exeexecutable
MD5:66996A076065EBDCDAC85FF9637CEAE0
SHA256:16CA09AD70561F413376AD72550AE5664C89C6A76C85C872FFE2CB1E7F49E2AA
576bonzify.exeC:\Windows\executables.binbinary
MD5:F3160BA7F8BB9D7A9C6080EF2C9869C5
SHA256:F6A3286714A661612EAC65E4A6CB78736C370492151B692A8F1E666740C0A00E
2960INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLLexecutable
MD5:7C5AEFB11E797129C9E90F279FBDF71B
SHA256:394A17150B8774E507B8F368C2C248C10FCE50FC43184B744E771F0E79ECAFED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted

Threats

No threats detected
Process
Message
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
ClaimOutput
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bonzify.exe