danabot | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/Trojan

Analysis

max time kernel
24s
max time network
38s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-11-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Trojan

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x002900000004521c-357.dat	family_danabot

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
69	raw.githubusercontent.com
70	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ed7ac101-199a-4c3b-88c3-de8babd4f8b4.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241108174807.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	544	WerFault.exe	112

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
1588	msedge.exe
1588	msedge.exe
2860	identity_helper.exe
2860	identity_helper.exe
688	msedge.exe
688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1320	1588	msedge.exe	82
PID 1588 wrote to memory of 1320	1588	msedge.exe	82
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 3444	1588	msedge.exe	83
PID 1588 wrote to memory of 4012	1588	msedge.exe	84
PID 1588 wrote to memory of 4012	1588	msedge.exe	84
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85
PID 1588 wrote to memory of 5564	1588	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Trojan
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fffd43746f8,0x7fffd4374708,0x7fffd4374718
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:344
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff71e435460,0x7ff71e435470,0x7ff71e435480
    3⤵
    PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  PID:544
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@544
    3⤵
    PID:4120
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      PID:5348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 496
    3⤵
    - Program crash
    PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11488405240768113193,7307384115589644809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 544 -ip 544
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9fc751d5fa08ca574eba851a781b900

SHA1
963c71087bd9360fa4aa1f12e84128cd26597af4

SHA256
360b095e7721603c82e03afa392eb3c3df58e91a831195fc9683e528c2363bbb

SHA512
ecb8d509380f5e7fe96f14966a4d83305cd9a2292bf42dec349269f51176a293bda3273dfe5fba5a32a6209f411e28a7c2ab0d36454b75e155fc053974980757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d9a93ee5221bd6f61ae818935430ccac

SHA1
f35db7fca9a0204cefc2aef07558802de13f9424

SHA256
a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968

SHA512
b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
0428c649d20c21ab9a6b54bb28b5e6bd

SHA1
21bb5b4c1726d2ffb70031d0809f379b8ce269ee

SHA256
75a6bca1680cba9b70e9383af2719fd4dca5af1c6be39de3b7228bab987918ec

SHA512
d25f929457b5b8bec81763596507c725df36951c3b32ed77235a08f99ff9234f5e54b3384147592f7f47959df6dc06a737b13f691b428f6778a4a910f5e019ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
16402b656609de30afdc2c90ab975a68

SHA1
82a98ab65b71a58928eb7604d66f224aa50a40dd

SHA256
dd7095bc71fe253f84436df7142da3c6cf7c5ce226920bb4e8a1628d4a351e3b

SHA512
190095767333c65ad9631acc071b76b0871543e953bfbdf55a965e68dda48cf0023efdc8c1a489779e9108b00f2e8ee77b503d5fe23bca7db8ffe0ebf4a6f627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
254015359647576063ee3b1d236e8ee3

SHA1
4a34e5a93a5b49593de1406563a689bd67002504

SHA256
ac2c0d033069349e1799f26a40b2b26f71d063cab31336521a55f14fcc757845

SHA512
f77bd6e1fb3967ed92772f17f95985d4b9f0e8018300163056963a901fa7c7300ef22884d6443255a15290d15345bdcdcd696e02a0dad06ba40039655a28f9a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a81d32731bdec076ba694854c4fd59e

SHA1
34057c8179b0ec5392e60c83b8ad01cd3ab6cebe

SHA256
e12d9e4d38d4df22c4dfc92cb39516a60c27e1c8767a753f85aa67625565019f

SHA512
6271bfac26b94125aa799e5de39d26430c45e7dbbffccbeef321efb73d30151475d2811edf8f20beab2eba9998b245bc0d4f95ee90b8fc1d99ca5878736b9d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e35f603fd48b9b624b6a40568e0383e0

SHA1
bdd40ab25f81db9d1ab5c6ddd01d438090fbc2ef

SHA256
4010bde319180348f1899b87ad4206ef42e5ac77dd7bdf5d4f9fbfea18a52d48

SHA512
1cc8e725ccdf94fd9dd11a2da815791a2a5c3768a59099e5da9a1b9184b6c4c1fe2a2279c85538a3cd2fc55372a779feb34dcbddf72cac063dac5bef69c995cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f9055ea0f42cb1609ff65d5be99750dc

SHA1
6f3a884d348e9f58271ddb0cdf4ee0e29becadd4

SHA256
1cacba6574ba8cc5278c387d6465ff72ef63df4c29cfbec5c76fbaf285d92348

SHA512
b1937bc9598d584a02c5c7ac42b96ed6121f16fe2de2623b74bb9b2ca3559fc7aff11464f83a9e9e3002a1c74d4bb0ee8136b0746a5773f8f12f857a7b2b3cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d3412a01d4c3df1df43f94ecd14a889a

SHA1
2900a987c87791c4b64d80e9ce8c8bd26b679c2f

SHA256
dd1511db0f7bf3dc835c2588c1fdd1976b6977ad7babe06380c21c63540919be

SHA512
7d216a9db336322310d7a6191ebac7d80fd4fa084413d0474f42b6eff3feb1baf3e1fb24172ea8abcb67d577f4e3aea2bc68fdb112205fc7592a311a18952f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa26c1d1dc362ad3871d0ec17ad747d7

SHA1
d06ce6583e07be3b07cace652bc1255cbd2577da

SHA256
f980fc9d4be37d30921dd27502b287034629b7508cf1a760cd6b040ca5eb511b

SHA512
1df25227f8f08b941ac079fa20056980b4e1373cfc3ae29e79016fbdbf20086fea763c52f57e0eb6619d738972608633c70eb4f5561036b48bb63d7b3c16a365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee48.TMP

Filesize
864B

MD5
870e27722273663628142eec82345475

SHA1
33f97afa38ffb6fe584828439859b3c3618f7d7e

SHA256
796b75c34afb648b5a94f1c0390740cd42237c8c79a76f31406cc330816f7644

SHA512
246f0d529e4af1f97c28b3562e5ef511738c9c306f6a8e823cb2e70c57ab69a7dc896bbddb00e91cff0d44055f3e7ee3d74c9b93e8f4b98e272cbae3b8b6ba8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
0d119f0bbcd2b8a04142763568796815

SHA1
fa60d250ff200d5b5efdb9a7eb5b2cc8aca37ec8

SHA256
a6572b8266be44a28dd3777b042287bdb6ca91464204b7263b71ebfa1b9d2511

SHA512
3d8450975c217e13b2f671019d0af8d83a08a689b804cd8dac2752d0eff12eb4fdc842fa44c7702c1f7c2f70091e4c9e2357a16567d5c7deb4fe893d51297f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f4db30a30c72109fb1de208ef0f9a19

SHA1
2a43fd27bc7f7589d73921a23fb29d862da3a161

SHA256
d3c40155cb94276d8d9c7b8e48fdb7850fc55be7ec27a7b91542a89313d5e2ca

SHA512
77d86195d914c8007fb4ea4a1206c31ad57f96474dc59e87978afc28b18ee93ddecb258fb510ca7c1ce395df568141cfe5e1c8ca6dbdaa59423508f7b3b7f7b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2708c8de140ff504d4d90b8a3a7c7fc4

SHA1
2e8293c1cf3753f2d28a536a9d073d5e4e68bd6c

SHA256
d3bd63c79ba993af7f27cf40bac2d76179f9b31602b9c6f25d90b0839119e8fd

SHA512
6e2241c44f4c8b98df71a5af5c353c7e51b469588f1d3a42203e6c5bf5470cc20018861747ce880934519a51501c5f63f6a5715803147d4f4f10753c22b5dff6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b3361f38c3eeed7238a6a9fe16238b0a

SHA1
7810a395d1ceda29cb19c8b24c4b86681d8eafa2

SHA256
a65a61eb5fd13f06a411dd2c0dc369c612e78b60f7aca3911ead66e05ab68e8a

SHA512
d60f2fb3af2f546a41c34b5872cd98fc4769cc6b7dfea6302b9d2c214fdf76324e2e77818405e3b5432d9f5bdaad7ae14a6dbbc067cfe96bdcf04a41bc8e10f8

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 737205.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
memory/544-362-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/4120-360-0x0000000002200000-0x000000000246B000-memory.dmp

Filesize
2.4MB

Download