danabot | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Banking-Malware/DanaBot[.]exe

Analysis

max time kernel
51s
max time network
52s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
17-01-2025 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Banking-Malware/DanaBot.exe

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x0004000000040b5f-221.dat	family_danabot

Blocklisted process makes network request 2 IoCs

flow	pid	Process
51	704	rundll32.exe
52	704	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2888	DanaBot.exe
4288	DanaBot.exe

Loads dropped DLL 4 IoCs

pid	Process
412	regsvr32.exe
412	regsvr32.exe
704	rundll32.exe
704	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\26832e8a-ab0c-4e49-ba51-75898cf7eadb.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250117162948.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	2888	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
728	msedge.exe
728	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe
1984	msedge.exe
1984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 1168	728	msedge.exe	80
PID 728 wrote to memory of 1168	728	msedge.exe	80
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 1116	728	msedge.exe	81
PID 728 wrote to memory of 2040	728	msedge.exe	82
PID 728 wrote to memory of 2040	728	msedge.exe	82
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83
PID 728 wrote to memory of 2376	728	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Banking-Malware/DanaBot.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb634b46f8,0x7ffb634b4708,0x7ffb634b4718
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6f76e5460,0x7ff6f76e5470,0x7ff6f76e5480
    3⤵
    PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,14438329025787480678,6304885109109468833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2888
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@2888
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:412
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 476
    3⤵
    - Program crash
    PID:2388
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2888 -ip 2888
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b16630717cf81f638bae67ab57f5e76

SHA1
5767a40e7011584c074743df3ddca48d05c833aa

SHA256
687f4722fac01dbddcee3ad0b9bb4c5483d21a83538b049818fb3ea9f2b52cfd

SHA512
3718b25f887b0112db461060ee647ad4240bad91d82816e48659e15b9f1c94b4a637665ac258b025fdb6b3ae0349bc26802e4b6d8215846ebc01777ed5a6f771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ab523be0df47b9c44c0863d39e9402e

SHA1
a41f981235db6719a25988be3f650f0dd44c5803

SHA256
65223a518625d4525c42fa0a46e7bc62cfbc9f4eed6570a7c10f639ccbb907ac

SHA512
865d0e948b80b911c029f4782d31bed455d6ae405823db137fe5582674f556312db9182f04417f876a4c04326183d97759abe5b114230a939417c9fe87449e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
2c2e6472d05e3832905f0ad4a04d21c3

SHA1
007edbf35759af62a5b847ab09055e7d9b86ffcc

SHA256
283d954fa21caa1f3b4aba941b154fab3e626ff27e7b8029f5357872c48cbe03

SHA512
8c4ce1ea02da6ffb7e7041c50528da447d087d9ee3c9f4a8c525d2d856cf48e46f5dd9a1fedd23dd047634e719c8886457f7e7240aa3cc36f1a6216e4c00ee37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5890f0.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b403222b41cbb097ed30f05fb1d432d3

SHA1
26f3d2d64748aa6b0b41237bfdf221a5969b401d

SHA256
1a8afd6663347dfc6494575bab86c14dc33aa10465b47796d7c4198de00be2f7

SHA512
12ae36ad30f3cd2135d7212f97787102429148ab5acd843dc2cb9d65910cd21c3cbb44eef38a7549e54fcc3d0dc7d53b986c9016bb263181ad907179ccd319dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7dbb09aff2c5c099e4861899212767e3

SHA1
60c51a74cd45ea4bb87c4515e21036ff7f90abcf

SHA256
c37f88049e02a68408361091ac68846dad4ac7cb53a30bebf7fd70ea5d4d5bbc

SHA512
841aba47c286e54a89911bef11ab62462e1af20d423b3c65a2ffd9f15df3d05256f83fe8e006d15e740541dbd0f26e2f345361ec40d9e248fe2ec6f8993e2d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2ee8d54ba7bc87e7184b9ebdfa96282

SHA1
c86c2405f8560d5edcd5a3c35752095c8ef359e8

SHA256
ad1de46c510e676ccd3dac32bd9f2c21735d59fb4302222dfae4a4c1ca9912fb

SHA512
ac1d76cce76d890f44075c6aeabef4232826e60abd391548a598488bb74f88e7d9038bb425263ee59b47081a8d04f7b92838cf1deba19cadd4d4bbc286bf864b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b412d0f61774d62f69064b75b9bd4278

SHA1
67a0edb4f9002c47a63a7ba938e6907a214f4ebb

SHA256
6b6e89af8ec7c6509a624bcaf24255919f038d9244057fc5ad4447e9fb8e8df4

SHA512
6e6fce251732e0b30768dce7d93c0422e4329c06f9ab2ad620239227be50c915774728ae522c66100e652a586b1b8be7117448a40ad059982e63ea508b1c8097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d590b705436b349074c9730516c56716

SHA1
545dae2c594f8dd63eebc19fabd55900b7a001cd

SHA256
da4e0974a427913f72174b1fa4fc560396d987ed41ed691409916cb42d914413

SHA512
e11e7aa45fe3b931bbdf7956379dc61f845e19a087eac8e5ebe4783c5ca3d2a602016271e8f1ea4bd2ef9dacca444b93f1fcab0373921246e2ed7350f48cb9d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
99315c72c0078122aea1e2e0e41a26e8

SHA1
1d04494fd6fd5bc394405c02e23f8df323394d4a

SHA256
2dcf01b803332137a3a4925f7fc2878c3c6b8be4be77ef359e7f658811446b97

SHA512
7a5404b86f6b5cdddcc12fb9c0f23f4264049ae784faf0be2ff16277eddc09759bcd4f62a6652c87f956255de49f12b12c32dbb5dd228cb99574a963c26ab605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e2e4066c096b0086f3ff15369953393b

SHA1
eb1a59d121f6771a010388813e51e4719fdbff77

SHA256
56cb550fca0ac77630e70a73f9e01b9afd0a9b7dafc7b3b5ab63054a04e5ce42

SHA512
4268c1e046468bdb6c558168389197ea1d5bf14d46787647091d1d7a3ddee4cc04118ad103dcaaf2b66adc02b8efff767b2b00b7868cdde6e50bde58d1fac22a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9648e903451b9bc3bbeb59887ca23e2c

SHA1
f7ae103f4bece8fd9a8589560b03764bd935b795

SHA256
2279173792ec67729999f10f91ef6016dbe7db4048f3d93642b3a0c99d1706f7

SHA512
a20299784aa17db01460414a167b2fc853a1e9038b48965b80cdca8cece9e30984a6c5e55f57ae91f19bcbeee5aa050ffcd2e130ba7b0368e44049ce77d4b147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
8ce6fbd87b84a540bc0a419a00dd8bc3

SHA1
baa5341c1007635838b6c4f73f1ece0db9ed1d3f

SHA256
f4c7072167e917f386e5c76e8d3e092bd0c4b43d7020574b8a9d2d0505c184e6

SHA512
99e24536c004fc193a95cf56c966aeed8eaa8105f56c8bb52f2627d0a862d684703a7754b3a78d4fbcbaefa6920a54367552395861b396c63a7fcca86c81c97d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
79ea0ac1d65c3715c7fc5d3fa1d4d823

SHA1
4c269049b1344f347c8764f5b95cf2295c1e1021

SHA256
c67a16a57ea01b948ba630d192e8ee9c92fb48d244d5163b94912bd349e1286a

SHA512
af114e93c4480c08f68a74e045bda1d04aa115074255ea4f1dbab837a3d24b4a4881074cebefa5f481e6cd885dddf23383f2db84c7d6c86c78e7f179f2bbd380

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
de53a1cdbdace13c15f48f38b9768ee2

SHA1
dc944f2287b6b9ee1ac39b6df12457d3ebab34a1

SHA256
2a2045d574e8faa3e5c7f5bb5ea703b538b21a33020b1e8cb6cb05a87b958e9e

SHA512
b050628bdc2361e75f3de21dc3d77dc251aba55cd86b9c0757ad409d447a57312f84911fa12caf97ed2fff86f353d82cf0766669eeed8bbbecd075b3282e0d38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
df1c5d17bd0608a22c5be988e8d51651

SHA1
c2c74dfbaf9bd051353ffd68a95639d79de03f0b

SHA256
7a51443b89a5b59666a02fe9b3af65c902692817827e3bb994eacda5e42f9b9e

SHA512
c216a51256e5c474affa168dd43b244969929d0a1a8bc5eb28e252e6bfc92b65ae471bd39a07d4cbdd218f08899dc567d920dd6c6aa43c2d37ef6ffb3af2efc2

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 729781.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
memory/412-224-0x0000000002520000-0x000000000278B000-memory.dmp

Filesize
2.4MB

Download
memory/704-227-0x0000000002390000-0x00000000025FB000-memory.dmp

Filesize
2.4MB

Download
memory/704-376-0x0000000002390000-0x00000000025FB000-memory.dmp

Filesize
2.4MB

Download
memory/2888-237-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download