URL:

https://bonzi.link/

Full analysis: https://app.any.run/tasks/49053099-57fe-4428-a166-0dab98eba912
Verdict: Malicious activity
Analysis date: March 20, 2024, 12:00:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

1140171B39D570CE50B3779922DF0894

SHA1:

BCF0DB75B50DFC7EB2906063628C9B14D4FA7B58

SHA256:

E9F27F4B83B04B449BC7D4C120CB245ED43E338CBB94D341F735FE0889D60BFD

SSDEEP:

3:N89K:29K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MSAGENT.EXE (PID: 1288)
      • tv_enua.exe (PID: 1072)
      • BonziBuddy432.exe (PID: 1028)

    • Registers / Runs the DLL via REGSVR32.EXE

      • MSAGENT.EXE (PID: 1288)
      • tv_enua.exe (PID: 1072)

    • Creates a writable file in the system directory

      • tv_enua.exe (PID: 1072)

    • Changes the autorun value in the registry

      • tv_enua.exe (PID: 1072)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • BonziBuddy432.exe (PID: 1028)
      • MSAGENT.EXE (PID: 1288)
      • tv_enua.exe (PID: 1072)

    • Creates/Modifies COM task schedule object

      • BonziBuddy432.exe (PID: 1028)
      • regsvr32.exe (PID: 2612)
      • regsvr32.exe (PID: 2228)
      • regsvr32.exe (PID: 3056)
      • regsvr32.exe (PID: 4016)
      • regsvr32.exe (PID: 3060)
      • regsvr32.exe (PID: 3688)
      • regsvr32.exe (PID: 3560)
      • regsvr32.exe (PID: 2436)
      • regsvr32.exe (PID: 3368)

    • Starts CMD.EXE for commands execution

      • BonziBuddy432.exe (PID: 1028)

    • Reads the Internet Settings

      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_4.EXE (PID: 2760)

    • Reads security settings of Internet Explorer

      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_4.EXE (PID: 2760)

    • Executing commands from a ".bat" file

      • BonziBuddy432.exe (PID: 1028)

    • Executable content was dropped or overwritten

      • MSAGENT.EXE (PID: 1288)
      • BonziBuddy432.exe (PID: 1028)
      • tv_enua.exe (PID: 1072)

    • Creates a software uninstall entry

      • BonziBuddy432.exe (PID: 1028)
      • tv_enua.exe (PID: 1072)

    • Reads settings of System Certificates

      • BonziBDY_35.EXE (PID: 1604)

    • Checks Windows Trust Settings

      • BonziBDY_35.EXE (PID: 1604)

    • Uses RUNDLL32.EXE to load library

      • BonziBDY_35.EXE (PID: 1604)

    • Adds/modifies Windows certificates

      • BonziBDY_35.EXE (PID: 1604)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1624)
      • BonziBuddy432.exe (PID: 1380)
      • WinRAR.exe (PID: 1592)
      • BonziBuddy432.exe (PID: 3292)
      • explorer.exe (PID: 1484)
      • msedge.exe (PID: 2860)
      • BonziBDY_4.EXE (PID: 2760)
      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_35.EXE (PID: 1604)
      • wuapp.exe (PID: 2324)
      • BonziBDY_2.EXE (PID: 2636)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3500)

    • Application launched itself

      • iexplore.exe (PID: 3500)
      • msedge.exe (PID: 2860)
      • msedge.exe (PID: 2836)

    • Reads the computer name

      • BonziBuddy432.exe (PID: 1380)
      • wmpnscfg.exe (PID: 1624)
      • MSAGENT.EXE (PID: 1288)
      • tv_enua.exe (PID: 1072)
      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_4.EXE (PID: 2760)
      • AgentSvr.exe (PID: 1596)
      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_2.EXE (PID: 2636)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3500)
      • WinRAR.exe (PID: 1592)

    • Create files in a temporary directory

      • BonziBuddy432.exe (PID: 1380)
      • MSAGENT.EXE (PID: 1288)
      • tv_enua.exe (PID: 1072)
      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_4.EXE (PID: 2760)
      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_2.EXE (PID: 2636)

    • Checks supported languages

      • BonziBuddy432.exe (PID: 1380)
      • BonziBuddy432.exe (PID: 1028)
      • wmpnscfg.exe (PID: 1624)
      • tv_enua.exe (PID: 1072)
      • MSAGENT.EXE (PID: 1288)
      • AgentSvr.exe (PID: 3968)
      • BonziBDY_4.EXE (PID: 2760)
      • AgentSvr.exe (PID: 1596)
      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_2.EXE (PID: 2636)

    • Creates files in the program directory

      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_4.EXE (PID: 2760)

    • Reads mouse settings

      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_35.EXE (PID: 1604)

    • Creates files or folders in the user directory

      • BonziBuddy432.exe (PID: 1028)
      • BonziBDY_35.EXE (PID: 1604)

    • Reads the machine GUID from the registry

      • BonziBDY_4.EXE (PID: 2760)
      • AgentSvr.exe (PID: 1596)
      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_2.EXE (PID: 2636)

    • Reads Microsoft Office registry keys

      • BonziBDY_35.EXE (PID: 1604)

    • Checks proxy server information

      • BonziBDY_35.EXE (PID: 1604)
      • BonziBDY_4.EXE (PID: 2760)

    • Reads the software policy settings

      • BonziBDY_35.EXE (PID: 1604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
43
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs explorer.exe no specs winrar.exe no specs bonzibuddy432.exe no specs bonzibuddy432.exe bonzibuddy432.exe cmd.exe no specs msagent.exe tv_enua.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs agentsvr.exe no specs grpconv.exe no specs regsvr32.exe no specs regsvr32.exe no specs grpconv.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bonzibdy_4.exe agentsvr.exe bonzibdy_35.exe rundll32.exe no specs wuapp.exe no specs bonzibdy_2.exe

Process information

PID
CMD
Path
Indicators
Parent process
1028"C:\Users\admin\Downloads\BonziBuddy432.exe" C:\Users\admin\Downloads\BonziBuddy432.exe
explorer.exe
User:
admin
Company:
Bonzi Software
Integrity Level:
HIGH
Description:
BonziBuddy432 4 Installation
Exit code:
0
Version:
4
Modules
Images
c:\users\admin\downloads\bonzibuddy432.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1072tv_enua.exe C:\Program Files\BonziBuddy432\Runtimes\tv_enua.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
4.71.1015.0
Modules
Images
c:\program files\bonzibuddy432\runtimes\tv_enua.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1168"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3232 --field-trial-handle=1288,i,4511402256110208696,16170208328677655014,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1288MSAGENT.EXE C:\Program Files\BonziBuddy432\Runtimes\MSAGENT.EXE
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
4.71.1015.0
Modules
Images
c:\program files\bonzibuddy432\runtimes\msagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1380"C:\Users\admin\Downloads\BonziBuddy432.exe" C:\Users\admin\Downloads\BonziBuddy432.exe
explorer.exe
User:
admin
Company:
Bonzi Software
Integrity Level:
HIGH
Description:
BonziBuddy432 4 Installation
Exit code:
0
Version:
4
Modules
Images
c:\users\admin\downloads\bonzibuddy432.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1384grpconv.exe -oC:\Windows\System32\grpconv.exe—tv_enua.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1484"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1572"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1572 --field-trial-handle=1288,i,4511402256110208696,16170208328677655014,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1592"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\Bon.zip" C:\Users\admin\Downloads\C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1596C:\Windows\msagent\AgentSvr.exe -EmbeddingC:\Windows\msagent\AgentSvr.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Agent Server
Exit code:
0
Version:
2.00.0.2202
Modules
Images
c:\windows\msagent\agentsvr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
52 426
Read events
51 387
Write events
786
Delete events
253

Modification events

(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31095486
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31095486
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
84
Suspicious files
125
Text files
423
Unknown types
79

Dropped files

PID
Process
Filename
Type
3500iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:7D1B274938774F9A8E6B3191740FD1DB
SHA256:CA6F02E76DB21050C0FF5C41C07C7DA9CECE660259E907205E4F17A2BA7E9401
3500iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:1E1162F2EF525E8B39D679CA593AE98A
SHA256:55F86AF2E11CE31FEE5F700C0A1205E72E554D08E480C9B40BF49CF48F5F1479
3500iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:89D0A0B14D9B578C4AF0F6B364F7844A
SHA256:D2C595EC72E0173470B3E0D0335C4A165FD5C8253B365B71A3B11B924A3A9FD6
2232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177binary
MD5:823CA70D3B2303DE0887061D6FADFC5A
SHA256:9D31CAEB6C493ED2459DE54554CDF3E871C61D5C9E698B6DFABD78BE8DA3F18D
2232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177binary
MD5:BD9C66DE2211B54E403119C37352906F
SHA256:7732683E15DF321528E9BD1A54A0C1A2D65A2EA350BADFD11BD2EFA0B6E5B690
3500iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3500iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2232iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\375RQGMT.txttext
MD5:6A29617BAB20ABB8FB03A0315A6CD561
SHA256:B7E17C8B71F20F1AF67DF8E348865633A57070ECE7DCD11CE95A02C2487C3BD6
2232iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\88NKBRAV.txttext
MD5:57234F2D084F4E86EB9C2D0BE71E46F3
SHA256:C3B050BA714C65C852CF266D8E9111ADEC1D6A83D43009C86FE63EDB396C2EDF
2232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\download[1].gifimage
MD5:4B1C229D42D8604A214C6A6799AAA868
SHA256:820701D14CAD06E81EB0FEC257AEB9A384CB55F8C9946F3D94FA7322043542E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
222
TCP/UDP connections
156
DNS requests
64
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3500
iexplore.exe
GET
304
62.115.252.160:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?96c8eb5dfc595a04
unknown
—
—
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/images/bbabilities2.gif
unknown
image
24.8 Kb
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/images/sepbar.jpg
unknown
image
1.05 Kb
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/images/meetyou.jpg
unknown
image
39.2 Kb
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/
unknown
compressed
3.67 Kb
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/images/download.gif
unknown
image
151 b
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/images/bbmail.gif
unknown
image
23.0 Kb
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/images/bbvine.gif
unknown
image
4.59 Kb
unknown
2232
iexplore.exe
GET
200
151.106.4.82:80
http://bonzi.link/images/bbcalendar.gif
unknown
image
26.6 Kb
unknown
2232
iexplore.exe
GET
200
216.58.206.34:80
http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
unknown
text
61.0 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2232
iexplore.exe
151.106.4.82:443
bonzi.link
Host Europe GmbH
FR
unknown
3500
iexplore.exe
62.115.252.67:443
www.bing.com
Telia Company AB
ES
unknown
3500
iexplore.exe
62.115.252.232:80
ctldl.windowsupdate.com
Telia Company AB
ES
unknown
3500
iexplore.exe
62.115.252.160:80
ctldl.windowsupdate.com
Telia Company AB
ES
unknown
3500
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2232
iexplore.exe
13.107.5.80:443
api.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2232
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
bonzi.link
  • 151.106.4.82
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 62.115.252.67
  • 80.239.137.138
  • 62.115.252.64
  • 62.115.252.59
  • 62.115.252.72
  • 62.115.252.66
  • 80.239.137.136
  • 62.115.252.74
  • 80.239.137.145
  • 104.117.244.112
  • 104.117.244.91
  • 104.117.244.98
  • 104.117.244.89
  • 104.117.244.75
  • 104.117.244.107
  • 104.117.244.97
  • 104.117.244.80
  • 104.117.244.106
whitelisted
ctldl.windowsupdate.com
  • 62.115.252.160
  • 62.115.252.232
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
pagead2.googlesyndication.com
  • 216.58.206.34
whitelisted
d36ee2fcip1434.cloudfront.net
  • —
unknown
ocsp.pki.goog
  • 142.250.186.163
whitelisted
fundingchoicesmessages.google.com
  • 216.58.206.78
whitelisted
fonts.googleapis.com
  • 142.250.185.170
whitelisted

Threats

PID
Process
Class
Message
1572
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
1572
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
1572
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
1572
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
1572
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
1572
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
Process
Message
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bonzi.link/