lokibot | hxxps://github[.]com/enginestein/Virus-Collection/tree/main/Windows/Binaries

Analysis

max time kernel
242s
max time network
247s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12-09-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/enginestein/Virus-Collection/tree/main/Windows/Binaries

Score

10^/10

lokibot agilenet collection credential_access defense_evasion discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe	Axam.a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe	Axam.a.exe

Executes dropped EXE 5 IoCs

pid	Process
1256	Lokibot.exe
888	Lokibot.exe
1592	Anap.a.exe
3724	Anap.a.exe
2336	Axam.a.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1256-252-0x0000000000A70000-0x0000000000A84000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysaxam32 = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe"	Axam.a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
18	raw.githubusercontent.com
29	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0003000000000687-387.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1256 set thread context of 888	1256	Lokibot.exe	101

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Morpheus\My Shared Folder\Blaster.exe	Axam.a.exe
File created	C:\Program Files (x86)\Grokster\My Grokster\XXX_HOTSEX.exe	Axam.a.exe
File created	C:\Program Files (x86)\BearShare\Shared\fxbgbear.exe	Axam.a.exe
File created	C:\Program Files (x86)\Edonkey2000\Incoming\setup_flash.exe	Axam.a.exe
File created	C:\Program Files (x86)\limewire\Shared\Super Mario.exe	Axam.a.exe
File created	C:\Program Files (x86)\KMD\My Shared Folder\Axam.exe	Axam.a.exe
File created	C:\Program Files (x86)\Kazaa\My Shared Folder\Invisible_man.exe	Axam.a.exe
File created	C:\Program Files (x86)\KaZaA Lite\My Shared Folder\AjeedNASA.exe	Axam.a.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Anap.a.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Axam.a.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Axam.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anap.a.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	Axam.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "Spitmaxa"	Axam.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon	Axam.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon\ = "%1"	Axam.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell	Axam.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open	Axam.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe \"%1\" %*"	Axam.a.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa	Axam.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command	Axam.a.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Axam.a.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 390692.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 114990.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 60218.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 6129.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Anap.a.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 54583.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
1632	msedge.exe
1632	msedge.exe
3464	identity_helper.exe
3464	identity_helper.exe
4932	msedge.exe
4932	msedge.exe
1292	msedge.exe
1292	msedge.exe
1256	Lokibot.exe
1256	Lokibot.exe
1256	Lokibot.exe
1256	Lokibot.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
2976	msedge.exe
2976	msedge.exe
3348	msedge.exe
3348	msedge.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe
2336	Axam.a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	Lokibot.exe
Token: SeDebugPrivilege	888	Lokibot.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2336	Axam.a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1080	1632	msedge.exe	79
PID 1632 wrote to memory of 1080	1632	msedge.exe	79
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 1584	1632	msedge.exe	80
PID 1632 wrote to memory of 2852	1632	msedge.exe	81
PID 1632 wrote to memory of 2852	1632	msedge.exe	81
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82
PID 1632 wrote to memory of 552	1632	msedge.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/enginestein/Virus-Collection/tree/main/Windows/Binaries
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd250d3cb8,0x7ffd250d3cc8,0x7ffd250d3cd8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1624 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,9537274184723247865,12341307622076161182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2816

C:\Users\Admin\Downloads\Lokibot.exe
"C:\Users\Admin\Downloads\Lokibot.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256
- C:\Users\Admin\Downloads\Lokibot.exe
  "C:\Users\Admin\Downloads\Lokibot.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:888

C:\Users\Admin\Downloads\Anap.a.exe
"C:\Users\Admin\Downloads\Anap.a.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592

C:\Users\Admin\Downloads\Anap.a.exe
"C:\Users\Admin\Downloads\Anap.a.exe"
1⤵
- Executes dropped EXE
PID:3724

C:\Users\Admin\Downloads\Axam.a.exe
"C:\Users\Admin\Downloads\Axam.a.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
525bfa001fd01eea5a3c033ecf2cb9b9

SHA1
b0295cf86a8df829faff01bf7356682e8ac2c8bc

SHA256
35f6bd77810a2693edd44d0d838638d4546985473569f5e3417b823c151c4aa5

SHA512
4f67d3c63c4aac6a1600e52bc34683ec150ce01976161916fce32d29482c675bbdcf02faf7f1220f507cd4a78d60613976cbc24df61d1537ebc96ffeedf7dd44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
be85a012866f82533b134a3e7c03581c

SHA1
8f361377763dc0f643a3c2746149ca5850c5d8c0

SHA256
7c0534066657219aeecf9763515dbb8eeb5b0cc4509d25ed75d5347476f443a0

SHA512
38aa3dc3c36a5319162d52fb0bdb7588dfa9fada5247c49ee53d870b7d928ea5be1387e176e8caf3dd6cad9b6975d432eae587c0103f8dffc56f17ef887ae621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd6d6f260fcef93090d68ff42d0b8807

SHA1
0c242696f2b9ac7999e03f8622600314e1a5f4ae

SHA256
0ef088ff5d3ce8fe14083780b05efc5beb2cd7d6c711ede5f79769c8e333d010

SHA512
b21ffa2d03e0390408849530c2f01a823d81dc7c3fdb250c9681d6466fd7eebf80a7f40a3df46dc2a72f081195ba22b2342c50a413b1094475062941144aa8db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0e5bf024462b44ba724a6532e8e14aa

SHA1
8fec9136ca97b5eb0eea660f2b40b6e64da2815d

SHA256
3ee1ff2023cf8bb130ad96ed76ca3da39bc9ba07099bc6ab3197e2adf0e95f07

SHA512
a57272687f4fea0803039e7dbca92bd70c671a7b3d2768a214e5e13a8017b56efe7259e0e5abac15af6421b780d572e8c32be772dc5f73510693c6d8d4c36830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
963ee8799572cc0d8e63cc25979de76f

SHA1
8061c724037cbf6c32a936e45bf99be0c37435db

SHA256
91eed006d069db054010837ea26c1d9b8d37ee5e476b9fef049436a335f87f0b

SHA512
994444b5e898c5eb62366895943804db60460ee3a48db78cdb93edb46224e76b99b549c1f5bc7ccd88f7c9f60f7e0c8482fda536ce2e312a873d2087e0e2bf17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e06615f24f94384c6e12429f5cce72fb

SHA1
873ee518d53345c334dfabdad1e52e314bd1f850

SHA256
864487fc86890e0f3a6baa6743d31c1f929c8b6d6a7237143e4e9fca5c1aaf6c

SHA512
fcf47c2ad6c44b34c524270677eb5901df360974d628f1ec7b78aafb3b10de5e730c8bf23216a312b53acf8a3995e5d05ef7451f48d6ff4a025c5ab3e5c78a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b23fe986ee61ecc9b954eac9f7f5a90d

SHA1
923316f3176ccad2d048a09de3b5811645f7bbdc

SHA256
3551ffff391e4453a3fe1ae66be76f5464fc21255ff563755e54b1565cc78b0e

SHA512
aee417cb7d4e1b8c046ff49b7f2d4df36b426b3d2cc645982da29eda742955d9b2896c9961f8afe4f7588b25ee4ad5d2eb3df8b4f8dd2fd3344fbd885d4729e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4bd6a9f0fc1f61144f6763f1852e8ed1

SHA1
09511de70fea9f2ab816ef334859610a7a833166

SHA256
2d7b5c75cf37518fb74094897a747abef1a3c44777e11884c26d7270e8f37dc2

SHA512
95a8150f8b91c738bbbd49594ba4c64d1559ae23de0e0084aaffc925bb04840b7b66bbb86adf835977975aca2d3b29ea3be9b3cb21fc2d760567d047ba8b27c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0baaf3d30d167eb735c24062ffbe742a

SHA1
c174b19fb4494db4e5b4d5af7f209c390663f4c9

SHA256
0b2b949c45a696a28f9c44f670e3876112592c1fd41c75fa3d5a80fb934ae5cf

SHA512
aefabca540d4dc9fc8955db1e9d9187cb556725591ba171148c21293e8887145449c1661ba4c462994a524f662694415f7c4536d3921f1eb02137f20e235f67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9004ae32c702b286410752273ea4890

SHA1
78cd27501cb6d0c86eaacdd2c4ca0a85146a7dcf

SHA256
07d90655b4a46c678269b1be68eaea5cf30ea5f09c5299c00da5e13cd3b1fde5

SHA512
b25f8bc3199728ee0521d161c97b5bdf96c0adda5e0ac172acb586f52b4f3b4824b6a98f61569b9dd6f172040b599fa99034586bda7890fed8867a142ac478ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53ecd8a81b7e5a61a4693371fb848175

SHA1
1f0ec9ff22a8ef70b47c89a5a934368eb349cde1

SHA256
c49eec11626650d1303ea599af843717408335d6220ecaa5f382e09a2641d070

SHA512
5f3f93b24a9875f04391786878f28bbe653bd64013b1c36f667f5081550d009516e87e89730e9a85d8b76a23d73db2311a86ae05688db4909e5533acaa66a453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c9d8.TMP

Filesize
864B

MD5
9d28277120a4b2dc951f6f585389e5aa

SHA1
f6d5829a80da3d5bfc26652498976177dab30694

SHA256
7f20e876193151ec8d974483b68410259bf88d2ebd2098da2dc7de5033bf6eeb

SHA512
41c58d8061a4228e569271186b83c8c7b5056cb911207ff5a439219283af7d6f94170ba36be129568911cd902b8d670696988afa4567b400b0c776be896c596d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c90c801f51bd2d082fcbcf2f186eda1d

SHA1
59c093f05f74c3df6cdf26dd83db142445a32ebf

SHA256
ce949a982bc2e5d3ef45847e2746d98ceedb3407de559ec164af06d3e3c9dd31

SHA512
c273bef4cf659e512d3476067baacdf3c74deac5b39c7817d9d0285b216607068eca08ce687a101486466b1c473ae0e6dc9f532855730255b620c29e369dfe3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8bef863b6c451e9aca1e4913d224e204

SHA1
9c3ed1962f0bd43e055fa606bf28398f94cb33ae

SHA256
890f492134cbdcee99837fdb189e787828217f2f43b06a13f9a81a940b16a35f

SHA512
68d5c6a2e60e89c75af45b34af5a4e8bfaaf4149b43022da704be3d91a8f72f96b2cc2d80e0f2552b9970bd55295c1f2dad4da0d807c469f51ffd970be1cec92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
912a8a6c168f14f6b5b7628ebce3db83

SHA1
0bd7b787eabc6395b6d0b8c2047c57e8dae8d595

SHA256
0f2a1b58260d34f6c41a90c9be5cb9e849bab3bc99e0802fb8b10f646f20d691

SHA512
b51fd2fcf07a069bdc7f5dfa7a5b22656377a0755e7ea912d3b1b4bbcfde4f98e02aac2dbc4b4b70bc725d3e50ea0875e8739d126141f73f17bf13c5339b54d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa3a5817d76063429d876869daa2ad98

SHA1
029afc5d167ae39a10b17cbfc72fb80b83d3233c

SHA256
b5d46c1c68c5b7634c5eef7e04e844be38b929455621c7b816650aa11349c66a

SHA512
14fb9666778c79a94e907a41fb487ef1095067ae07da5bc65cd36855c12d76188dd9e679469f1ccee49c8fce0eec6e40bef8e4347d4f124f04fcbc57e7972dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a740ec90d9874b488e2297e95ae7f87

SHA1
d53fc918e076c7e197580ff8653ce6dbd6e9c647

SHA256
d8fa9ddcc7675f2d75cf9466b4dd6801a47fbc669e8848913b7e8818c1cf09d6

SHA512
90437e48c9bed68be3cdf11aa8194d6f76d6813883c118c87e82620848fe6ff8040b4b0a1b73f151ab182862acae1a930cb98c3c36ffcf691060833025197472

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3761892313-3378554128-2287991803-1000\0f5007522459c86e95ffcc62f32308f1_1a4dc33f-c784-4d28-8db2-389663d94aeb

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\Downloads\Anap.a.exe

Filesize
16KB

MD5
0231c3a7d92ead1bad77819d5bda939d

SHA1
683523ae4b60ac43d62cac5dad05fd8b5b8b8ae0

SHA256
da1798c0a49b991fbda674f02007b0a3be4703e2b07ee540539db7e5bf983278

SHA512
e34af2a1bd8f17ddc994671db37b29728e933e62eded7aff93ab0194a813103cad9dba522388f9f67ba839196fb6ed54ce87e1bebcfd98957feb40b726a7e0c6

Download Submit
C:\Users\Admin\Downloads\Anap.a.exe:Zone.Identifier

Filesize
264B

MD5
389027c327ea6a1e0e8c2131373e20b9

SHA1
a7db9c635804f7cbf4d7b6b329a44226cd9608e2

SHA256
f72d48d622b7eaeaa8585f161dd8e06265dbf215cf46656d7ef8caf13f38e1ff

SHA512
c47d4e1ce04c83834e27151ea05ebd4884489c784e924fe382533ab745ef719cf68d9df5a70f79a240a3f3582704d1934e95885fbf7cc54fe61854ca67e3b7bd

Download Submit
C:\Users\Admin\Downloads\Axam.a.exe

Filesize
11KB

MD5
0fbf8022619ba56c545b20d172bf3b87

SHA1
752e5ce51f0cf9192b8fa1d28a7663b46e3577ff

SHA256
4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74

SHA512
e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb

Download Submit
C:\Users\Admin\Downloads\Axam.a.exe:Zone.Identifier

Filesize
264B

MD5
bfe7121eb02568125620c0bb75b64085

SHA1
7f005c2f8e50bf155f17e76cdac74afe26b1e810

SHA256
284abab6763eb2808c9fc94ca9b9d0b30ed92bcbe4f90c4ca03764fb970e71a5

SHA512
4b84b3958f0d35570a7bb4320b25737ace92c2ae5e0e4b0a6194a05f2ada91d9291ac658fdd5ac4b2d78f81ec4d893d1d959ac692f0694e729ced2eb3f9e5fea

Download Submit
C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 114990.crdownload

Filesize
10.0MB

MD5
5df0cf8b8aa7e56884f71da3720fb2c6

SHA1
0610e911ade5d666a45b41f771903170af58a05a

SHA256
dd396a3f66ad728660023cb116235f3cb1c35d679a155b08ec6a9ccaf966c360

SHA512
724ce5e285c0ec68464c39292be62b80124909e98a6f1cd4a8ddee9de24b9583112012200bf10261354de478d77a5844cb843673235db3f704a307976164669a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 390692.crdownload

Filesize
300KB

MD5
f52fbb02ac0666cae74fc389b1844e98

SHA1
f7721d590770e2076e64f148a4ba1241404996b8

SHA256
a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

SHA512
78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 54583.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 60218.crdownload

Filesize
50KB

MD5
47abd68080eee0ea1b95ae31968a3069

SHA1
ffbdf4b2224b92bd78779a7c5ac366ccb007c14d

SHA256
b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec

SHA512
c9dfabffe582b29e810db8866f8997af1bd3339fa30e79575377bde970fcad3e3b6e9036b3a88d0c5f4fa3545eea8904d9faabf00142d5775ea5508adcd4dc0a

Download Submit
memory/888-333-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/888-331-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1256-266-0x0000000005DB0000-0x0000000005DF4000-memory.dmp

Filesize
272KB

Download
memory/1256-253-0x0000000005180000-0x0000000005726000-memory.dmp

Filesize
5.6MB

Download
memory/1256-252-0x0000000000A70000-0x0000000000A84000-memory.dmp

Filesize
80KB

Download
memory/1256-263-0x0000000004C10000-0x0000000004C18000-memory.dmp

Filesize
32KB

Download
memory/1256-264-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/1256-265-0x00000000058E0000-0x00000000058E8000-memory.dmp

Filesize
32KB

Download
memory/1256-251-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1256-279-0x0000000005A40000-0x0000000005A62000-memory.dmp

Filesize
136KB

Download
memory/2336-541-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2336-570-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download