danabot | hxxps://github[.]com/Zusyaku/Malware-Collection-Part-2/blob/main/Banking-Malware/DanaBot[.]exe

Analysis

max time kernel
496s
max time network
497s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Zusyaku/Malware-Collection-Part-2/blob/main/Banking-Malware/DanaBot.exe

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x000a000000023d0b-231.dat	family_danabot

Blocklisted process makes network request 30 IoCs

flow	pid	Process
59	5504	rundll32.exe
60	5472	rundll32.exe
75	5504	rundll32.exe
76	5472	rundll32.exe
81	5504	rundll32.exe
82	5472	rundll32.exe
86	5504	rundll32.exe
87	5472	rundll32.exe
91	5504	rundll32.exe
92	5472	rundll32.exe
94	5504	rundll32.exe
95	5472	rundll32.exe
96	5504	rundll32.exe
97	5472	rundll32.exe
98	5504	rundll32.exe
99	5472	rundll32.exe
100	5196	rundll32.exe
101	5504	rundll32.exe
102	5472	rundll32.exe
103	5196	rundll32.exe
106	5504	rundll32.exe
107	5472	rundll32.exe
108	5196	rundll32.exe
109	5196	rundll32.exe
131	5196	rundll32.exe
132	5196	rundll32.exe
134	5196	rundll32.exe
144	5196	rundll32.exe
145	5196	rundll32.exe
146	5196	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
4180	DanaBot.exe
2208	DanaBot.exe
2332	AgentTesla.exe
2712	AgentTesla.exe
4884	AgentTesla.exe
1640	DanaBot.exe

Loads dropped DLL 9 IoCs

pid	Process
5256	regsvr32.exe
5280	regsvr32.exe
5280	regsvr32.exe
5472	rundll32.exe
5504	rundll32.exe
5504	rundll32.exe
6128	regsvr32.exe
6128	regsvr32.exe
5196	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
52	raw.githubusercontent.com
53	raw.githubusercontent.com

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\Microsoft.Management.Infrastructure.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe.config	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe.config	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\Microsoft.Management.Infrastructure.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe.config	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\VDFParser.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\Microsoft.Management.Infrastructure.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\VDFParser.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\VDFParser.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5436	2208	WerFault.exe	124
5448	4180	WerFault.exe	121
1336	1640	WerFault.exe	158

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 366008.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 629760.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
3452	msedge.exe
3452	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2332	AgentTesla.exe
2712	AgentTesla.exe
4884	AgentTesla.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3648	3452	msedge.exe	82
PID 3452 wrote to memory of 3648	3452	msedge.exe	82
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 3108	3452	msedge.exe	83
PID 3452 wrote to memory of 4808	3452	msedge.exe	84
PID 3452 wrote to memory of 4808	3452	msedge.exe	84
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85
PID 3452 wrote to memory of 4984	3452	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Zusyaku/Malware-Collection-Part-2/blob/main/Banking-Malware/DanaBot.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff6e146f8,0x7ffff6e14708,0x7ffff6e14718
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4180
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@4180
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5256
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 400
    3⤵
    - Program crash
    PID:5448
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2208
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@2208
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5280
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 436
    3⤵
    - Program crash
    PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2332
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11973763591255156379,18239117372964522052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4180 -ip 4180
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2208 -ip 2208
1⤵
PID:5372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5284

C:\Users\Admin\Desktop\AgentTesla.exe
"C:\Users\Admin\Desktop\AgentTesla.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4884

C:\Users\Admin\Desktop\DanaBot.exe
"C:\Users\Admin\Desktop\DanaBot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\Desktop\DanaBot.dll f1 C:\Users\Admin\Desktop\DanaBot.exe@1640
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6128
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\Desktop\DanaBot.dll,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 152
  2⤵
  - Program crash
  PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1640 -ip 1640
1⤵
PID:5712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x240
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll

Filesize
5KB

MD5
aa6d1a798829536972ac5ba7d01d0c77

SHA1
8ec399faa7c428e9962f116b2baf6efca636e8c8

SHA256
74a89211b2a1bcf84796785fb93647ac6a1e5efbb2bbd14ddcee2e50c15153a4

SHA512
a937d3840bd6102c321ebaa06e01bda575d383aa152c1c0bfc8faa870109a7672a9957c50a6a259ecf481b47450df1814d7d152334e396780fe15760281be870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
220aee1011b2d2a0df80dfadf21d99ed

SHA1
f56f68c2af4261aa10df9428c81562110c844631

SHA256
efc1b14fdaa86eb67f4abc076bdc592d48a8d33c22bbaeb7d2652e7c50fa5b26

SHA512
4769d9c344f66d5ce5d67aae1e15367f14090b013cd8a3321ee074f52e8dad771ff5e9b467e2a7df7af77edf4dbafff492490be4bcbea5cde5abac9082705bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9b3143f7a318596494aea93d126435ce

SHA1
536e1f153fd67a1c951816392479eb9511f7be73

SHA256
a8e6adae634cfe9c95ddb01aff5c6d00f748ae96abaa7d1d4bda19e13564f61f

SHA512
be588676e30edd00a39a40644302e07c68581f74d4dd3107e42d86b9d2e89af2d8b3aa7b608f757c6c50cef7f7479e87b41a45d968157cf5216120a108a6a736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
246167ac8e542f5ebae486074eea2053

SHA1
d3a329e1b8bfd0e502806e9d6e3297379372b37f

SHA256
73343b28834de3d30b2b6c080c115fcf3849811ce1a4b22597f9a7ef31c0ce67

SHA512
0142873c5018500f25db3e6754e78edc4ccdd44bfe6482bdc280d540fa6d23f7d5955d855b5cd9bb790a9cfd4a9510aa3ca68a788ba06c40b317e7186e313b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f9b8d4ef9bd59dd5f88ade0e34c749e2

SHA1
2c2f8a99aa461acfbc9572c132efcf60bd0e02e6

SHA256
57cffeab49a960a1381fb032c87b892649bebd604cc2759df6bad6a728c62697

SHA512
e934430a7d17f91af7ea55e4cc36ec9b6499bd708199038e8ea00b93ae233194bf83497200376af88c5c970c4b06145490cabb625578b213f98b16f9585048ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
7c6f77ce8f7dee8d51a092206d00f988

SHA1
ecf6201025a6dc79f0395f84f1f71ba55287c032

SHA256
6772a992f4c82d1fd4cb98aba5375aea3dcfc930ed28f0877c869c4ee5079c8e

SHA512
798a10664815a35a719bf61d3c6ceee28424cbbea538b25231d3df403089b7d38b82c2bb487b424e7b5d15366cbbda4159fe91eb7696ec754dad59270ec919ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
bb0612ea9fda96811665ae6b448d19f8

SHA1
c6b51153e1b82bc72096d15b0e021ff57d3851b1

SHA256
e1956a8da207adccedd55a98db6c043022c9d7032d32e18ec875c06cbd60b8b6

SHA512
03b3aada6540bb5c9b83fa576f3ff7c6c3c95b047e54e1947811fef8c9a94dc8c3f54d74716fad219086488baf0ef7d31a391d1a8401261a962b575ab7a2f7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.reddit.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
940B

MD5
4521c513ba471fc123c7db2a856560d7

SHA1
c73802cc31633247575d69697abb1ba39730fea7

SHA256
b75ed51fed792c294e0bb54b4eb3fce664d22f67c6d0a0ac5cfa4bbb0683b738

SHA512
17339863c13c4dee652bcdab90ead9000222a44d14cacd8c92290bba887e956ad3ccc2fadcb2d3838240bfc7b3b66201d0737ac286c0c49ec51e7a3a8578543d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
61a84dfcd0c6e1756357560361a3f01a

SHA1
32fd97a1f6785aa4db513a8a61b5f9db9ab3ce2f

SHA256
b5ee71f3e61426f92eca340118c6d719fd1d5ffbfa6ff1a38bb7a4c3aebf2628

SHA512
2516d367f06afd0e337fad8371906ca4a5968f49e980d585490f292262448bb4f92e2e16814e8c932fcea84e018d097a5300c4cfaefbda606cd0666b47c0e431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
846a4a345ab9c5102dcf3fbe6ad744c6

SHA1
15a84c770674198e8105b2bed2a25a78c09b9a9c

SHA256
3e2f713a86ad36d775bfaec767343b0beb06562335cf013f53f84ec27bc331d7

SHA512
fe1d161a1319695b946f303e99fc81c34af298b33e94c27977f6ad3589fa3b635a1001c5b9f87532b0bf29659ad285985551dc6bafeb955fc8050b973f6a2d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cbdbce7517afc8620c70e6a4c19c4187

SHA1
b932cfbb95d5f42e292d9f1f09a55d79b0506692

SHA256
dc0aabd6063340e92566953ac65113f640243b0a4a4c02bc11d293f184809019

SHA512
3f936fc7f7602923d9b70de608fc0ffe261d9a3d0d49855a203cc7f2342e85d26ddf10b44270b400881980d9a504e671dc6edf942bfa7f4cf11401b4e04be375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
509031f2a8881a8b12889a2140f2b186

SHA1
3db9b42c705950b6964f6ee2b2bc29185714ec8d

SHA256
3cdb975c6e63904baec22cddaa75d9c6cbd834c88eeedd0259b8e8ec1875e448

SHA512
c00f3669464e7e5b461a1ab25714f0bdfc424b5b7393ce0dfc9bad60770b1ce84e4342fa09ad90e66463705625e1714a4e0428f053355019d7ab2b4c5b5e93c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c65aea5fb795b41eb31d949fafacee8

SHA1
4209a9bd99a87a22e8cdf2477f777c68b87cc315

SHA256
d7b6ba5d3944bf491e34c0a6a2972258a779169a06035a30f8c6377dcee194cb

SHA512
e26ba3d76896a5fd4b7a3dc3744cd63de01ceb539db0f51ac6145dc9f486019a217e98493ff16dd1fdcee7868a7cc41cd6adea4c0992964be8a971a0f166914e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fd29c43b610e0dc93e2ccc454afcb551

SHA1
c4272a0beabb6e6b7b3ab8ebd97526b3ceb19360

SHA256
ad2b33d6b2179e5b503dff22c6b36c7694894ba0660164b69af10320a71b7005

SHA512
dd0b42cc2ee2a6fe8c862c90a96e1f8a082ab47602e78a659f384282c843638da25c2ea397dda01971888f231e00ec633b4d6426e7b679b984398c409133b960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
94dc6859c16d7fc222a9b1d4c4c193b7

SHA1
66455a118ef116312093e3542ce60ba9cee5bc67

SHA256
def5f7c107cfa752fa3a733eb493647bfbda2b46f4cee1f1d3648eee01b88626

SHA512
806e181ad6d49e7e981248161ffd6cdb4e17b42d5e80e7222eef71a170d241bb6cabece0ecbd79f4a7a7d1faccdb655502b146a81906d0d1318e6a860c8f21ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
449fa60790c5eb75017735341e7ed887

SHA1
daceb9ca88036f8d7c521562a69da7c04cb06f2a

SHA256
eb671f9d793097229e62245a0f5154eed9914a7a5cf03285a47cb7a459e0d353

SHA512
32b7cf705bcadb7b298f2935f7b584f0df985b23f8e77678760a427a72451028e228a3e6b5d9995b122af9f2f05eb0ba20a2b56d76ebde79897544c72a487380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d27087ffe4ef29ac896d85c88fe0c67

SHA1
cf76935a943de34fd7a25087bb74a110c19402cb

SHA256
5e95c31aa7d11e9834aec24e40337d8acb1d2808077e8b011ee5062c69d32088

SHA512
58fe9964701225b29204cac1618bcc5340bbbbdbf2c3e779287f4cfb7d951513b4c9b9a69f85577c69da573c66af806f33cdbadeba34fe28a30257ab8bf8432c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a41e56a4fe54e479a886728937136b0

SHA1
375dec4787dd74e2ec5ca4f007044c902f458d88

SHA256
db29cd974a9e0fdae92ad7178da036a0777ede59033fc061b8a08dce5612df5d

SHA512
2f55637fffac42254b65791751c54133d0ea34f8af2ae133002c94aaf248c643299377b6b073e38cd9eb8fcb8ec2e731784a253a77e76cdeabac42749510fd6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fab55a668d2310266c5852b89d894c6

SHA1
994e5602520dc79e7443660199d1d2bf04ac897a

SHA256
73f4eb876c29afb30f3cbd3cd2914ecd94d61ef82bc842321bf4f137a84205bc

SHA512
c6dd7a9549e1718acdebcd5d209f6eb42b3ec39bd450b0e8e39f6a502de89c8727105dab6a672eaadc59dca4dd04f4a29434172e058020d5fbd13a7033478faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b9592fb8b47a8cfc0621e12c05fe1b2

SHA1
5dfbd0c1efb9358e22e6e1d4d4f5fd923e14f6ec

SHA256
ad0574f85c43255380ffaae4366c5cf84bf9fc3efc794b0871e21ea1657bf400

SHA512
1f2da863b241701317367847a07cde54b94b657bda09ecc3c7befea05a00581981c6925db991dc97bab2d7529d81abf8c186a5b8053ea1045f9b59d1c9dac4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9d956086df35c02c97392e1f5f82f757

SHA1
7f5b7a2d25d32f6627a57f8a0c7fc1be8e6eac4a

SHA256
6d2b28385680e561483e9ed3178fd232063d15121caa4eb45b972921a5d5f81f

SHA512
d141881027e04e1cee4ae9b96792211d4d8c976f2d953652bdcc85930ea42cf66d1aa82d9ac9ec55fc71e97caac874ad5bf0b5ade0dc7cf8d8aecd68b190aa67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ec68a.TMP

Filesize
48B

MD5
473b8863b3ffcfb841358ef6815f6514

SHA1
6d7a99ddb04b8295aa241002c22a15708464ae04

SHA256
7f1e91323213472f29c42d89604bd5e8685b31628af25306aebd4f6144e04224

SHA512
1b9f0f2a8ed8cc3c358e099e57126c0c76fb85545f14200c50f4a1e42724afac652ea1b8ec731132a8c6e085694c33da3f55b55d5b6d4dcbfb426939cfa6406d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d8730d2522f38e9fb09de5dca0d872a

SHA1
f8630c659c1d02dc0cb4656890e06810a9848fdd

SHA256
bba1f74635c70bc5f68dc5b1df8f6ef95cee9ce02acc7c7b67189f31fe168006

SHA512
6eb45a9cce68971c791dabebac2f637df15cda45ae90598f3b1f0d4d0a36ee66b9a94ba4cd9ff89361821041185eb62d80af8f141635262d57a4f0740b5b7c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
01a80f3d4f62aaa29fe196817b8a22c0

SHA1
115a8d6ad0bc8fa50aaf7402088532266b2e22a2

SHA256
53f7a09064b2b3695046beb8300cd809899fb41b812661f486a583c33f50a5a7

SHA512
281aabba48687e2bef71809955a616b487c9773f505f9d14002a987fec1e541511e1a709e513a485b9f7d4087b9042448632b1f4779d54ed47ffc21f1362ee7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
354bfea449ebcee9f62b2bc6593170b0

SHA1
5126eb8d56df71b8eb19093eef350d8ebe4a8256

SHA256
3f63b026a8f1a31b9ec2d8d7f1cc01f7ae5b832acb7d4d5a14d6e577d037a4d3

SHA512
becbf6cd50c116938345a782844f4a487ecd8699ca1c6f1c9e3b8e99ac79d14842146714d8ab1cf50618595b9bb4d35a7d43309c00647d107e56baf489724805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c1014fa21cc80fef44776e44d488c71

SHA1
30cae6db22319933aa825264e7e98b5fc1998e8b

SHA256
7208d86d0ba7b678f33e74e21eeb54ae15125b5a8f5ad557b80ccbe08b83d8e8

SHA512
05a4ec46b3799652ad86dc1f21fa0a99a95cee722b6ba015ccde30205368596c7ed81086c179678628a8b2c17268d0fcb0a87f6794a390049d4dbd8db2bf33a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8783c770e5cf124ec6dddb6e4e4eb6f8

SHA1
780082518e0e32e044d691309b7d062bc6838bc0

SHA256
a622f391e21caa02c57ba2409da1be37cdf82176ba8deab19b2d132711988b8f

SHA512
d4616159c50ae3dc3f94bd202d3acffec97747a0ebd43ed828a663022fdd1d6d68f947563b20f9d70d3457359452770369fde7212d5f2d317a1cce666d3a3066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8022aca42d593c490b51f8d66eda0416

SHA1
34487adb01f6c783b6afe537852c017fbb60d78b

SHA256
0e531761af1d633ebdb1d3e4f2d23dfa3448a65da3ba41364f524161cdae37ae

SHA512
a3b4af635e35194a70d8ceb0a94f9dfd284112b0148327b10c9b3a67162378f66d251134fa721bc630972f267b04add455fa5cd43e2e084dd7fb487fd4481692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
54f5a8d0151750bfee5a083c56b0f7de

SHA1
3f5146d32c6e8a1bbb3adddfe68be3206ef1010d

SHA256
764f87375cf0711fe8ff4fce71a072ec02cab7cee885651e7c9bd365cabbaa87

SHA512
62fb1350552878af4cc375e95d94784579a13905ea11b07d7839645356b9aec47090cc2bce78af64a9d573b7fb140fc5aabf8f9f3a2ba4d96b640eb3d63ca52d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6574a1358a133a391b87b10a19e9ba4f

SHA1
c9fa085a2666be7efbf1bffc00e0262b367f741e

SHA256
3b4b775eaae824c368aef2cf0297be09fae4fb2c73d4e446b05127e84ce67b86

SHA512
faf53733b56b83196cda55b286be4b16bee25926af8c7e95a686891ca797779d4eb7c853f8414e4f07348e31aacff79f8f2ca77f96dacdb6c8b11617e2a7c6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5ac0140d29b895e8456370ced11200ca

SHA1
657fd8d7210a134cdbe9d5d6c2a72cfe5cd9ee0b

SHA256
1e5a3ecef74adfaa0eff7e7a646afae28ce6c9c4faa1877ef3cb4d74e6c5a0a4

SHA512
fbe90b59201d05ffc35f87b3d9a5a20dda1c93997313787b61ecd5deea2c4b47f32fa430c919d417290926269fbe5bb15310023f097e676f1060d714520d8b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c2b58bd97d11e74c47007b548a37eb8

SHA1
60c6955643d03c6efe4b970f3f410325c5cf865c

SHA256
6700d9f872c9b923444a5d2c8764352c57af10387b279b916116b5f10a1675f2

SHA512
3a48d568bb5b132d7319255fe14c9be55b9772fb6246b8533b39427211e7762002dc4095a250adaf26488ffaa9c1577119b730f460b40d1cc8c7a439c8d063e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
62f6101e0866e6e51b8e2b24b6740e81

SHA1
ad6b4a2bcc7473225b66ae05d45af2b7881bca83

SHA256
de9093e17541f005f1f92e444adbe475a7a6695e749e1e21d6bf44c1e175b8e2

SHA512
21d0bb524214e24185c619d9ba1dea56a9b7f1cea51caeb85452f4c8948545017b8c26c735b86d0d7fe01aec26e7c72891ef7449e8dc33088997aaccbb177527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5761cb49722131c3962b7a87d1ce1cf5

SHA1
0b7fe0c3b50bde3adae4b2823fd92b34b7e5a26e

SHA256
0a6e84a435976005610d43aa8dab3ce6141630745a13263acbe2ff39362d35ca

SHA512
d6bdd9ddfb0c193223b76ed0dcbd5c77f6115826f3c447a85f99c6a884273d0f80f34a863dda15aaf3bbd03f4ffe473f0b7a4f8594f7778dcf6f46a1c57540ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2333861d07f3d59efa4d507ca94f2739

SHA1
3051368241e683a32097e4194ec773112b38baee

SHA256
39eedba66dda78b0eccb221f695aea4dc64764a1269cf467018de66c56e5d2dd

SHA512
faaa72ff3b5728dd10f837d781d20e459ba31239bbd19a9e196fee9a4b5784449d02a0e5c9b2fd523ebcb912eda5c00f4e47352eb6ac5e5901190791dcace2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f8ceacbbf78193a30178d90eb75e201

SHA1
933eeb44c6ab5898348072bb457e510310a63cce

SHA256
e1e108b6cbda650ac2bc83f7c50071accca46885bd617f8d9d9a1af7ff495b12

SHA512
75a64e457a7d6820831911846cf0ec1720b3455abc3b58160253848d210e5a9eb3bd46085857b1db55abc205b4ddec513733e5b2a83b7bb443c07f11ac83a0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fb58.TMP

Filesize
874B

MD5
d4868a40009d0840ff2335dc89b772cf

SHA1
5b63f24ab56d429f77f9b5790212e69d083af716

SHA256
009a64b4882765d06ee44fa920febb8c800fed559ac1cf9621dbd196b30850ac

SHA512
0843d2def7410c20a545f16485a51d1c821d1f0f2d29c63e047ed7b067613ad8d28f5fd3f316dfac30043c81edfa76d633fe4125938fdb4fa357029200b074f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89d94ed1438e94941328af205b5a6d1d

SHA1
bd93f5d85e8c29d5b3cfb0b1fbbf1ba34d7e7680

SHA256
14b7e9ad97a0f88f85df71e42ae0631df88d4dbe3ab339b2ba68729adddf8ac5

SHA512
57182dc5c05263fea05ec2211bf8397774cf28a7e856d77a2a880a5020d4c89dae847a2de5215b01b16b942cf53e2ab032d1bc333fb7afaaecb6a2e172b4e990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fea28ec86adf15748837c082cba6858

SHA1
963277db4f30e965377e367d3d7ef5fc5fb88bc2

SHA256
85661879cea7d1712f6006e8663a8c0ef6f858db86066de5b9ba11e2756b0109

SHA512
5d102bc3abd2d619f79562f3ad9989993da4582ce765846f42288e6d12d11864e3cc4180f667273368625cbbcfb34479441663a5ece264e357657b4750dc2524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e87f4823449987f5151b2b8d1dd6f44

SHA1
0eb06506a6712a47f37ec1d64bde6f4174d13b30

SHA256
6a6cd7f757fae6799805b81a6ab290e81f580b4f1b3bb0020300a6fffde80502

SHA512
8c3ce5d152021d1ed239c0152133bc38c51784f57d5c0fe28667dfe9d19d0400ab408d870d6be688f7f987312031b0d2224ba36d565a6f83affcb7c3937f18be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9126f9ea2b242eae63cc09dfa319388

SHA1
9b2390ccb29e6f216ef4a8d4cff6cf62122f3ca9

SHA256
d08cab4faf4fbd359988059d97d03f731897fc682effe1834a0f6f939b9d7a03

SHA512
1d182ada4777761d5376899b8b28bec4b4f893623eb56320665368d8e55796998f1b93465c199daea2e7c20f395ecdba6aea5768b81d38bc1b1ac052043ec23c

Download Submit
C:\Users\Admin\Downloads\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 366008.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 629760.crdownload

Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
memory/1640-494-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/2208-243-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/4180-242-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/5196-497-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/5280-237-0x0000000002490000-0x00000000026FB000-memory.dmp

Filesize
2.4MB

Download
memory/5472-298-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/5472-247-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/5504-299-0x00000000024B0000-0x000000000271B000-memory.dmp

Filesize
2.4MB

Download
memory/5504-248-0x00000000024B0000-0x000000000271B000-memory.dmp

Filesize
2.4MB

Download
memory/5504-241-0x00000000024B0000-0x000000000271B000-memory.dmp

Filesize
2.4MB

Download
memory/6128-492-0x0000000002190000-0x00000000023FB000-memory.dmp

Filesize
2.4MB

Download