caa6aa5632df1be94dada89120172716bfae182ca971e3ba9b5034029ebb300c

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Size 12.6MB
Sample260602-n7pywsdw5j
SHA256 caa6aa5632df1be94dada89120172716bfae182ca971e3ba9b5034029ebb300c
MD5 55653ddae6c992d4935099bdd5ff3a0d
SHA1 5d9038846a22e42a8bc11ed74536bb8b2a10b4bc
SHA512 e70abc25dcf5b1f9e5608921e5b14fcb77b8e503cab9d1ab7b9594f0b82b518eaf38402c86dd9bed7bc789fb3c93aa56475b84ed8cf38ad7bd6459fbb8d8183e
SSDEEP 196608:63G05aJvzdxoAk7KrxgtFCQYhztrDi1G4kdavVoWiZXiE6QQrnx8lR9b29f6O9KL:041XY70yCBjdaK+EGrnxw2N9Kpdz
TLSH
T1DBD63375F2A800FCF093917CC9A3CD22D6673C4D02A176CB23667B4A3E7B55A5D2A271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	RegDll.x64.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
1700	BANDIVIEW-SETUP-X64.exe
4792	BandiView.exe
2476	RegDll.x64.exe
3364	RegDll.x64.exe
2532	RegDll.x64.exe
1332	RegPackage.x86.exe
1984	Replace.exe

Loads dropped DLL 1 IoCs

pid	Process
2532	RegDll.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\BandiView\langs\Bulgarian.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\clip.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\data\skin.data	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\dll\libexif.x64.dll	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\Uninstall.exe	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\orf.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\tga.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Belarusian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Spanish.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\data\local.html	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\gif.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\German.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Slovak.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\skia.x64.dll	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\Uninstall.exe	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\shell\BandiView.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\BandiView.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Greek.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Hebrew.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\SimpChinese.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\plugins\@files.txt	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\bmp.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\psb.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\tga.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Slovenian.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Spanish.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Ukrainian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\vcomp140.dll	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\avif.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\clip.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Croatian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\dng.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\heic.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\tif.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Croatian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\data\resource.data	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\dll\libsqlite.x64.dll	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\shell\BandiView.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Dutch.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\data\icudtl.dat	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\shell\RegPackage.x86.exe	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\webp.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Arabic.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Polish.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Portuguese.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\arw.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\bmp.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\dll\libsqlite.x64.dll	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\arw.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Greek.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\PortugueseBR.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\SimpChinese.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\TradChinese.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\exr.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\png.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\psd.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Serbian.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Turkish.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\plugins\@files.txt	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\data\OpenSourceLicense.txt	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\BandiView.exe	Replace.exe
File opened for modification	C:\Program Files\BandiView\config.ini	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Hebrew.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Ukrainian.lang	BANDIVIEW-SETUP-X64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BANDIVIEW-SETUP-X64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegPackage.x86.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\BandiView.exe = "11000"	RegDll.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\BandiView.exe = "11000"	RegDll.x64.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248753839849262"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.cr2\ = "BandiView.cr2"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pef\ = "BandiView.pef"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.sr2	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.mef\ = "RAW Image (mef) File"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpe\Shell\Open	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.x3f	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.gif	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dng\ = "BandiView.dng"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.3fr\Shell	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jfif\Shell\Open\Command\ = "\"C:\\Program Files\\BandiView\\BandiView.exe\" \"%1\""	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.png	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.pef\ = "RAW Image (pef) File"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cb7\ = "BandiView.cb7"	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.jpg\BandiView_bak = "jpegfile"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpg	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpf\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\BandiView.ico"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.heic\Shell	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cr2\ = "BandiView.cr2"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.pef\Shell\Open\Command\ = "\"C:\\Program Files\\BandiView\\BandiView.exe\" \"%1\""	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.dng\Shell\Open\Command	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BandiView.raf	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.png\BandiView_bak = "pngfile"	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pbm	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpc\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.j2c\DefaultIcon	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.arw\Shell\Open\Command	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.mef\Shell\Open\Command\ = "\"C:\\Program Files\\BandiView\\BandiView.exe\" \"%1\""	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jxr\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.hdp\ = "Image (hdp) File"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.avif\DefaultIcon	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.avif\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\avif.ico"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jp2	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hdp\PerceivedType = "image"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bpg\ = "BandiView.bpg"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.nrw\Shell	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.cbz\ = "Compressed Image (cbz) File"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	BANDIVIEW-SETUP-X64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jxl	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.arw\PerceivedType = "image"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.erf\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpg\Shell\Open	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.jpe\PerceivedType = "image"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpe\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\jpg.ico"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.tiff\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\tif.ico"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jxr\Shell	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.mef\DefaultIcon	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.ico\ = "BandiView.ico"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.tga	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.kdc\Shell	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.jfif\ = "BandiView.jfif"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.ppm\Shell\Open\Command\ = "\"C:\\Program Files\\BandiView\\BandiView.exe\" \"%1\""	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpf\Shell	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.crw\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.nef\Shell\Open	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srw\ = "BandiView.srw"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.3fr\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.hif\Shell\Open\Command	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.sr2\Shell	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BandiView.jp2	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jpf	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BandiView.apng	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.crw\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\BandiView.ico"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.crw	BandiView.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1700	BANDIVIEW-SETUP-X64.exe
1700	BANDIVIEW-SETUP-X64.exe
5228	msedge.exe
5228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3364	RegDll.x64.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1700	BANDIVIEW-SETUP-X64.exe
4792	BandiView.exe
2476	RegDll.x64.exe
2532	RegDll.x64.exe
1332	RegPackage.x86.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1700	3236	2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	88
PID 1700 wrote to memory of 4792	1700	BANDIVIEW-SETUP-X64.exe	91
PID 1700 wrote to memory of 2476	1700	BANDIVIEW-SETUP-X64.exe	93
PID 1700 wrote to memory of 2532	1700	BANDIVIEW-SETUP-X64.exe	96
PID 1700 wrote to memory of 1332	1700	BANDIVIEW-SETUP-X64.exe	97
PID 3236 wrote to memory of 1984	3236	2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	103
PID 3236 wrote to memory of 1720	3236	2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	104
PID 1720 wrote to memory of 1500	1720	msedge.exe	105
PID 1720 wrote to memory of 860	1720	msedge.exe	106
PID 1720 wrote to memory of 60	1720	msedge.exe	107
PID 1720 wrote to memory of 60	1720	msedge.exe	107
PID 1720 wrote to memory of 60	1720	msedge.exe	107
PID 1720 wrote to memory of 3720	1720	msedge.exe	108
PID 1720 wrote to memory of 3720	1720	msedge.exe	108
PID 1720 wrote to memory of 1724	1720	msedge.exe	109
PID 1720 wrote to memory of 1724	1720	msedge.exe	109
PID 1720 wrote to memory of 1724	1720	msedge.exe	109
PID 1720 wrote to memory of 5020	1720	msedge.exe	110
PID 1720 wrote to memory of 5020	1720	msedge.exe	110
PID 1720 wrote to memory of 5020	1720	msedge.exe	110
PID 1720 wrote to memory of 5052	1720	msedge.exe	112
PID 1720 wrote to memory of 5052	1720	msedge.exe	112
PID 1720 wrote to memory of 5052	1720	msedge.exe	112
PID 1720 wrote to memory of 1164	1720	msedge.exe	113
PID 1720 wrote to memory of 1164	1720	msedge.exe	113
PID 1720 wrote to memory of 1164	1720	msedge.exe	113
PID 1720 wrote to memory of 3208	1720	msedge.exe	114
PID 1720 wrote to memory of 3208	1720	msedge.exe	114
PID 1720 wrote to memory of 4632	1720	msedge.exe	118
PID 1720 wrote to memory of 4632	1720	msedge.exe	118
PID 1720 wrote to memory of 4632	1720	msedge.exe	118
PID 1720 wrote to memory of 2516	1720	msedge.exe	119
PID 1720 wrote to memory of 2516	1720	msedge.exe	119
PID 1720 wrote to memory of 2516	1720	msedge.exe	119
PID 1720 wrote to memory of 2920	1720	msedge.exe	120
PID 1720 wrote to memory of 2920	1720	msedge.exe	120
PID 1720 wrote to memory of 5232	1720	msedge.exe	123
PID 1720 wrote to memory of 5240	1720	msedge.exe	124
PID 1720 wrote to memory of 5232	1720	msedge.exe	123
PID 1720 wrote to memory of 5240	1720	msedge.exe	124
PID 1720 wrote to memory of 5376	1720	msedge.exe	126
PID 1720 wrote to memory of 5808	1720	msedge.exe	127
PID 1720 wrote to memory of 5808	1720	msedge.exe	127
PID 1720 wrote to memory of 5820	1720	msedge.exe	128
PID 1720 wrote to memory of 5820	1720	msedge.exe	128
PID 1720 wrote to memory of 5984	1720	msedge.exe	129
PID 1720 wrote to memory of 5992	1720	msedge.exe	130
PID 1720 wrote to memory of 5984	1720	msedge.exe	129
PID 1720 wrote to memory of 5992	1720	msedge.exe	130
PID 1720 wrote to memory of 5648	1720	msedge.exe	131
PID 1720 wrote to memory of 5648	1720	msedge.exe	131
PID 1720 wrote to memory of 5320	1720	msedge.exe	138
PID 1720 wrote to memory of 540	1720	msedge.exe	139
PID 1720 wrote to memory of 5324	1720	msedge.exe	140
PID 1720 wrote to memory of 4504	1720	msedge.exe	142
PID 1720 wrote to memory of 4504	1720	msedge.exe	142
PID 1720 wrote to memory of 5228	1720	msedge.exe	149

C:\Users\Admin\AppData\Local\Temp\2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BANDIVIEW-SETUP-X64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BANDIVIEW-SETUP-X64.exe" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Program Files\BandiView\BandiView.exe
    "C:\Program Files\BandiView\BandiView.exe" /regmandatoryadmin
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4792
- - C:\Program Files\BandiView\data\RegDll.x64.exe
    "C:\Program Files\BandiView\data/RegDll.x64.exe" /regieemulation BandiView.exe
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2476
- - C:\Program Files\BandiView\data\RegDll.x64.exe
    "C:\Program Files\BandiView\data/RegDll.x64.exe" /calldll "C:\Program Files\BandiView\shell/bvshell.x64.dll" DllRegisterServer
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2532
- - C:\Program Files\BandiView\shell\RegPackage.x86.exe
    "C:\Program Files\BandiView\shell/RegPackage.x86.exe" /unreg BandiViewShellext
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1332
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cybermania.ws/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x29c,0x2c8,0x2cc,0x2a4,0x2ec,0x7fffff85c188,0x7fffff85c194,0x7fffff85c1a0
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,3400433616563396059,7662520587265804943,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
    3⤵
    - System Time Discovery
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,8831049083284090149,5783030896337335197,262144 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1567543251262126808,8640440643417611448,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,11907216375302204789,14387600717917470100,2097152 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,16236351774643425478,10527262029985480467,2097152 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,3541150986055825573,9078203002915620200,2097152 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,2513234146104327208,11433859314207582711,2097152 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,1716838191754142693,8347580595788888207,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5240,i,2672381409824920607,7363399579675640124,2097152 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5280,i,11376702973098807230,3086665261055341163,2097152 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,11825932799911330435,973813213752020948,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,4297482759766754365,15005922617513501049,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,1442250761838662986,292824526799480674,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,14915939500642095846,439981252229723224,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,14915939500642095846,439981252229723224,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,10297149477794311935,14446195629686626982,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,12411483937059634764,16949361262949000324,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,10658927551362847859,2517818976113517677,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,11423701091693421320,7741677609542158245,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7513479898547026832,9836900873005217948,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,481812226734786782,8310925107869816506,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,10349406171497795373,11575401476401103204,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,10088242057555057786,1757439348565443820,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,6880116483823245817,11179722833151520098,524288 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7120,i,67390687931700972,4563752800185572886,262144 --field-trial-handle=2368,i,14445144269579979665,15910633994033082955,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5228

C:\Program Files\BandiView\data\RegDll.x64.exe
"C:\Program Files\BandiView\data\RegDll.x64.exe" /pin "C:\Program Files\BandiView\BandiView.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BandiView.exe

Path C:\Program Files\BandiView\BandiView.exe
Size 6.7MB
SHA256 54de9d718833dc64bd71c1298d71c781a3ed5528cc568de94d3064d2d61a2741
MD5 6d1c0563df0b5ac95a12377f3e174073
SHA1 32caeb1a192734f979dbd88d0e0dce7e1f4bd796
SHA512 0e19a53ffd553d3222ee833ca41b827614d30f958e455a69eed764af470e36a50b3f9db1a27e7248653a250bee670c079a4515a5f094ed8dfea15a7b49552621
SSDEEP 98304:3lpkC1Ew2dz44S0T2SGtDEchL9s3HLH0Z:VpV1Ew2dz44S0T2BLL9s3HoZ
TLSH
T1AF667C42B1A801D8D1B7C078CE6AC917EB71344D13F186FB729096E52F27EE13A7A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Program Files\BandiView\config.ini
Size 80B
SHA256 96323ce5c2e5a44b16988778704b2244290dedea41dc32d8dbf067f03f28040d
MD5 63659cc6d1eccfb14fdaf8ff4672af82
SHA1 d8ac28ce6d20ebbf7b0248e0416baa01e162baa3
SHA512 008a9c03a3a3963b92370fa40f89837890bfd6a77a7f038676829e3100f9123f967dd72cb4cf42fe3a8cbe2b78232af1a019da6941a2a254e4082743d4185347
TLSH
T1ECA0120E036D59278418575ED810D39C3B9002C2101801120B22410100120820484457
MD5 SHA1 SHA512 TLSH

Submit Download

RegDll.x64.exe

Path C:\Program Files\BandiView\data\RegDll.x64.exe
Size 201KB
SHA256 f81f269e9b259b827ac9046c396dafbf8b13de454762fdb32a2147cda2174df3
MD5 b75caeba48754ea05dd3265e80917744
SHA1 7e90b2fe323e32b8ea3307e0356fe6648dc3cc35
SHA512 04b4816fc1992e626f978600766e77a8a0e9b7e5a80bb3aeae5d3aa198fb8b504205bb7c5075f503a53cf5420ae9e668d4db2b6b2f131deac5f55db6cc066e5a
SSDEEP 6144:TdQ5QphYNwhMdmJLxJ3Vx88YLzSpzSKpkN:R+Qp04JLx5Vx91M
TLSH
T14C141802326420E4F36A87358951E5859772BC7806E0EB8FD2787E765E332935E3B61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.data

Path C:\Program Files\BandiView\data\resource.data
Size 24KB
SHA256 81c3ebe48f2c070b53b888727354c978448afa1989f16ad09b20167b24fc64b1
MD5 5270333f8333ccbcd84186b043366cd7
SHA1 c91b0c663e71901903415f708bad804431f9cd9c
SHA512 88b92efa1965728de4ace453b168d9ced5893d4742efa4079e4f9387886ee95c41b36ea05a0d28d3361f8d37ca3b1ee7e29ce40202fca4e38df4d441d1ce49d0
SSDEEP 768:Qzk5Nur9Jhx5zaMMFAXpcclB4vCB9BB5w:QXgOXpr8vCrBA
TLSH
T162B2325C5CDB5996B838F18A966E8322159ACC33283698EC726C1DCC4F291580FF74FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.lang

Path C:\Program Files\BandiView\langs\English.lang
Size 58KB
SHA256 6b26a477e089a46e5ef4dcf403b98e7c34fb278e527baf4089bdfb9f43954bcc
MD5 81e1c6240c2970483142b653f6224946
SHA1 4437591178b989e24e1dfff1ab8cd3443b978fb6
SHA512 2ec8a563c357c2fbd91ef0a44fae98ba57700a7867c53a940ff748d5815cd7979a0460fe179f1e9a7da921d453d095aa7848e4f973f6e1afa866e39db25e7fa3
SSDEEP 768:H5/MMLUgfpM9nqTEwpORk6IMtjTWnPpe6Xc5DNwpr31gK8QNUu/HU:Z/vULnqTEwpOCRZpHXc5xugyU
TLSH
T16143E85F69022937A8537186BE8B97F26873D40E0E2D4B28B4AC58C4D37C56C077B7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@files.txt

Path C:\Program Files\BandiView\plugins\@files.txt
Size 1KB
SHA256 bcdf9c5a40abac7a10020e181518a968c20a7ea829c416706ec0a2519f63fd7e
MD5 7c687fb13ef45b8292efe8fcd480c4d5
SHA1 29abcb6621230109a29a8cf4c0c94fb7ee03583a
SHA512 b62f095290d857c720cb2d7c7f1dca9249048caf1c6e71b7faee560ef02393a9701fae540a647b4c1a7b22affc02ddde1a19759364f33cde1371051f7da16333
TLSH
T1BC3116BF36CB0ECE76141380671264DDF4D717F416A6E88269E2D09FAB1D3B32539260
MD5 SHA1 SHA512 TLSH

Submit Download

RegPackage.x86.exe

Path C:\Program Files\BandiView\shell\RegPackage.x86.exe
Size 261KB
SHA256 f48b5e9fafcfe95de1959af56eb630f9d0527e440f08a9f8c39c2ce46dc837d7
MD5 25387fce6d45e3190dd54400b3a67bc3
SHA1 69c615f377d958f7eaaac0634184f1fa6136cc81
SHA512 bcca7ec8c21fa12e5b4f4284f0ec9af4a3dbe0d188936019619fd0872cb9984f89efa3ce454bb8457eb842c5a08159a8a0aabd7d256eb7c2a9e273235c7ffa33
SSDEEP 6144:nx94Bx85kcXFNK4NPDgb8pTQzRpFtmpLmB:nx9U8/obCGruI
TLSH
T1F3445B11B5808071E72A1B3115D4EAF0593DBE784AD4E98FE3B87E7A4E302839A3755F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvshell.x64.dll

Path C:\Program Files\BandiView\shell\bvshell.x64.dll
Size 4.0MB
SHA256 89e4e3a63831539854ee09edfeb94ba85b9f851be2f764608f19d786d3e7d702
MD5 532ed53782e5621b6ae92db7a54eadd9
SHA1 90df7a971be826c055156410af75f9656597b1fb
SHA512 003f5f1672ea578d671d08d6e3d014b293da2962b1ed38df20acd62f7fbd1b65b8cdd4997236ff01cdc614e5bea603945ed679ab42844009e9b61ca0adacccb9
SSDEEP 49152:NXl7n/WvrG9H2CygAYqIQXllkhWckcBF/4nm1F8IF8AmjEg4WQndIs676ZOcGfTx:NpujoAYzkEYQnNUcYTxT
TLSH
T14F166C03A6A004A9C3B68039DD6BD516E771740D13F18AFB729096E53F23BE03A7B795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 342ae9ddc12b3730fe7046241df7afa04f204ec8ae73d41b3467090d57eca5b6
MD5 21715d6bf63ed432d8f4d1eb4bf67018
SHA1 cee359414c27ce8e1ddc353823d958a30e08534e
SHA512 2425e68008056e9c2a7f308166e1f19d1f35d7a36ec47aecb71768a0daac2cec254cceb6867ea0a74b8257df98dc71d228ddd4011498442467fd721bc02389a6
TLSH
T113710AF9065220A3EB2C4970E5E38A293637C2541DA72E4ACEBC867D75C7F81FF15186
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6ea45bc63c6112954a99d2ff32047bac9cf0f3b83da183b58580ea1c045f2da7
MD5 8651954adb3f6f1c877cbe79c377f640
SHA1 cc956f25384123ca6b54bdd3939622c605da7ea7
SHA512 36b3185ff04de1631d4122417db421c57f6a7068e537b37d44eade8e9808aaa0e0a651621cd233c8d5cd41cd0617d90fdb28330e9161b6b4125df60ae1e4e706
SSDEEP 192:DoLJasfvuJ/e7agqqIqjUSeqVhu9gQOqtbdQRGt:DoLJasfvW/e7agqqIqjUSeqVhu9gQJt/
TLSH
T1E0D17CF383E5DA2FDA4159F0AB65AE1BCE1D052943183C1A8DD9DF4BA3E3471E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3884e55123c299c296cd91932fe027086990cc21d69a5bf9c0dcbee80f5889a9
MD5 54ce7857d86d7fb41fc3a82751cb497a
SHA1 084020af93cee9a69552a41e2916203c306e0686
SHA512 91320400b48c81910fc1531e61a820190f6d29a4104435006b146a863da49aed66f779e113a802cdace2e9b1aa3a4a204b676661c93f083d0af154c44ec06180
SSDEEP 192:sxZcR2yM/jK1Ml8Mim/fAs8V+RtWqIdpUIHW6+WNO5W/BWtrfVI0++HsiCIg4J:sxZcgqm/fAsg+R21HbJ/YVMc
TLSH
T1E652E85AAB3459778DDFD21AF555BB13D7F9143292940D489AFCCB0C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ee4c9637c577cc04202d6bb5d3f62a6c863cfbd7580558b1662ef8eb8a2d19bb
MD5 a15fc3216c598aaecbe7e52725b11e1c
SHA1 4b478fa11156fd95c4d83e820761cc37824870f5
SHA512 84207367d71260b63d7453fa16d5c3a8ce9b86a9ec6686ede2cda9e737037ddd23301234160bd5823d7b61dc12d6efd61944caa257cbf548512a9c5a0567f0eb
SSDEEP 192:sxZcR2yM/jK1Ml8UQ8im/fAsPV+KtWqIdp+IHW6+WNO5W/BWtrfVI0++HjiCIg5J:sxZcgqxm/fAsN+K2vHbJ/YVfn
TLSH
T10E62E95BAA3459778DDBD21EF551BB53D7F8143292940E486AFCCB0C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 58b26084b614398cacf73e1a324fa9f5816aacc4bce031c6a14556eafc6fc728
MD5 8b240ed1a14a3d91b1a322f4f2b752ed
SHA1 80e1efcc90566e4670d3faefb9691336e6ff2679
SHA512 66950905f63c59ba74515e54e8ac8ef0cd7b7536225ce98be760c8a823d600faa5862676d6f7bdd2adfa0b48dfd3044403502576c9af2f210ef21f4aa4904e8c
SSDEEP 768:LiUZYiA7pLuLXgMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5z7eLlPZ4REroL:LiUZYiMEXgMWvg09ou1jaYz7eLZmRPJV
TLSH
T148F2FA3B7C0CCB7E4F844E9DED2A7E8A6DE801CB5A98895447EA844C03C66EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b75315792a7df42ca3d3153315d2107e2a4b1231b7fe8f648ae8d14dc52eb1ec
MD5 66e4fed4da0d96afd6e392e809428ba5
SHA1 42434b9d3d395e81a18ecf9d7342ff44422db745
SHA512 7e225c6da3938f36c2da8d74ec836a077cbe59b0c01255fb85be0c9242874d29301686bfc9286781b14be2cbfa761af57d47aa76c2022a4c1619f6437e124747
SSDEEP 96:KA1eK2A84YKR+Ou7KKsk/LqK4gyufOKYAQ:EWX5JB9p
TLSH
T163D1275B70BA02423C7D2A5C8294975A8EC271533028B42B7FAD01B25E67E31DEFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c407c3e4-c5df-43e6-a3e0-31ea8104bfb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c407c3e4-c5df-43e6-a3e0-31ea8104bfb1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bb8a7c42e0fe5a57e1c4baedc48103be4c3bafec4e51d063dc52031d3d432286
MD5 d5ddd43dca458a1e1825224be0ef43b6
SHA1 1883b81b5bb31c4363a4f31b5eb16a3c7cde0bcf
SHA512 37d8b531eb029887d4d1a2d7118bdec8bb3c5d2afb3636c7712e31e941a41c01de3863efa58f23feb48bd625bd575b919ad609847cf613c4e8772c9f8e28dc8e
SSDEEP 384:yutNnNnb9+sNoE0dVKzX5od+l8yBX0d+2QD+SoVKz6Zl1zr9wadV1Y:jjZbENeO+clQD+SoVXzjV1Y
TLSH
T1C2927B3629386C275A93B549F58B36936FB811B799C42F94E7EC5B0E00D725C270F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b948ab65745e4cec3940f6a723f5a2c245057ee7942248077c3bf6dafbbbba4
MD5 617cbba1a93257b502ff03873afb4671
SHA1 4a4e5504f10fd89509ce3bcf89d919baf1a231b6
SHA512 bcee9184c1277cf78659cf34b275234a8f11c390cabaeac5d00623459fe6e7bc9cae3657cfcfa02cc30932b17e19638378ccd872eafec11ec0273e14b25aa155
SSDEEP 192:yON261VWQmiUyoJgGX5Obd+j9jzoryMmM/avW3Q0U6:yON26WvgGX5od+l8yZR0U6
TLSH
T17B02C73569687C6B8EE3BE4AB48737135FA8117BEA942B84C6E81B1C00D765C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 69acc0cc8985420e2af362212a54fe8b8e78dc860fd03af62f247545ace8eea6
MD5 671a1495ade00ea26a47b0570783f8cf
SHA1 7715f8a4321e788855c68901161a1ccab4dc036e
SHA512 f7ebee219eb1b45f0da7b5d589cec31ebb74b47342b537ee7798f7d6e641c1f02f7f5783c3bf251bfb67e411287aa6afa67c4deaa097fa85ee0dfb39043e0510
SSDEEP 384:yDiF1tNnNnb9KzsNY8TUNTUlIlx0dOK2Dfw6X5od+l8yBX0d+2kD+SoVKz6Zl1z+:jF1jZboVwgvuiO+clkD+SoVXzjV1Y
TLSH
T1ACD2B4F598D79936D99E5787A73E2E425EBCC163B8885980F7D81E0CCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bfbea22938066589343ff0a48ed04582307e7348e0472992a5cc7d80ea3fd16b
MD5 ca02776167b83be35aa8d52eb76d96dd
SHA1 2150fb92b5351c775b2f31372b8bb28ceaea855e
SHA512 027e8e1ab226ad36b75cb2abe990ff6cd4aa8cfb274c79073089d7ae19fc2009ecacdf1219d0d173197d732cc0a03d0d8a82f173847da04fd1348111835ed8b9
SSDEEP 384:yvtNnNnb9+sNox0dVKzX5od+l8yBX0d+2QD+SoVKz6Zl1zr9wadV1Y:ajZbECeO+clQD+SoVXzjV1Y
TLSH
T19F927C3629386C275AD3B549F58B36936FB811B799C42F94E7EC5B0E00D725C270F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5f9e5d400bd330ffbc3b7f82234924b9c2287887d32475f306cd68cf74266662
MD5 9b4e54ba6c034bc5b6b3ab2d17a2185f
SHA1 cd63611c55ecad8eb6981850669aeca9c269877b
SHA512 234fb7c8178ead7c17c705d9c9fc8cf2bcd0c94cd6b51e44c26149f90bea0945e93cee5bd210faf420dfdfd0c837cc0195ce1de595ca7fe6428a8cdb52d23a93
SSDEEP 192:yONJ61yWQmiUydJWGX5Obd+j9jzoryMmLXQFd+21jJvAqcGU6:yONJ6XQWGX5od+l8yBX0d+2HDU6
TLSH
T13812F835A46DAC275EE2B549B48B33535FA82077DE856F80D2E81B1C00D769C2B5FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c0bae2296283a9eead8daf404f7fda7ada0764225d54528ac8d362fb7bd07bf9
MD5 13e8b163a526c50f7304da7426cd2f57
SHA1 ee4f0cb5b85ccba42181f80b39a27e733e4ac103
SHA512 7a90db1e8d661a1544445c79c49d08f08e2aab89eadeb394ba25455c7b0c61277035732647604f484d3aef46ba99852d6b40c89f2e22616b49ebbafee2281c39
TLSH
T13F41F858BAEE1158B3B72E569BF6B86E487FB9362E0AD15D00010E0F0676F41C9A1733
MD5 SHA1 SHA512 TLSH

Submit Download

68aa8674-1ff5-47fc-9983-3cf5185db21c.tmp

Path C:\Users\Admin\AppData\Local\Temp\68aa8674-1ff5-47fc-9983-3cf5185db21c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BANDIVIEW-SETUP-X64.EXE

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BANDIVIEW-SETUP-X64.EXE
Size 9.9MB
SHA256 2d3c6e7c002be38c442868353268b641069b0674dbd1fb5e584ce2c507afbba9
MD5 15c7d18fe178d4b4ec941067f6361f75
SHA1 faaa268fce985243916f8c1e55c733835285f40c
SHA512 1a9895739551e0936d4c960e17d676e731d12fbcc5409d2972606579620927a0abfa00852fa128be776dd8b699ad0d4f302b30a4d2dcfba765a93b8f14e80e70
SSDEEP 196608:0tVIe9e20xv0OSxMsChLJ+c1Z2es7RKfcsTbOS7farvZ9QbTwbvgYdBiPX:peQ2090BMjwc1Z2NVsTbirhoTwbvjdYv
TLSH
T12DA63372BAF0E039E17365B02A2AC2F6C0B2F9765525944B57E06F096F34553CB2E332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CyberMania.url

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.url
Size 203B
SHA256 fe596ee03bd1a6ddc5c1e6cfe0504e2292f9dd0cd35f62487a3484d8a6bee094
MD5 47c76b79310a4beec20ebbcc4e98b69e
SHA1 7f802250547d367e771189f9eb0ea3fd9d091872
SHA512 c0a7027f73bb0e33e69886add900b31c1c11cd5e6f1c849252b2c60f199b29481fe40112e09fea27b19b2c357cb2c898d9ecbba559459454f5912c0b808b4c37
TLSH
T1EFD0C9A7DB09C25283169849E270DF0CF80724A8C88AC7CDD3904A8D4EC5091D4CA1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Replace.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
Size 2.8MB
SHA256 003ba054b0a46b264d3719bc47614005a26fdad3c8fe89b7c6eb1da9b00b44e6
MD5 81f684c4a21f7407ae3e1392309f8f7a
SHA1 5b4c0fefab1c632f5587bb474b91bf291bc289e8
SHA512 9eb03d4037add92b97da5e755ee51d2a6474cc782476501aabfa3ded9a56f0df97abc66a950653bad97be920eaa432931e947935cbf8cd969981918e5e18b55b
SSDEEP 49152:OZB1G8YlDC9gXBuGoOAYX+nrvJo1MDu9PuICAz3HRA/l6oSCRmSJ85cktfT5sXs:s3GfqgdoOAamLJo1/dCATQkoWYktEs
TLSH
T174D5220AE69908F8E4B7A478CC578546F77A3C1E03A0578F1395726B2F373A19D36712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d039ce7b-7a57-4b3b-a032-dbb1108fb616.tmp

Path C:\Users\Admin\AppData\Local\Temp\d039ce7b-7a57-4b3b-a032-dbb1108fb616.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f11b1fe9-fe01-464a-8967-e74a2e6afe8a.tmp

Path C:\Users\Admin\AppData\Local\Temp\f11b1fe9-fe01-464a-8967-e74a2e6afe8a.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1720_629390776\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BandiView Image viewer.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\BandiView Image viewer.lnk
Size 1KB
SHA256 598409cecffa15df4e270b4105f8a7b1f9d7227206a9a26d1edbd0862fa774a1
MD5 2523b003d65f3cf2c7078f704d9f414c
SHA1 4a7a08b4a3e407f4164eef1ddbca36437ccd868e
SHA512 0804006f38beeedd6e57042e28a2c6b5f2787477162fbe4fa075018aae1b6a382ad5f55ed83f5d4f54602e61273d34e7123a244012ce4e97b536877f801b3d83
TLSH
T109119C3907863B1BE3EB82364AA606328672FC02E7A41BAA44C842C00D9824562D8F79
MD5 SHA1 SHA512 TLSH

Submit Download

BandiView.lnk

Path C:\Users\Public\Desktop\BandiView.lnk
Size 1KB
SHA256 3b54d9ee9cf2c91f27827047ad53a7e552c07afaef48d89b42fc23fe600b8740
MD5 e2b3c0120ff09db906840a2daffe5486
SHA1 f54d632ee5ae2e2061b81860048909e94c0969f1
SHA512 295d06c67098ffdf5ef87a6040643ac322671cfc5592888583193789d45b699cb634bafdd2c88abf88d46a89c7fd7895a9525716a926e1c50d7d4f5d6dad3d68
TLSH
T1C831D0321BC62619F3F792734BFA6A3442B2FC0397A103AF44CC43805EA4244A1EDB76
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1700-223-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/1700-16-0x0000000000640000-0x0000000000641000-memory.dmp

Download