lokibot | hxxps://github[.]com/rojikofron/boyufronjs/blob/main/README[.]md

Analysis

max time kernel
187s
max time network
188s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-01-2025 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/rojikofron/boyufronjs/blob/main/README.md

Score

10^/10

lokibot agilenet collection defense_evasion discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot

Downloads MZ/PE file 1 IoCs

flow	pid	Process
58	4644	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
2988	Lokibot.exe
1936	Lokibot.exe
852	Lokibot.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2988-826-0x0000000004F60000-0x0000000004F74000-memory.dmp	agile_net
behavioral1/memory/1936-857-0x0000000002A20000-0x0000000002A34000-memory.dmp	agile_net

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
22	camo.githubusercontent.com
41	raw.githubusercontent.com
58	raw.githubusercontent.com
11	camo.githubusercontent.com
21	camo.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 852	2988	Lokibot.exe	108

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 981045.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\dnSpy-net-win64.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 378251.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4392	msedge.exe
4392	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
2652	msedge.exe
2652	msedge.exe
3188	msedge.exe
3188	msedge.exe
2988	Lokibot.exe
2988	Lokibot.exe
1936	Lokibot.exe
1936	Lokibot.exe
2988	Lokibot.exe
2988	Lokibot.exe
1928	msedge.exe
1928	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	Lokibot.exe
Token: SeDebugPrivilege	1936	Lokibot.exe
Token: SeDebugPrivilege	852	Lokibot.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 988	4392	msedge.exe	77
PID 4392 wrote to memory of 988	4392	msedge.exe	77
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 864	4392	msedge.exe	78
PID 4392 wrote to memory of 4644	4392	msedge.exe	79
PID 4392 wrote to memory of 4644	4392	msedge.exe	79
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80
PID 4392 wrote to memory of 4840	4392	msedge.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/rojikofron/boyufronjs/blob/main/README.md
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb516d3cb8,0x7ffb516d3cc8,0x7ffb516d3cd8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Users\Admin\Downloads\Lokibot.exe
  "C:\Users\Admin\Downloads\Lokibot.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- - C:\Users\Admin\Downloads\Lokibot.exe
    "C:\Users\Admin\Downloads\Lokibot.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=876 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7948 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,4387095883647013977,10365080782297927722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4776

C:\Users\Admin\Downloads\Lokibot.exe
"C:\Users\Admin\Downloads\Lokibot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe
"C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe" C:\Users\Admin\Downloads\Lokibot.exe
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Lokibot.exe.log

Filesize
425B

MD5
bb27934be8860266d478c13f2d65f45e

SHA1
a69a0e171864dcac9ade1b04fc0313e6b4024ccb

SHA256
85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

SHA512
87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
37KB

MD5
5873d4dc68262e39277991d929fa0226

SHA1
182eb3a0a6ee99ed84d7228e353705fd2605659a

SHA256
722960c9394405f7d8d0f48b91b49370e4880321c9d5445883aec7a2ca842ab4

SHA512
1ec06c216bfe254afbae0b16905d36adc31e666564f337eb260335ef2985b8c36f02999f93ab379293048226624a59832bfb1f2fa69d94a36c3ca2fdeebcdc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
4fa02ac6347763639aeb01d8adf287b2

SHA1
8cbf6b37f0cd329ba5b4f4f59437c55dd3057b37

SHA256
ec23a39504c8b289a6401723dd1a5153e9072e5f5beca20f88fac54ed3a477d9

SHA512
371e4b42152c578090254323dd4846df1ab38ac6bcff8ed6b67143dbfa5111c72e64366ac24b6ac04f3c405ce22e5f50f2a04e1805cce8b22ee8b95139a53afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
99c59b603e12ae38a2bbc5d4d70c673e

SHA1
50ed7bb3e9644989681562a48b68797c247c3c14

SHA256
0b68cf3fd9c7c7f0f42405091daa1dda71da4a1e92ba17dad29feb00b63ef45f

SHA512
70973ea531ed385b64a3d4cb5b42a9b1145ec884400da1d27f31f79b4597f611dc5d1e32281003132dd22bf74882a937fc504441e5280d055520bfca737cf157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
525579bebb76f28a5731e8606e80014c

SHA1
73b822370d96e8420a4cdeef1c40ed78a847d8b4

SHA256
f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

SHA512
18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
58KB

MD5
1a66e7a04fd75b4124dbf84649d62e3d

SHA1
6cf9ee430ad835cae431132b306739f819834116

SHA256
f817e171b8d013945d336df3c6339bcf4999835e05197be2b3ff698081a997f2

SHA512
1f3b3231459ba24f8146582c81ce2929c22d27c97e1a6cc19d93df0ce78bd4d13927729ec50f1269f3ca5cc41de2764245706c785dd34afff668688e586b1f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
18KB

MD5
0346ebe73b21667ad74c6e0583a40ac7

SHA1
4c75eafd2ac666700a1e7a36845ef859b1e8131d

SHA256
9df525b3192d1c859c90a82abbab4b5de63662e1374de09fbc381b55729a8d3d

SHA512
e27348c6f0f91f8f06d7bf9d3c5cb4b15d2cd7a0f8badc4822288bb63b740985798c96fbbbf1c30d67c59c58f08bcab5316f85a0d4876b67c27172db1a2c4e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
40KB

MD5
fc6557bdffc2399eb502eeec4df611e2

SHA1
8f6fc12ed1845ed2a35cde58d52039ed115e5998

SHA256
f94fcabd54d4796021377453a74f72753e70225e1ed81ca8b2044c2fef9b27d5

SHA512
447abe0ed097dfd6b4cd3961ad3e0bba5e7561d8aed270325227c9a3405a83e7988fbaea3577cfe5d721ecf9966275bcbd5459a2bbad4349429dc90b4d106665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
53KB

MD5
2ee3f4b4a3c22470b572f727aa087b7e

SHA1
6fe80bf7c2178bd2d17154d9ae117a556956c170

SHA256
53d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799

SHA512
b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
65KB

MD5
260264be97e8c5e4291b9160fe452cbb

SHA1
03124b906432244113fd4583558d93858e7f1868

SHA256
1ddbe9819c06b3214c10d6d6333f8d30bd007d503d25da1c28c61ea540d41eb6

SHA512
1eeb088867ade8b255affd3284badc767aca5cd45b81e93eacce2599c445725091a4e25cf582cf279924b9269f4986a2b2e8a0223949d860b646a5c47e429233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
107KB

MD5
299ca95cc038a95290e1110e037c96fa

SHA1
cb9cbfd904623ab7287bb019c0eb0c48bfe5a4e2

SHA256
9847c0208b4c74a399438b062467820f9023534a5358fa5d6b28a4b0c18d033d

SHA512
6b61806258b2a02aa968c0ce55429adf5727af4420547532c9db10ae832f1e3abbf70d08f6c69e590d1823b6699685b0c153314ce113bf85d346f4dba0c97cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
16KB

MD5
1364101ded1889e3918dbb0e8fa5324e

SHA1
5bfb724d497c1033bd37073e6d2bb4bb6b5433ad

SHA256
310b6eb28fbb33575ef7da7793b6661abbbedcb9d3ff1e1a1bae3b8138667eb6

SHA512
4e3ac33b0dc4ce859e26841fd13e4a9f72b990f31d4c65ceb60ae7ae301a72dcc6c0e7296e5625afa0d58442d301079297d4708d1686111041243922c561a8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
26KB

MD5
c9a44eb6dc1c77a9a2d988768c9fd5c9

SHA1
f352d7ed33ff0d8361be168a6b5300288d91ef78

SHA256
675b4a74249edb71579147676a8115b662a915db9fd24fdfcaebbb0d7618c62c

SHA512
81534ba808f32ade00a81349612c9b905914004c3a8d7e53e9993170ab5957600dd49d9881284541240181987ffc76208acedfac24bc1e8d33c99f003c65fbff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
2506350b4329df752b6405f5fb9de051

SHA1
984c45294a5d5b4662416b3047196f0f8db37d99

SHA256
3861924f89634dd268ab7958b890b3d1edbb29751d55d7c24f59dda51984bb24

SHA512
573bdc0abdd4adb0be18bf1cd67ce421d87a282e3bea8a5336be145dc0c32e078f12534f91cff1240dfea42d403be9eb6af8ed6eb215a4218a2ad2a57216e159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
266c960d2e0e29dfa3513fe73b01b956

SHA1
0cbaca12579125580a2f70c69d1c1d2b3c0e4d2e

SHA256
146304fbaebb095236df3dda4c7be06b793bc3990289113b814882501544efaf

SHA512
97ddfff179c65b8d6d599f9d62c87071830df15b918892635277537a4a48569075a25a880f748ec4f7b75843a4f952c65744b81f8b5aa743363b073343e22133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2aaab18a62aaca6eaa70576f209aff21

SHA1
fca4ab453c35b448edaca8e76bebe3fc7f99c319

SHA256
9fb4a1aa190e54c7840c22134a8a64e141998d4f8ea561e33d4d47effbaaea23

SHA512
9385f22311b464c912be9292793ec659b21098c6b0224c4248eb66855ced6ef7c79276dc40fed63b603b975bda4bba0d322aea6299fe60dad3e256095dde90cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5fcb8585fc8e7c9bc1817608119513a3

SHA1
2aefbc19bdfb9dd841e15479281ad0e6a8a86145

SHA256
03f2069c7573a27f20aceb568e2aa5479324f28bbb79d7f9403e771e79e90623

SHA512
32ea11f5ef264cbdc60b6acdf3221207ad26d8a8d3f2fb7aef6a5e5124b881ea3d12eeba5f3edd061199e214f81012d66c8e514a99f02adc4f69ed9c0c5698dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d8e6c2a12391a8dc42a5d041db91a2c7

SHA1
399efbc742361b79105a70109a1f6d109c07f966

SHA256
1ced55a687c9553f7cf5a66bab47c0a637ac9add2d3e7eb4ef79f93d82b20715

SHA512
463a4c196659a0cfad95c345c70e4b3738cdb363a1221d875b0640300743f5b55dda4601d407e0672559071a78e82b09819c2397b39836ef66f04c8fab46d868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
409ed98935f6c98b3c06cb1dca089e03

SHA1
a8aab6724d5f8015efa47f1fe64406e1cea346dc

SHA256
8503dba21c30d043bcaf34644f6b967b3160e42ad9681018e7636ac8be664ebd

SHA512
d1f4c3da9df30398ae8eab8d6f833c87db69b578a571e08d1ce811020b36d8f9d8753e7a1e93b53714d5f40e148d154237007f9c6ff202aa9fcd304a184c8706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f83ae420be034260f43b302796f5755

SHA1
5154a5ac6d9be787c41ba0a26f327b0661f12632

SHA256
bbbf2e5a811f8f37365360df3e88b97334382b0c1f3ad5a5998a4da5e60a7a2e

SHA512
a643f0db61e6c7b7d84447b6b061aad8991b6f12cff359fcb347703388fe39b7f5c539f5495a42af2c9b0c72ad6bdf76d36a9de9600a6fc583b879a263d3424f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
536b1a2aa0010aa5a961e5202495944d

SHA1
e6afc1d0ce341d553eb0ac18efcd6d057d858332

SHA256
1e66d48cdccfa5d046b1b3fd5b099ebc4f0c68f5d2bc3dfbc6a78159fe9a30be

SHA512
926c21316d6129d62ed6d532ce90f85a55cb7194936fe55c7cdb82ae21c791f35b08f37345fb70ba12d0a9f8e01fa76b0d0e950917e482c0568a10f34dfea7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8e59291290590d296a60abac24d5411e

SHA1
08cc783d8cdcd6e5382c835bb6508d7b8821f066

SHA256
1e1e5e21f86b2f73f3eb92753a9776a8fa81cc3b1075da1145308180650641e3

SHA512
581e2eef0ea9cd6796cad122cbfbac2d452a438aa8f6b5ac686e3ba3a76f20755a4b3ec1688ddbb0daa24d82d8e58e920f3d066bb9be3b419959e12550b269a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
eb9b53cd14bfe23b0b70f808f08aed1d

SHA1
28f691aa5da18e2648f69395ebeca2bd39442fa7

SHA256
1b9d724d46452256862dad3234dc5e418701076fe142930e2e17d33f25ec84cb

SHA512
9cd1a1f36707225fd68da1752643a46d740b23dbc69395b4bae24f1b64dc240904e0247fae9ac88ddec03f02907b55e9e7825adca8e02d813e3f75508402fda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a636591a3d320ff272b0fd492cdd5ca8

SHA1
57752d8635c35aad9412893e662911e71ac1f485

SHA256
ee0767721669bfac021e071944b57bd9704ee8f0d5be50124b52757a1dcb5439

SHA512
d09e8d116c29d223b2542d3d3e8575aa5b9dcdf8afa4eefdf9280a0e2ea5fe7481320e21a67f5e37d93566e70c326e358032978ce7343087bbca1733dfc706a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1f2cb5fc91251a650f77c125f4665a71

SHA1
cdd3389baa4cf5ae6c2ec972eaccf75644893a0f

SHA256
5d3ecf6edc5442856aa997129b9d9e41c88e624a674dc7ac24056e4a12545a16

SHA512
9902633cd8b5edfa180f0a32a74dbf046409db59b19a03f4fad65c344f97007caa7c975f0fd14c92602d2c189b5345b477506e406d808c977b50bc12b10122c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5a7d7903dae4dfa755367e337b18cfd6

SHA1
98e7dec1c4493eb3ac4116e35d2b77d244f99cec

SHA256
aa0d6952dd00d5169d1bac23426fb4fbb2db0e698ec2fcc6cac7bfccef1e37c3

SHA512
96935cc90dd4c86fe4c23bed10d5ff60a333921ff21dc5c5822f4c96c58783a3e3294a8b3e9b04acb1ece3ccb4c74f1eb1447ca09d08b077035de0a80cfaa14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dc5f04a43e49a36ca8ea1b765066c506

SHA1
e911ee8b8fd431d173a104e214d4874d641d3bd1

SHA256
d7b36f61d77a8f0d88a964214f06d0837564d7d4369f03934c99db16b738248d

SHA512
2f9b7db4c0c420ede04171860cb46bcb96591f07ef4771db068eb115452e139eb898525d9ebc2fa1c889d3e8605ba4a99384ac8fcc20fe8517a2272b9b7d7ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dc2fc0673ee390db701efe9917b46b99

SHA1
60907f54c474477f52bb646de465d1efe96c8382

SHA256
888f5c986425f14cbd41d62d0cd387f990271ca0f88ce2836bfb810c46453819

SHA512
47f08a5292f12297c8a7559b3b995c0b5eb9ef969ce5d4093eb8e37e068bc7f97909678c1ffa2275881caefb92706dfb2d27a53f47e47a1cfceaa06f39648560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4ff.TMP

Filesize
1KB

MD5
bccedfdd02b43c04ee2cb5dc72923c31

SHA1
cc02117876972fde47ddedf3d31571df71659765

SHA256
b657a90ecc44a032e586cf817fa8ec6655daa5310fda3e63bfa5263498793e1b

SHA512
c8eb70b51906a083f03a8f2564b3db4cd1720de82e623d96071f135516b5d70217d19809d56dc10f35c2240c85c4bccb2bf86ba7598791842051668ecc957f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bcf41776-f3ca-4073-bfcd-94b9f1a0c38b.tmp

Filesize
2KB

MD5
9b4762affc22e920dafef8a2e940ad6c

SHA1
f682f84a006541d3c49a24d355b144f2d2b8d33e

SHA256
08b8eb531e7d99e8ff53638fb5b45a3e8756ff07e1076f95ab4353ef4a825fc0

SHA512
92b3fc8706e2df0e05726568b675d04673fc4bf487ecdd04c7a24812453b8fb74d561dd1ef14a9549aa61d70a08410499740785308e142e457014116a683f821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6f5e4e1-d4f6-4c6f-ae2f-d577cd658195.tmp

Filesize
7KB

MD5
b9f359e82418980dc76b34275af9d694

SHA1
6b017ca53f7830f526604d7d632bcd848748ade8

SHA256
487a6a17466afaffa5067510b848033d742fb0e92d78fc3ebf069dd74af106e5

SHA512
1a4b380f0a5e1d686b64f1a87e27e23e195522e2243c3ba8659cbda7e9c3dd029a3fc4bc015855f0d0d8e8ab9a514d8d6da7a6bdc2086c60066e2992ed43c0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2ed9190d4b43e11c454d953b662cc4f0

SHA1
00a3049f38ee2227385e603ca6fcd58806834034

SHA256
a6b0d89ef817a5a1b1d7c37620514810da1c5be87332e69edf8def693d3670f9

SHA512
56e42bd9dd5ac806b836f9af44929b31bc8672d022e31846e3ea484a31494db679341af8b859d46903e28613288a41ed5dc486afc704850368a2553195f62f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6bd7b5084a81a0da7d6ea4a103df77fd

SHA1
cbf374296d2942634acd17fc474e4094f2ea0d58

SHA256
4c79829c5474b74b26ac362adf7e845812477edd0f16d9703a4dd436a420771d

SHA512
661c1e96e1a80d1c61dda51b5e2722257f1d3d6f08c58b4f91e3e819e29ef4d4399c71779ae5a71541eceb7e8b3b4be8e944aab4865d7c5db6111a97e4c808cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
53ce73bb85c5bf21b4acd7a007a99072

SHA1
fb0f0d55013dae47087105ffc6987517acc04501

SHA256
8ecf1021f809490b8f992fc33236d716b19f74ef282532e8e5e873fa02a10703

SHA512
13496f47955f24e67e693bae8f8a7f1e4a5f3d9d21b783555d9b06837870237f5b1c7ef490eef5ee3570458143f989cecf037899ac66b98e269d1b0f30ac99cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f5aa689e6945b9152371b4613c6bfcb3

SHA1
3928253aeb17f5ed5bbb4ddde5afa4bcb36c9ca4

SHA256
eec9e8c413dbaa82868e3f93dd17855e59d17a52d353fd7f4a68442fcbc715ab

SHA512
9d7f03eab6d85580147a1d27a02af44b74b5d2f3183812fd54a7566f6361a50750c718c3e7b5b861ccf6bb42b3f6e58a06229aa64ed3d2ce9eeda710641c1ebe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4249425805-3408538557-1766626484-1000\0f5007522459c86e95ffcc62f32308f1_02510207-a8a1-401b-a8b2-969e44fe3fef

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4249425805-3408538557-1766626484-1000\0f5007522459c86e95ffcc62f32308f1_02510207-a8a1-401b-a8b2-969e44fe3fef

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 981045.crdownload

Filesize
300KB

MD5
f52fbb02ac0666cae74fc389b1844e98

SHA1
f7721d590770e2076e64f148a4ba1241404996b8

SHA256
a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

SHA512
78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

Download Submit
memory/852-1208-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/852-1205-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/852-1226-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/852-1362-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1936-857-0x0000000002A20000-0x0000000002A34000-memory.dmp

Filesize
80KB

Download
memory/2988-826-0x0000000004F60000-0x0000000004F74000-memory.dmp

Filesize
80KB

Download
memory/2988-827-0x0000000005640000-0x0000000005BE6000-memory.dmp

Filesize
5.6MB

Download
memory/2988-833-0x0000000005630000-0x0000000005638000-memory.dmp

Filesize
32KB

Download
memory/2988-834-0x0000000005DD0000-0x0000000005E62000-memory.dmp

Filesize
584KB

Download
memory/2988-825-0x0000000000570000-0x00000000005C2000-memory.dmp

Filesize
328KB

Download
memory/2988-835-0x0000000005EF0000-0x0000000005EF8000-memory.dmp

Filesize
32KB

Download
memory/2988-836-0x0000000006280000-0x00000000062C4000-memory.dmp

Filesize
272KB

Download
memory/2988-975-0x00000000062D0000-0x00000000062F2000-memory.dmp

Filesize
136KB

Download