caa6aa5632df1be94dada89120172716bfae182ca971e3ba9b5034029ebb300c

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Size 12.6MB
Sample260602-n7pywsdw5j
SHA256 caa6aa5632df1be94dada89120172716bfae182ca971e3ba9b5034029ebb300c
MD5 55653ddae6c992d4935099bdd5ff3a0d
SHA1 5d9038846a22e42a8bc11ed74536bb8b2a10b4bc
SHA512 e70abc25dcf5b1f9e5608921e5b14fcb77b8e503cab9d1ab7b9594f0b82b518eaf38402c86dd9bed7bc789fb3c93aa56475b84ed8cf38ad7bd6459fbb8d8183e
SSDEEP 196608:63G05aJvzdxoAk7KrxgtFCQYhztrDi1G4kdavVoWiZXiE6QQrnx8lR9b29f6O9KL:041XY70yCBjdaK+EGrnxw2N9Kpdz
TLSH
T1DBD63375F2A800FCF093917CC9A3CD22D6673C4D02A176CB23667B4A3E7B55A5D2A271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
2456	BANDIVIEW-SETUP-X64.exe
2088	BandiView.exe
3264	RegPackage.x86.exe
4612	RegDll.x64.exe
1016	RegDll.x64.exe
2976	RegPackage.x86.exe
4720	RegDll.x64.exe
4924	Replace.exe

Loads dropped DLL 1 IoCs

pid	Process
4720	RegDll.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\BandiView\data\cmyk.icc	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\shell\BandiView.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\BandiView.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\jpg.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Belarusian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\English.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\cbr.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Arabic.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Croatian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Finnish.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Italian.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Romanian.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Serbian.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Spanish.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\clip.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\cr2.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Catalan.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Latvian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\shell\bvshell.x64.dll	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\dll\libexif.x64.dll	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\png.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Catalan.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Hungarian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Portuguese.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Serbian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\data\OpenSourceLicense.txt	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\data\lm.x64.dll	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\bmp.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\version.ini	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\TradChinese.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\data\lm.x64.dll	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\shell\RegPackage.x86.exe	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\shell\RegPackage.x86.exe	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\shell\BandiView.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\heif.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Bulgarian.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\data\paperturn.wav	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\dng.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\nef.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\psb.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Dutch.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\German.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Russian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\BandiView.exe	Replace.exe
File opened for modification	C:\Program Files\BandiView\icons\orf.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Greek.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Portuguese.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\plugins\@files.txt	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\dll\ark.x64.dll	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\dds.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\tif.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\webp.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\French.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\langs\Slovak.lang	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\data\WebView2.x64.dll	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\data\meta.html	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\bmp.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\nrw.ico	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\icons\psd.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\langs\Slovenian.lang	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\data\paperturn.wav	BANDIVIEW-SETUP-X64.exe
File opened for modification	C:\Program Files\BandiView\skia.x64.dll	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\icons\psd.ico	BANDIVIEW-SETUP-X64.exe
File created	C:\Program Files\BandiView\config.ini	BANDIVIEW-SETUP-X64.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1288399942\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_79716675\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1288399942\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_79716675\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1035680676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1035680676\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1035680676\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1567082176\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BANDIVIEW-SETUP-X64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegPackage.x86.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\BandiView.exe = "11000"	RegDll.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\BandiView.exe = "11000"	RegDll.x64.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248753691834903"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.crw\ = "BandiView.crw"	BandiView.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.orf	BandiView.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.jpeg	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.tiff\Shell	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.pcx	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.pbm\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.pnm\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.pnm	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.heif	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.raf\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{0002DEAD-9BF7-4CFA-8A5C-DE8679340003}	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\ = "BandiView.jpe"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bmp\BandiView_bak = "Paint.Picture"	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.gif\BandiView_bak = "giffile"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.gif\Shell\Open	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.tif\DefaultIcon	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BandiView.j2c	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.wdp	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpf	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.hdp\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\BandiView.ico"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.qoi\DefaultIcon	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.sr2\ = "BandiView.sr2"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.cbr\DefaultIcon	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.cbt\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.tif\ = "Image (tif) File"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpx\Shell\Open	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.wdp\BandiView_bak = "wdpfile"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bpg	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.rw2\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.srw\Shell	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jp2	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.j2k\PerceivedType = "image"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdp\BandiView_bak = "wdpfile"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.apng\ = "Image (apng) File"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.erf\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\BandiView.ico"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\BandiView.exe	BANDIVIEW-SETUP-X64.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.webp\shellex	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.pgm\Shell\Open	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.x3f\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.cbt\Shell\Open	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.3fr\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\BandiView.ico"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.raf\ = "BandiView.raf"	BandiView.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pbm	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exr\ = "BandiView.exr"	BandiView.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.arw	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppm	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jxr\BandiView_bak = "wdpfile"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.heif\DefaultIcon	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jxl\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.nrw\Shell\Open\Command	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.ico\BandiView_bak = "icofile"	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.bmp\ = "BandiView.bmp"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.dng\Shell\Open\Command\ = "\"C:\\Program Files\\BandiView\\BandiView.exe\" \"%1\""	BandiView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.3fr\ = "BandiView.3fr"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.tga\Shell\Open\Command\ = "\"C:\\Program Files\\BandiView\\BandiView.exe\" \"%1\""	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jp2\PerceivedType = "image"	BandiView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpx\DefaultIcon	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jxr\Shell\Open\FriendlyAppName = "BandiView"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.heif\ = "BandiView.heif"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.avifs\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\BandiView.ico"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.dng\ = "RAW Image (dng) File"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.mos\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\BandiView.ico"	BandiView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BandiView.jpg\DefaultIcon\ = "C:\\Program Files\\BandiView\\icons\\jpg.ico"	BandiView.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2456	BANDIVIEW-SETUP-X64.exe
2456	BANDIVIEW-SETUP-X64.exe
720	msedge.exe
720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1016	RegDll.x64.exe
800	msedge.exe
800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2456	4736	2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	80
PID 2456 wrote to memory of 2088	2456	BANDIVIEW-SETUP-X64.exe	81
PID 2088 wrote to memory of 3264	2088	BandiView.exe	82
PID 2456 wrote to memory of 4612	2456	BANDIVIEW-SETUP-X64.exe	84
PID 2456 wrote to memory of 2976	2456	BANDIVIEW-SETUP-X64.exe	86
PID 2456 wrote to memory of 4720	2456	BANDIVIEW-SETUP-X64.exe	87
PID 4736 wrote to memory of 4924	4736	2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	88
PID 4736 wrote to memory of 800	4736	2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	89
PID 800 wrote to memory of 4508	800	msedge.exe	90
PID 800 wrote to memory of 1284	800	msedge.exe	92
PID 800 wrote to memory of 4276	800	msedge.exe	91
PID 800 wrote to memory of 1284	800	msedge.exe	92
PID 800 wrote to memory of 1284	800	msedge.exe	92
PID 800 wrote to memory of 4068	800	msedge.exe	93
PID 800 wrote to memory of 4068	800	msedge.exe	93
PID 800 wrote to memory of 3768	800	msedge.exe	108
PID 800 wrote to memory of 3768	800	msedge.exe	108
PID 800 wrote to memory of 3768	800	msedge.exe	108
PID 800 wrote to memory of 4496	800	msedge.exe	96
PID 800 wrote to memory of 4496	800	msedge.exe	96
PID 800 wrote to memory of 4496	800	msedge.exe	96
PID 800 wrote to memory of 1240	800	msedge.exe	97
PID 800 wrote to memory of 1240	800	msedge.exe	97
PID 800 wrote to memory of 1240	800	msedge.exe	97
PID 800 wrote to memory of 2028	800	msedge.exe	98
PID 800 wrote to memory of 2028	800	msedge.exe	98
PID 800 wrote to memory of 2028	800	msedge.exe	98
PID 800 wrote to memory of 2036	800	msedge.exe	99
PID 800 wrote to memory of 1528	800	msedge.exe	100
PID 800 wrote to memory of 2036	800	msedge.exe	99
PID 800 wrote to memory of 2036	800	msedge.exe	99
PID 800 wrote to memory of 1528	800	msedge.exe	100
PID 800 wrote to memory of 1528	800	msedge.exe	100
PID 800 wrote to memory of 564	800	msedge.exe	102
PID 800 wrote to memory of 564	800	msedge.exe	102
PID 800 wrote to memory of 2052	800	msedge.exe	103
PID 800 wrote to memory of 2052	800	msedge.exe	103
PID 800 wrote to memory of 5092	800	msedge.exe	104
PID 800 wrote to memory of 5092	800	msedge.exe	104
PID 800 wrote to memory of 5092	800	msedge.exe	104
PID 800 wrote to memory of 1980	800	msedge.exe	105
PID 800 wrote to memory of 1980	800	msedge.exe	105
PID 800 wrote to memory of 1980	800	msedge.exe	105
PID 800 wrote to memory of 3280	800	msedge.exe	106
PID 800 wrote to memory of 3280	800	msedge.exe	106
PID 800 wrote to memory of 4192	800	msedge.exe	107
PID 800 wrote to memory of 4192	800	msedge.exe	107
PID 800 wrote to memory of 3768	800	msedge.exe	108
PID 800 wrote to memory of 4836	800	msedge.exe	110
PID 3768 wrote to memory of 1884	3768	msedge.exe	111
PID 800 wrote to memory of 4360	800	msedge.exe	112
PID 800 wrote to memory of 4360	800	msedge.exe	112
PID 800 wrote to memory of 232	800	msedge.exe	113
PID 800 wrote to memory of 232	800	msedge.exe	113
PID 800 wrote to memory of 3204	800	msedge.exe	114
PID 800 wrote to memory of 3204	800	msedge.exe	114
PID 800 wrote to memory of 1308	800	msedge.exe	115
PID 800 wrote to memory of 1308	800	msedge.exe	115
PID 800 wrote to memory of 4880	800	msedge.exe	116
PID 800 wrote to memory of 4880	800	msedge.exe	116
PID 800 wrote to memory of 2276	800	msedge.exe	117
PID 800 wrote to memory of 5104	800	msedge.exe	118
PID 800 wrote to memory of 1748	800	msedge.exe	119
PID 800 wrote to memory of 4244	800	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_55653ddae6c992d4935099bdd5ff3a0d_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BANDIVIEW-SETUP-X64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BANDIVIEW-SETUP-X64.exe" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Program Files\BandiView\BandiView.exe
    "C:\Program Files\BandiView\BandiView.exe" /regmandatoryadmin
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Program Files\BandiView\shell\RegPackage.x86.exe
      "C:\Program Files\BandiView\shell\RegPackage.x86.exe" /reg "C:\Program Files\BandiView\shell\bvshell.x64.msix"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3264
- - C:\Program Files\BandiView\data\RegDll.x64.exe
    "C:\Program Files\BandiView\data/RegDll.x64.exe" /regieemulation BandiView.exe
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    PID:4612
- - C:\Program Files\BandiView\shell\RegPackage.x86.exe
    "C:\Program Files\BandiView\shell/RegPackage.x86.exe" /reg "C:\Program Files\BandiView\shell/bvshell.x64.msix"
    3⤵
    - Executes dropped EXE
    PID:2976
- - C:\Program Files\BandiView\data\RegDll.x64.exe
    "C:\Program Files\BandiView\data/RegDll.x64.exe" /s /calldll "C:\Program Files\BandiView\shell/bvshell.x64.dll" DllUnregisterServer
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4720
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cybermania.ws/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ff95570c188,0x7ff95570c194,0x7ff95570c1a0
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,10437937728292130080,15818878965952765053,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10477668992023179309,4345529740971223974,262144 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,6370602357928586995,8245996855765488083,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3579285103186149503,17885378455394597353,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,13909599413720983713,6346928732785763810,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16550233922167894454,13630148508817571119,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,16722818092983103672,16397755697073620072,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4376,i,3892639020676024398,17909966077166593110,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4448,i,11888717761643092803,1781896362224501264,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,473705250846058367,8785462618775634161,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,4989991283376732452,1936570264877882436,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4396,i,13523107959900856875,264689438380261835,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5424,i,13261291019823930524,5441369926119809509,2097152 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,17860804825595707061,17019996578957006885,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,15098557222604250700,17178290239727167314,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,10032789037640890934,16302627358395713042,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,12842339242720038964,11268147295863737518,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,12842339242720038964,11268147295863737518,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,14957941108816934126,17584364210682564081,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,14154424216440599969,10380101117750528470,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,11201639767101430674,9539946006815588052,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,3410589446798737359,5865413613232761562,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,17864844990636853798,2071017386026788015,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,4090667459777855785,17145521712049560396,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,15269113344080382490,9056512128750327812,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,7811240890786417376,8417049591683867530,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,16291996512748892816,2002800114740648190,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,7906617435133379844,4787109336369812191,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,2299402573022958893,182125527624618473,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,8943693022274822025,17851553722838065516,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4828,i,9574357708511830641,14336246294876446609,262144 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,2152671945696263711,12995421207864584213,524288 --field-trial-handle=2176,i,2080360612761925114,1531775953942199329,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:4304

C:\Program Files\BandiView\data\RegDll.x64.exe
"C:\Program Files\BandiView\data\RegDll.x64.exe" /pin "C:\Program Files\BandiView\BandiView.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BandiView.exe

Path C:\Program Files\BandiView\BandiView.exe
Size 6.7MB
SHA256 54de9d718833dc64bd71c1298d71c781a3ed5528cc568de94d3064d2d61a2741
MD5 6d1c0563df0b5ac95a12377f3e174073
SHA1 32caeb1a192734f979dbd88d0e0dce7e1f4bd796
SHA512 0e19a53ffd553d3222ee833ca41b827614d30f958e455a69eed764af470e36a50b3f9db1a27e7248653a250bee670c079a4515a5f094ed8dfea15a7b49552621
SSDEEP 98304:3lpkC1Ew2dz44S0T2SGtDEchL9s3HLH0Z:VpV1Ew2dz44S0T2BLL9s3HoZ
TLSH
T1AF667C42B1A801D8D1B7C078CE6AC917EB71344D13F186FB729096E52F27EE13A7A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Program Files\BandiView\config.ini
Size 80B
SHA256 96323ce5c2e5a44b16988778704b2244290dedea41dc32d8dbf067f03f28040d
MD5 63659cc6d1eccfb14fdaf8ff4672af82
SHA1 d8ac28ce6d20ebbf7b0248e0416baa01e162baa3
SHA512 008a9c03a3a3963b92370fa40f89837890bfd6a77a7f038676829e3100f9123f967dd72cb4cf42fe3a8cbe2b78232af1a019da6941a2a254e4082743d4185347
TLSH
T1ECA0120E036D59278418575ED810D39C3B9002C2101801120B22410100120820484457
MD5 SHA1 SHA512 TLSH

Submit Download

RegDll.x64.exe

Path C:\Program Files\BandiView\data\RegDll.x64.exe
Size 201KB
SHA256 f81f269e9b259b827ac9046c396dafbf8b13de454762fdb32a2147cda2174df3
MD5 b75caeba48754ea05dd3265e80917744
SHA1 7e90b2fe323e32b8ea3307e0356fe6648dc3cc35
SHA512 04b4816fc1992e626f978600766e77a8a0e9b7e5a80bb3aeae5d3aa198fb8b504205bb7c5075f503a53cf5420ae9e668d4db2b6b2f131deac5f55db6cc066e5a
SSDEEP 6144:TdQ5QphYNwhMdmJLxJ3Vx88YLzSpzSKpkN:R+Qp04JLx5Vx91M
TLSH
T14C141802326420E4F36A87358951E5859772BC7806E0EB8FD2787E765E332935E3B61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.data

Path C:\Program Files\BandiView\data\resource.data
Size 24KB
SHA256 81c3ebe48f2c070b53b888727354c978448afa1989f16ad09b20167b24fc64b1
MD5 5270333f8333ccbcd84186b043366cd7
SHA1 c91b0c663e71901903415f708bad804431f9cd9c
SHA512 88b92efa1965728de4ace453b168d9ced5893d4742efa4079e4f9387886ee95c41b36ea05a0d28d3361f8d37ca3b1ee7e29ce40202fca4e38df4d441d1ce49d0
SSDEEP 768:Qzk5Nur9Jhx5zaMMFAXpcclB4vCB9BB5w:QXgOXpr8vCrBA
TLSH
T162B2325C5CDB5996B838F18A966E8322159ACC33283698EC726C1DCC4F291580FF74FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.lang

Path C:\Program Files\BandiView\langs\English.lang
Size 58KB
SHA256 6b26a477e089a46e5ef4dcf403b98e7c34fb278e527baf4089bdfb9f43954bcc
MD5 81e1c6240c2970483142b653f6224946
SHA1 4437591178b989e24e1dfff1ab8cd3443b978fb6
SHA512 2ec8a563c357c2fbd91ef0a44fae98ba57700a7867c53a940ff748d5815cd7979a0460fe179f1e9a7da921d453d095aa7848e4f973f6e1afa866e39db25e7fa3
SSDEEP 768:H5/MMLUgfpM9nqTEwpORk6IMtjTWnPpe6Xc5DNwpr31gK8QNUu/HU:Z/vULnqTEwpOCRZpHXc5xugyU
TLSH
T16143E85F69022937A8537186BE8B97F26873D40E0E2D4B28B4AC58C4D37C56C077B7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@files.txt

Path C:\Program Files\BandiView\plugins\@files.txt
Size 1KB
SHA256 bcdf9c5a40abac7a10020e181518a968c20a7ea829c416706ec0a2519f63fd7e
MD5 7c687fb13ef45b8292efe8fcd480c4d5
SHA1 29abcb6621230109a29a8cf4c0c94fb7ee03583a
SHA512 b62f095290d857c720cb2d7c7f1dca9249048caf1c6e71b7faee560ef02393a9701fae540a647b4c1a7b22affc02ddde1a19759364f33cde1371051f7da16333
TLSH
T1BC3116BF36CB0ECE76141380671264DDF4D717F416A6E88269E2D09FAB1D3B32539260
MD5 SHA1 SHA512 TLSH

Submit Download

RegPackage.x86.exe

Path C:\Program Files\BandiView\shell\RegPackage.x86.exe
Size 261KB
SHA256 f48b5e9fafcfe95de1959af56eb630f9d0527e440f08a9f8c39c2ce46dc837d7
MD5 25387fce6d45e3190dd54400b3a67bc3
SHA1 69c615f377d958f7eaaac0634184f1fa6136cc81
SHA512 bcca7ec8c21fa12e5b4f4284f0ec9af4a3dbe0d188936019619fd0872cb9984f89efa3ce454bb8457eb842c5a08159a8a0aabd7d256eb7c2a9e273235c7ffa33
SSDEEP 6144:nx94Bx85kcXFNK4NPDgb8pTQzRpFtmpLmB:nx9U8/obCGruI
TLSH
T1F3445B11B5808071E72A1B3115D4EAF0593DBE784AD4E98FE3B87E7A4E302839A3755F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvshell.x64.dll

Path C:\Program Files\BandiView\shell\bvshell.x64.dll
Size 4.0MB
SHA256 89e4e3a63831539854ee09edfeb94ba85b9f851be2f764608f19d786d3e7d702
MD5 532ed53782e5621b6ae92db7a54eadd9
SHA1 90df7a971be826c055156410af75f9656597b1fb
SHA512 003f5f1672ea578d671d08d6e3d014b293da2962b1ed38df20acd62f7fbd1b65b8cdd4997236ff01cdc614e5bea603945ed679ab42844009e9b61ca0adacccb9
SSDEEP 49152:NXl7n/WvrG9H2CygAYqIQXllkhWckcBF/4nm1F8IF8AmjEg4WQndIs676ZOcGfTx:NpujoAYzkEYQnNUcYTxT
TLSH
T14F166C03A6A004A9C3B68039DD6BD516E771740D13F18AFB729096E53F23BE03A7B795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee93a6f7d4cf311fd0e1f40c0afccee1cee462a0ad5d189e6fd12793542e567
MD5 042b5a81b8f9e5f2e5e1b1ef0b9c97b8
SHA1 8164701b94e0509e7ce25bbd729d9a2a541bc216
SHA512 44a62942afbd847ef5fefcdb060d3b4faa54b5f6b612a09366f3622f4beebbd50e527a67ef727bae51d47d0f4a8145e79b81cac52fb6d9ae39e362c50f423a09
TLSH
T14FD02B7111090041C80D0032107386054303FF010A05B8433C6134251D10C49834E094
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1b87229f99cc53c652c227dd7b0e674fd1a7f3d2071ecbd7e96d14caf01789e
MD5 12fe7e86ea55bcbc14173d158228b533
SHA1 4d08fab080251fc755b72705a654e4971294953c
SHA512 5f7f520a3c5a907c7487d7831cea4efeb50450367f23409af02c5269a3fd34cd57d86191174e7c2c1b103980b98f431afe701795717921d9887b0f9bcbc45b3e
TLSH
T199D02B7111090041C40D0032107386054303FF010A0578433C6134252D10C09834E094
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 98f26b1025a400bd9c07d48a09861331ad56da8ccfd49da5aace6b2d8a8fb04f
MD5 a6f81cc80bc66834bb024f295bc1c614
SHA1 3572e8e0d07165f8f7fda71d1e8e70833a791028
SHA512 8e7a4ab07f5085ffd516531514bdf68ed5da14b90062295b908d2ece60da72dff0e7a1c72db1df0ca3cfa3fb611bc1525e297c16de53e71abe9545aa66e1b123
TLSH
T10471D5D410C284E3EB9711BD5AE28F2436B648D91D63BFBE03541CBB2803BB9C43A521
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cb88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cb88.TMP
Size 3KB
SHA256 0ded51ff85dd9a2ec35784a24ce0aa8e48ea1dfdf3644172a545408ad95a59f4
MD5 d2ec7d814da9cb1d11df1ed3c7b6767d
SHA1 81d85d26e9c41ef5c66897df7efe8f0c9f9e3a26
SHA512 1774b02de82bb42b4aa42c8de199b3373c2e8a70392d930f54af7cc257c93bf9445fb1c0f102ba58035bc1b1e421dff81a171979a7405a68896a262507d91fc6
TLSH
T12761B7E411C288B3E397513D69E28F1036B645D90E637EBD16981DFB2C12F79D83A510
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ebaca52889467aaeb993b525919c95dae4fd7a902b18f77281b1921ce59942e1
MD5 6ca5aa50e5ad4bcb64952f2feb18f13e
SHA1 57c763a00bf7138471e52dadf5a49b0113f23aa9
SHA512 914634cde6e7616a7bc1d7b77c25c2397f43af2b84bdf544cb0b7fe3c74601dd6612745ad4998d25c3a48597d35bccf5f48399ab8b689c81cb0441a3961c3d4d
SSDEEP 192:DnPzzTehLCu1zqqjGqIPGqVbCtOWMKa7dkj6vzGt:DnPzzTehLCu1zqqjGqIPGqVbCtJMKa7I
TLSH
T136D17DB3C3E5CA2EDA5155F0AB65AE2BCE1D0529435C3C1689E9DF0BE3E3471E100A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 77ecee1587a1ea44886ad134b91f455ec823bc03a78e96486cea1c8ca71c1f76
MD5 8d24813776ec73be34d80170d99abb6d
SHA1 2f062be3ae522b6011aa9736741a35faf2361982
SHA512 d439d02e87ada196ed7ad3a961206f0333c1272db3da677f99b2a8fd84453e001dfa01aed267ff1731f9fa531fd04e5bd675dc6521dd0fbe6159bad05a04e0ec
SSDEEP 192:sxZARZyM/jK1Ml8Mc5/fxs8/8Qt/hKRRIdp3c/W6+WNON5/BHtSjVI+qK01Bw5mc:sxZAX05/fxsE8Q3KAM/bu/yV8Xzc
TLSH
T17662F91AAA345977CDDBD219F555BB57D6F90432D3940E48EAFCCA0C01E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bf53e5e9cdf472061bc737697670bb4f504b4e14458d4845c9b5eb73d34be369
MD5 c5985a8799b49162954b70f5d5dd109b
SHA1 551f448f3a8d4be1fd8b77028610c513bb05bef0
SHA512 a09134a4aad9fe8a53e9092168ab0c8e049f6cab8129b393d5cde50d510013532fc46b225079b15de26f7d1921874416eaefc17c372120eff8058d3fc5837c04
SSDEEP 192:sxZARZyM/jK1Ml8UQ+c5/fxs6/IQt/hKRRIdpRc/W6+WNON5/BHtSjVI+qK01BOk:sxZAXq95/fxsyIQ3KA6/bu/yV8XZd
TLSH
T17662095AAA344977CDDBD21DF555BB57D6F90432D2940E48AAFCCB0C01E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 6b1f7cbd2b5555b3ed75b5985ebb2686a2c9bf1e8e5ede1bcbee9e3664c34567
MD5 29aad58907affb5fb34c00243f52af85
SHA1 87de1f60f015ec0fe0dcdeb361d712c104a08adb
SHA512 b018bc3d7b0eaf806f91ba146fc5840ef376501a80a91801d492dc93379201016dbfa223dedde7a16dc065d919694c249e78c011a8185be5c3b3781abcd40e44
SSDEEP 768:PA4bSV4b+8b4bm2877pLuLXG4bRWRmG4b/Qn4bH8F1+UoAYDCx9Tuqh0VfUC9xbZ:P3u+68si28NEXl1WRmlzQ4ju1jaKXTwr
TLSH
T1FF032B3F280CCB7E4F844E9CEC267F9A6EE8029B5698885447FE454C03C66EF551A1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3a976e56559e34c6d935b382f3cab0727d27b3e11e578ae43b6628c5caa5348a
MD5 aafb8af8a866f7c7ebbbb578757b3f65
SHA1 43b44c8bce9508dbbdf83dea6de02ba5f205c8b0
SHA512 c32513a1071fb7bef03346bc55822f381e4adb9172c3fb933525243a086d75bce4cc52c03b85a3b6eb5bb3f69ab27c5f5cc42c43096212e210f02a0f4c7c8d74
SSDEEP 48:KMQILKFC8byIvIdKw0IEiI/KDqwvyRKvk4K0Uxh+:KMQwKFCqvviKw0viMKDqK20
TLSH
T1E8917763727E16813C7E6409D1A48E6B5A4276633029642B7BE840B24E3BE105FFDCCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594c22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594c22.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 11dc1ca88d4571e5d20f4b8fea3189cd4794c60e760fed2b857b6f30efcf0880
MD5 eee9482db5fa7e58dc09f20f74d762ee
SHA1 0130beff4fc1d196ee9d8c9099983a03855db9ef
SHA512 2b8ac82bf6714858370e4dc5d052d729f3c0ba8e3f118ce98f06f3642be9ec544ae3e11b94ddd814f853d57bcfd24d140f0b080fe0e22ec79a5794822b1531d1
SSDEEP 384:yHiF9tNnNnb9D78Nm8TUNTUlIlQwv7UvfDfcF3b+AxOsJnIg/SA+jXaRnP/rV:TF9jZbRzwgCAFrpxOsJnIg/SAt1/rV
TLSH
T10FD2A4F598E79937D9AE5747A73E6D429EBCC1A374881984F7C85E0CCC821BFD20A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a8f7444afb9f8a01da21749ec41025371f5550fc436a94223ade38b988dc1d43
MD5 4fec212da7c0aca113ca7ec08e22f3a1
SHA1 01ffb0792b6dab1abf1f93a6d363d664352a2a7b
SHA512 f5f51f0b0efdaa9d5c78c26cbd21b73d9bc5b76d299ec8de423f081ce1f2124a9ecd9a83a68f4ea3d70919cc82d139433ff392a77ef57a51aee5cf9f63831883
SSDEEP 384:yntNnNnb9R8NmDwv7Nvr3b+AxOsJndg/SA+jXaRnP/rV:MjZb/2DrpxOsJndg/SAt1/rV
TLSH
T18F927C3529B8AC775AE66209F54B22539FBC15FB88C43FD4E6DCAB0D05D725C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e46a028f0a69f05c2f942342c97996b47c7407a7057d772e247635293c9b6b12
MD5 c35325442bb8f40ee5fac4af2731d794
SHA1 2ddf67b2e740187764367ddd876cb8ba54410b03
SHA512 dee54e6909c601b500761afd3bce2a60e4b0bff7ea721f1bdfed0fe30d61698247f78d8c19c5ca7f4f9c25cfee40972c2ffb442265a9368678134cfc5b515e2e
SSDEEP 384:yhtNnNnb9R8NmQwv7Nvr3b+AxOsJndg/SA+jXaRnP/rV:ejZb/zDrpxOsJndg/SAt1/rV
TLSH
T182927D352978AC775AE66209F54B22539FBC14FB88C43FD4E6DCAB0D05D724C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5c0125e8ea3b8f8ac8b0b7c1df0bb927a2b467ce738a0da0959e462beef68de
MD5 7780ab2c0c7b365996df9260d2779f13
SHA1 58639756694bf5dd2c3f486ecac5ecfd26ce6cf6
SHA512 aa973eb41b0bc65d8af99de9e657a33b930ba8890cc8b4a57511990d349f78ae1645e0f045dd674df440f8ab470c91638f79c3170d394e972dddae6864fd4762
SSDEEP 192:nRGNE6yMQmiUyiJm21Y3b+jcxODo+MnQCU6:RGNE6x551Y3b+AxOsJjU6
TLSH
T18002D635A9786C779FF26E49F98723138FE8117BE5942F84D6E82B0C04D765C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba898d3a4e449b10b0d06f594e6f057edf57d00870ef44e46d556c76a5de3102
MD5 d2473d935e1a2690a2a43a924cd5ba6f
SHA1 d24a6f41b79668523d3cc1c739ce9ff54208fd23
SHA512 69082e09f46294ca5d18e0121019ee59168dba06481007b16fc910e2f427fe89696f0e1679110cc014b33d558282b40d65e211a23662da96d68b8c03ded0ebca
SSDEEP 192:nRGN36yuQmiUy/02tY3b+jcxODoJB5a4MtqwaU6:RGN3636tY3b+AxOsJnKgU6
TLSH
T12D1209356979AC731EE66549F8C732938FEC20BBD9846F84E1E86B1C04DB61C270F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6ab6236b-58be-409c-9cdf-aa5ba3cc6d2c.tmp

Path C:\Users\Admin\AppData\Local\Temp\6ab6236b-58be-409c-9cdf-aa5ba3cc6d2c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BANDIVIEW-SETUP-X64.EXE

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BANDIVIEW-SETUP-X64.EXE
Size 9.9MB
SHA256 2d3c6e7c002be38c442868353268b641069b0674dbd1fb5e584ce2c507afbba9
MD5 15c7d18fe178d4b4ec941067f6361f75
SHA1 faaa268fce985243916f8c1e55c733835285f40c
SHA512 1a9895739551e0936d4c960e17d676e731d12fbcc5409d2972606579620927a0abfa00852fa128be776dd8b699ad0d4f302b30a4d2dcfba765a93b8f14e80e70
SSDEEP 196608:0tVIe9e20xv0OSxMsChLJ+c1Z2es7RKfcsTbOS7farvZ9QbTwbvgYdBiPX:peQ2090BMjwc1Z2NVsTbirhoTwbvjdYv
TLSH
T12DA63372BAF0E039E17365B02A2AC2F6C0B2F9765525944B57E06F096F34553CB2E332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CyberMania.url

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.url
Size 203B
SHA256 fe596ee03bd1a6ddc5c1e6cfe0504e2292f9dd0cd35f62487a3484d8a6bee094
MD5 47c76b79310a4beec20ebbcc4e98b69e
SHA1 7f802250547d367e771189f9eb0ea3fd9d091872
SHA512 c0a7027f73bb0e33e69886add900b31c1c11cd5e6f1c849252b2c60f199b29481fe40112e09fea27b19b2c357cb2c898d9ecbba559459454f5912c0b808b4c37
TLSH
T1EFD0C9A7DB09C25283169849E270DF0CF80724A8C88AC7CDD3904A8D4EC5091D4CA1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Replace.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
Size 2.8MB
SHA256 003ba054b0a46b264d3719bc47614005a26fdad3c8fe89b7c6eb1da9b00b44e6
MD5 81f684c4a21f7407ae3e1392309f8f7a
SHA1 5b4c0fefab1c632f5587bb474b91bf291bc289e8
SHA512 9eb03d4037add92b97da5e755ee51d2a6474cc782476501aabfa3ded9a56f0df97abc66a950653bad97be920eaa432931e947935cbf8cd969981918e5e18b55b
SSDEEP 49152:OZB1G8YlDC9gXBuGoOAYX+nrvJo1MDu9PuICAz3HRA/l6oSCRmSJ85cktfT5sXs:s3GfqgdoOAamLJo1/dCATQkoWYktEs
TLSH
T174D5220AE69908F8E4B7A478CC578546F77A3C1E03A0578F1395726B2F373A19D36712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c449c9de-fa30-4780-bdd0-3e85e60dc3a3.tmp

Path C:\Users\Admin\AppData\Local\Temp\c449c9de-fa30-4780-bdd0-3e85e60dc3a3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir800_1450938462\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86a9fc65-c77b-4cdd-bd51-c965a7471355.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir800_986040882\86a9fc65-c77b-4cdd-bd51-c965a7471355.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BandiView Image viewer.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\BandiView Image viewer.lnk
Size 1KB
SHA256 8682d3f75ca1cb81a542954a8788ee26c6cd426f4a04af32eca3f981c41bb90f
MD5 78df068a171e7d13253d3a531f795b28
SHA1 f53f55b8f92fc32b5c44d3ed5af9585c5d08c4bc
SHA512 39dccf68b83fe75fe36fc7df0d4fcf1173cf5e9f1f5dda4a480cfdc4d040bcf5bdd5c3110cee06765e0e935889e22aff76b34747cd45cd17547e396fae051380
TLSH
T143115028079A2B56E6F7C13756E556325732FD02E3A40F6B41D882405C6C35175E8F3D
MD5 SHA1 SHA512 TLSH

Submit Download

BandiView.lnk

Path C:\Users\Public\Desktop\BandiView.lnk
Size 1KB
SHA256 58cd0cea29543c91784766fc933ee89e63a8dd2314a5af9d8bd5a9ba42d7c666
MD5 29ea705a985c2c7daab8f5d590fd7fc0
SHA1 8a554dd45bd2939a838a5162d1b7cbf482b977fa
SHA512 0b1b2022e9a095c316bf6bc0704ce4581d025934ee56e2f92bd6d45d100b977a3703da8c687ff0a3d9f805869ab3bb49f55c5942f5eecb826f7bbc3a119e9d18
TLSH
T1BC315B3017DA5655F6F7D1735BF9AA344671FC42539403AF02CC8240AE6835471ADF7A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1035680676\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1288399942\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1567082176\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_79716675\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2456-16-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download