lokibot | ce7e05df71270d0aed71ab8af1de1f152fbdfeb10d781fe26e3f8c58c3fa899a

Resubmissions

08-01-2025 11:13

250108-nbnqyszlgq 10

08-01-2025 09:29

250108-lf7zaawpen 10

Analysis

max time kernel
31s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe
Size

345KB
MD5

9874f21e0e3ee7dd020434173334e191
SHA1

5a4a29b0980ea0b5b42da76d878102bf7a00807e
SHA256

ce7e05df71270d0aed71ab8af1de1f152fbdfeb10d781fe26e3f8c58c3fa899a
SHA512

88bf864d828a6dc1b5d4eb151e96d3032c4e4453fe50b377faf7670265e840105ca6f93c0dc710415695179989c437b5517722f796041cb70d0f842e6651ec23
SSDEEP

6144:XrydTW3AHIooGEArx3i6VaiGuBKIugXd2qP4XTMDV/xkAkLOoT:XGdKQHIoTEArDQNIugXd2qPaMDV5kvD

Score

10^/10

lokibot collection discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://secure01-redirect.net/ga13/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2396	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeDebugPrivilege	2396	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2428	2356	chrome.exe	32
PID 2356 wrote to memory of 2428	2356	chrome.exe	32
PID 2356 wrote to memory of 2428	2356	chrome.exe	32
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 3048	2356	chrome.exe	34
PID 2356 wrote to memory of 2896	2356	chrome.exe	35
PID 2356 wrote to memory of 2896	2356	chrome.exe	35
PID 2356 wrote to memory of 2896	2356	chrome.exe	35
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36
PID 2356 wrote to memory of 2696	2356	chrome.exe	36

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9874f21e0e3ee7dd020434173334e191.exe"
1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7069758,0x7fef7069768,0x7fef7069778
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2012 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1132 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:2
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2932 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:8
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2088 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2672 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1648 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2632 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2568 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2704 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3636 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3888 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2100 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1672 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2880 --field-trial-handle=1400,i,7481624262867121175,10314653439339386258,131072 /prefetch:8
  2⤵
  PID:2576

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
41KB

MD5
ca9e4686e278b752e1dec522d6830b1f

SHA1
1129a37b84ee4708492f51323c90804bb0dfed64

SHA256
b36086821f07e11041fc44b05d2cafe3fb756633e72b07da453c28bd4735ed26

SHA512
600e5d6e1df68423976b1dcfa99e56cb8b8f5cd008d52482fefb086546256a9822025d75f5b286996b19ee1c7cd254f476abf4de0cf8c6205d9f7d5e49b80671

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c9421509c5208fc68cd1983bf34adfa3

SHA1
024bf3fe743112c8d9e26a39353c0ba39dad8be2

SHA256
ed91f5c26c987c6113584d8f05c8f17a4fc796b61cf5267a1b7d7bf323bdce74

SHA512
4c68d28e34980ea27fe0d73368d5896dfe12a71b4ef16878ce2317eedd63c614c95c432d2deed11d6f0ee0b426d948e10afdcb524875d26141460ec06ba0e624

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
2e33ab2e4b2aa5cd9ac23f3a27503ac1

SHA1
bde14c3a707038a909089433382747dcd35f6bac

SHA256
d236c4786769b064befde16036a0919c10bf5d8511f2232e246e220d80b855d0

SHA512
024b5b6be3c7fe212514e6245163ca6f76df5f2728aaa7e1c9802252843ddeebda5e9d407bb09e5d4cc3028530eb600118ab308b6a23be824989ac11476c25ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
a5fc97a49bddcd5f541bb80527d91052

SHA1
a43e57b6cb8403571c65804a492b133e944bc9db

SHA256
d01dc528897f19e9d06f2e92281aaf5d96e62ba6ce9f2069ce19e51aca227ad2

SHA512
3a35e50bd0357aacf44808435aab0d009ee35c9f92b174399b9d11d7cb405f1ffaca7f3a87ffb3afc1c1c423d6781c09e64851b53f6690f7d8305e6a4344940c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
61f3321a1b3bc45b8f306bd2d30ced97

SHA1
c70a0ed4856f4bc9ae52388fe9bcf7b7eac4b741

SHA256
55507a6d9324470fe7d191592f7c8bcf782ec4cb2d653f75e6766141c17da99f

SHA512
d7c7486843e92bd95085352cad0ae777669add767187e75fef72be1a900c4b75cc1dd01ee8f3654334d17c619ea8e23d8c938f96a8f55bb739c86153fbe4e86a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
028a3e8ba0554622473d4614cf1cdffc

SHA1
737aef778884b3c9a5a312a370186786c101fff4

SHA256
836ce06ab0ef62af14c88c9248f49ece98eee7680720f469a4b19e5288ba614c

SHA512
7e9f7d0e332a002dd7f6d72a70f52c44270d8845da7a48bbfa0f8f9a6883daa4d6df3df3f3854f034f4fd2356a55a41602bf9f8d375e9422a28a521b4278f94b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a7616e5578fdd9bc7b370ee25588b214

SHA1
1e1ffb528c039db7fa7b04a780adf7605697e936

SHA256
2791d4cb42b34e10f8f10290d0d7186272bcc58a710bb4a1af56fbdc48ca2ecd

SHA512
06bda29a627ee4753224559edd4a09bd689a9805a3fd649f518515cc44cf399381291e6b15a24e95520aa6350c0dda282152c86dbcde8abdf23d3703eef22912

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5dde885b20740b2ae34e98c0592d03f6

SHA1
769ff5805d247d58903fcf6e06067c1153a97a09

SHA256
b388aa98ea7575d31091893f22fd5a984e65c912832b0540fdb757737d40d591

SHA512
8e34a5cfac5864e179689edddcc5a5857ce3713239cb836d9c4b6df4b4d2a6f062cc3a81f94bca0f24b2a2aa691c7ee65aa48f4100a8fe6ccd3d9c4d474dfb42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5d7623c3fb51e62af2e742f3dbcd027c

SHA1
323fb0d97dfc5889a5233090ebfa31b5b71c4746

SHA256
5b3f8e8b043ed01ae6816cda015eea4ea8c24cb4048510411851af1fc79528f9

SHA512
b265b61d388bd113369964abc0b17a6af1240b4a62713ee42fb3b89c5925a8fe1b0df72c50032ca50494994b270ad181f48bcac33d71fdc5c7b8587d2926ed04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
354KB

MD5
a2d3a6d1567be2a23e9a4ebeb98aaa7c

SHA1
bc04be2b58397e7227f77810af39ead64784357c

SHA256
6bd01b233a734789a21c3e3fdd5f53fa201da8b2d13a57f5ef2c5a66eda1d70a

SHA512
ff07323ea8964a8a8539ec8c3402189fc3e64841b1ee53f40ac5a0199b19c572070e8d58f493c8f3a1e24e05047144bc9eed5d0eda48171ee3a8d202fe21e7b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3A6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD3C8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\0f5007522459c86e95ffcc62f32308f1_9d81b961-0275-4281-8321-63119951606b

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\0f5007522459c86e95ffcc62f32308f1_9d81b961-0275-4281-8321-63119951606b

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
memory/2396-86-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2396-87-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2396-198-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2396-81-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/2396-2-0x0000000000020000-0x000000000003B000-memory.dmp

Filesize
108KB

Download
memory/2396-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2396-1-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download