Analysis

  • max time kernel
    428s
  • max time network
    429s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250207-en
  • resource tags

    arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-02-2025 18:33

General

  • Target

    https://archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201903

Malware Config

Extracted

Family

lokibot

C2

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

  • Chimera family
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Lokibot family
  • Renames multiple (3242) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Downloads MZ/PE file 7 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 26 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201903
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86574cc40,0x7ff86574cc4c,0x7ff86574cc58
      2⤵
        PID:408
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1788,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=1784 /prefetch:2
        2⤵
          PID:2080
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2052,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2072 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          PID:1140
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2128 /prefetch:8
          2⤵
            PID:2536
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3112 /prefetch:1
            2⤵
              PID:2948
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3260 /prefetch:1
              2⤵
                PID:3824
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4280,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4364 /prefetch:1
                2⤵
                  PID:696
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4588,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4548 /prefetch:1
                  2⤵
                    PID:1968
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4780 /prefetch:8
                    2⤵
                      PID:2972
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4904 /prefetch:8
                      2⤵
                        PID:1012
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3404,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3340 /prefetch:8
                        2⤵
                          PID:4596
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5028,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5092 /prefetch:1
                          2⤵
                            PID:3388
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4340,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3296 /prefetch:8
                            2⤵
                              PID:904
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4332,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5240 /prefetch:8
                              2⤵
                              • Modifies registry class
                              PID:2100
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4424,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4440 /prefetch:1
                              2⤵
                                PID:3848
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3208,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3224 /prefetch:8
                                2⤵
                                  PID:392
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4364,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5336 /prefetch:8
                                  2⤵
                                    PID:2864
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5476 /prefetch:8
                                    2⤵
                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                    • NTFS ADS
                                    PID:2100
                                  • C:\Users\Admin\Downloads\Lokibot.exe
                                    "C:\Users\Admin\Downloads\Lokibot.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2140
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4472,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4628 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:656
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5280,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=736 /prefetch:8
                                    2⤵
                                      PID:4884
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5552,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5724 /prefetch:8
                                      2⤵
                                        PID:2408
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5492,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5584 /prefetch:8
                                        2⤵
                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                        • NTFS ADS
                                        PID:4696
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5516,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5876 /prefetch:8
                                        2⤵
                                          PID:3760
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5388,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5712 /prefetch:8
                                          2⤵
                                            PID:4876
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5676,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5688 /prefetch:8
                                            2⤵
                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                            • NTFS ADS
                                            PID:4636
                                          • C:\Users\Admin\Downloads\HawkEye (1).exe
                                            "C:\Users\Admin\Downloads\HawkEye (1).exe"
                                            2⤵
                                            • Chimera
                                            • Executes dropped EXE
                                            • Drops desktop.ini file(s)
                                            • Drops file in Program Files directory
                                            • System Location Discovery: System Language Discovery
                                            PID:2076
                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                              "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Downloads\YOUR_FILES_ARE_ENCRYPTED.HTML"
                                              3⤵
                                              • Modifies Internet Explorer settings
                                              PID:3148
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/Downloads/YOUR_FILES_ARE_ENCRYPTED.HTML"
                                                4⤵
                                                • Enumerates system info in registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                • Suspicious use of SendNotifyMessage
                                                PID:3620
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff850813cb8,0x7ff850813cc8,0x7ff850813cd8
                                                  5⤵
                                                    PID:656
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
                                                    5⤵
                                                      PID:4416
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                                      5⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3368
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
                                                      5⤵
                                                        PID:1236
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
                                                        5⤵
                                                          PID:4032
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                                                          5⤵
                                                            PID:3492
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
                                                            5⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5408
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
                                                            5⤵
                                                              PID:5604
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
                                                              5⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5636
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                                                              5⤵
                                                                PID:5892
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                                                5⤵
                                                                  PID:5900
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                                                                  5⤵
                                                                    PID:6084
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
                                                                    5⤵
                                                                      PID:6092
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2192 /prefetch:2
                                                                      5⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4020
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,13977631888158484658,12049797431716764154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
                                                                      5⤵
                                                                        PID:4336
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5684,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5344 /prefetch:8
                                                                  2⤵
                                                                  • NTFS ADS
                                                                  PID:4420
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=3720,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5964 /prefetch:1
                                                                  2⤵
                                                                    PID:3868
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5624,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5612 /prefetch:1
                                                                    2⤵
                                                                      PID:2860
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6008,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5804 /prefetch:8
                                                                      2⤵
                                                                        PID:1508
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6020,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=6036 /prefetch:8
                                                                        2⤵
                                                                          PID:2596
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5888,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=6064 /prefetch:1
                                                                          2⤵
                                                                            PID:4876
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=5660,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2056 /prefetch:1
                                                                            2⤵
                                                                              PID:4904
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4440,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3144 /prefetch:8
                                                                              2⤵
                                                                                PID:1508
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6176,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5380 /prefetch:8
                                                                                2⤵
                                                                                  PID:1448
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5640,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2972 /prefetch:8
                                                                                  2⤵
                                                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                  • NTFS ADS
                                                                                  PID:2092
                                                                                • C:\Users\Admin\Downloads\7z2409-x64.exe
                                                                                  "C:\Users\Admin\Downloads\7z2409-x64.exe"
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2092
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5772,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5596 /prefetch:8
                                                                                  2⤵
                                                                                    PID:3404
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4404,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5852 /prefetch:8
                                                                                    2⤵
                                                                                      PID:1488
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3156,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=6252 /prefetch:8
                                                                                      2⤵
                                                                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                      • NTFS ADS
                                                                                      PID:5848
                                                                                    • C:\Users\Admin\Downloads\AgentTesla (1).exe
                                                                                      "C:\Users\Admin\Downloads\AgentTesla (1).exe"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5392
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4448,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=6232 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3000
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6236,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5372 /prefetch:8
                                                                                        2⤵
                                                                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                        • NTFS ADS
                                                                                        PID:1492
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6024,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4640 /prefetch:8
                                                                                        2⤵
                                                                                          PID:5756
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4368,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=5016 /prefetch:8
                                                                                          2⤵
                                                                                            PID:5780
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6300,i,14083019418384752637,14461339192063182284,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=6316 /prefetch:8
                                                                                            2⤵
                                                                                              PID:5768
                                                                                            • C:\Users\Admin\Downloads\Aurora Worm v1-Cracked by RoN1N.exe
                                                                                              "C:\Users\Admin\Downloads\Aurora Worm v1-Cracked by RoN1N.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:4704
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lsvawwcb\lsvawwcb.cmdline"
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:6000
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEB8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8088530FC5D44DFAB182EC2906DA78A.TMP"
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:6024
                                                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:1776
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                              1⤵
                                                                                                PID:2752
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTgyRTE5MzMtMzRFNi00QkFELTgzMjQtRTM1QzU4QTY1NEYxfSIgdXNlcmlkPSJ7OTk1NUI2QUYtQUQxOC00OTY4LUE3NUYtMUJEM0JDRENGRjFBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MTM2NjA3NEItMDQ0MS00RjI0LTk4RUItMTg3MEFFODk1QjYxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1NzQxMiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDMwMDQxNTY3MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNTY4NzYyNzciLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                1⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                PID:656
                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                1⤵
                                                                                                  PID:2812
                                                                                                • C:\Users\Admin\Downloads\Lokibot.exe
                                                                                                  "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:2284
                                                                                                  • C:\Users\Admin\Downloads\Lokibot.exe
                                                                                                    "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • outlook_office_path
                                                                                                    • outlook_win_path
                                                                                                    PID:2952
                                                                                                • C:\Users\Admin\Downloads\Lokibot.exe
                                                                                                  "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:2212
                                                                                                • C:\Users\Admin\Downloads\Lokibot.exe
                                                                                                  "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:1960
                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                  1⤵
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1560
                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                  1⤵
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1916
                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:2788
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:5228
                                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                      1⤵
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:5848
                                                                                                      • C:\Program Files\7-Zip\7zFM.exe
                                                                                                        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\smb-qua22o4u.7z"
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                        PID:400
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML
                                                                                                      1⤵
                                                                                                        PID:2892
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff850813cb8,0x7ff850813cc8,0x7ff850813cd8
                                                                                                          2⤵
                                                                                                            PID:948

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          MD5

                                                                                                          372d1b7503d762128fe6cfa95cb5582b

                                                                                                          SHA1

                                                                                                          e377b3749c381d775cb39995e3998eda2107cbc5

                                                                                                          SHA256

                                                                                                          546be83b367d07c6ab14fc6a71b7e534392b99393a0067bdd326efb8e39bfcd9

                                                                                                          SHA512

                                                                                                          f49d82fa26da608b188df08792ba6c2b4311274fed2c95ee7882214c4cd69b32dfb136ac8a59641a2fbebe69b81888fa495b1aaa619f09b68dd3c8eee546525c

                                                                                                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          MD5

                                                                                                          b5ad5caaaee00cb8cf445427975ae66c

                                                                                                          SHA1

                                                                                                          dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                                                                          SHA256

                                                                                                          b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                                                                          SHA512

                                                                                                          92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                                                                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                          Filesize

                                                                                                          4B

                                                                                                          MD5

                                                                                                          f49655f856acb8884cc0ace29216f511

                                                                                                          SHA1

                                                                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                          SHA256

                                                                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                          SHA512

                                                                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                          Filesize

                                                                                                          1008B

                                                                                                          MD5

                                                                                                          d222b77a61527f2c177b0869e7babc24

                                                                                                          SHA1

                                                                                                          3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                                                                          SHA256

                                                                                                          80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                                                                          SHA512

                                                                                                          d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          5a31a5bf57cb8717bd2f360a78e9996c

                                                                                                          SHA1

                                                                                                          82534128acb068cdf2f73cac92856ecc5985ae41

                                                                                                          SHA256

                                                                                                          5540c71cd6ab8ffd46440e226a7c933ff0e5c6baeadfa4e20eb9bf892cb1a2f4

                                                                                                          SHA512

                                                                                                          340cab6192357469d71413574230c7580f2e4f4e768e0d6135e0cc6bda619bba3ca801189865bc9ba16a86031f27e17d3f39b21810d7f1d5979709472c8d9e04

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          cb492543fe2b0b3051e41a9dc132bdd0

                                                                                                          SHA1

                                                                                                          2ea01f9dbceb08fc513eea8323665d5145b1ef7b

                                                                                                          SHA256

                                                                                                          068b0a1a24ce1a79399eae07ce75fb1fc06fee14c65888855079bd9d5b2d68c1

                                                                                                          SHA512

                                                                                                          6919b44a8ec81b0176a96640f996a3fc4bfee7b851316fe7578e083f2d1fe364d5e5ef92f8aaec38487157ff8a8561c38c1fcdfc3eb49cf50137ae18ca9f3c72

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          MD5

                                                                                                          1ba4a1da0cb95cc146d76dfa4d21ecb8

                                                                                                          SHA1

                                                                                                          4a0f7889a4f2636743746f313ee9ef94a225e5a7

                                                                                                          SHA256

                                                                                                          871260ba0248cbd6cfc6d0994695e54383a8ac73cca8ba5c3905e06b996ae92f

                                                                                                          SHA512

                                                                                                          278cd5354142d56972f4c40fa9ffb7a2a013632408841fd1bc2969b4a2ef840a5e927c1458335da35673e964a8a0c707a38c6c57599145f8f3c19f422cf537f0

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          20e1134be1011ce0e1a117b6875dcfda

                                                                                                          SHA1

                                                                                                          d6bff2bbb6de12e824b75e63ea8d8ef6ec26a85d

                                                                                                          SHA256

                                                                                                          5dce5e550aa4e8b20438e37484b614d9414596fc92f1674df570f0e2de2c4983

                                                                                                          SHA512

                                                                                                          94329daafaa9ebfad9dd42e368b35f072cbe12456e2df51326eced827a96b68291e94662a10494d7f14b266033ef72c99d4bd19840c5301173b0350d9d4183ef

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          c82f9135e98323a7f2667df4912b2d79

                                                                                                          SHA1

                                                                                                          ed83057b2bd9d3ea5d6558c9d6d4f25c8db2dced

                                                                                                          SHA256

                                                                                                          bfe7adf1bfed10601ed8ee3183ce60bc5c41a5c2f0de8845b52dbc301373fd71

                                                                                                          SHA512

                                                                                                          202d9400a1a3175524c55c89fee6639d5937eeb593e95363f82149e513e9046c10b01735e5ecde29424fab469fcc56f89bc54fbde49964ccf068a4fce9d9cb44

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                          Filesize

                                                                                                          2B

                                                                                                          MD5

                                                                                                          d751713988987e9331980363e24189ce

                                                                                                          SHA1

                                                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                          SHA256

                                                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                          SHA512

                                                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          8bf8add492d23d38c91b40dc87b16fdb

                                                                                                          SHA1

                                                                                                          58d08886f9c3a122d137a793889048ba91dad9ad

                                                                                                          SHA256

                                                                                                          e3c6f506f256233c50c88a678a35526d930b4c4f8a1d85197542fc1ec43ac74b

                                                                                                          SHA512

                                                                                                          5af3aceba3fccbabc14f5742e7bf24537a012a7a777ffc25212372766cc8d6da239070fca0716602e8b2b64566b6fed1980148223152f670d5cabbf8aae83932

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          dab63871a762a8d3cbd43fa1ec6d8526

                                                                                                          SHA1

                                                                                                          4d1bfdb904531841b2c0199fb53cc9091c18fa46

                                                                                                          SHA256

                                                                                                          5a82e17b4153858ad4cc71f56ec81e7d5b35b1f6aba3da36183b16697439b6a5

                                                                                                          SHA512

                                                                                                          a9675d6167b329f3d0f20b6ff287fe543af16f3c07dd6c3464bb9623b981451f1b91449ce6a45aa2afb0dbd9e9a0908869fa8aaebd98a84abbab32ff5f97d01c

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          791aeac92a449551945871ff76efa90f

                                                                                                          SHA1

                                                                                                          f139fe42e7fc91649616359fb91e9b3d0e3fedfa

                                                                                                          SHA256

                                                                                                          bf06aa536609782d238a3aaa67e0228c096cb835d2071f8fb9be6c01b7109a3a

                                                                                                          SHA512

                                                                                                          e43a68577e75d5268432a653d6c3eeb04876c28326804abe2d9f63e0d21faa2453a283a9e57c741b90b1c8d871baa57f798c9fa5da66108986dfabb387d47f64

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          076d50a20c826b171e46041b6c72ef40

                                                                                                          SHA1

                                                                                                          05c67f3a33684eb7903087bb7ed1b761e5e6d307

                                                                                                          SHA256

                                                                                                          101ae324966d2cc66f025318aae5f5350133c17f4716c2c09034963d4d46e319

                                                                                                          SHA512

                                                                                                          de3ba6ef5215b0003baa425f4f5fdfb2e3879cab1fd2c0e45eab5ecf16cf3284918162485bc33f75af375540d270e9127c82e6945fe8c7b428547cfb3d2da355

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          356B

                                                                                                          MD5

                                                                                                          0938b222f91ce61a50a55973aa2224c0

                                                                                                          SHA1

                                                                                                          659a5e2019f85947cec3525da34034d801c3d398

                                                                                                          SHA256

                                                                                                          bafaea5d202a8f4ee0acda28b8f6182df04560eeeb6f912dd33f6ff991733805

                                                                                                          SHA512

                                                                                                          8269cc685adc925c51e3367fa6ae075403878a8cd5e44ff6ff4b8a7330b328bb015660f8e5d41c59f0b9c487fe0f39090d9c59e0ec4778d41aeda06d9ce99c1a

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          c78f5fad598b3770bd7978c3c38b6f60

                                                                                                          SHA1

                                                                                                          6c18ec7768b5caf272b3037a8adf1623777d3ea3

                                                                                                          SHA256

                                                                                                          a4eb7ba8e7421e8cf136b8be4f32ba77ac30823cf1f50f3495633b8600a8962a

                                                                                                          SHA512

                                                                                                          a0d74572a3991c9f5ad1d12ae97cb66d95f14eedd65c9f3e98e9634e3b06f84102f7df355f3726a6b7f5ae559993b47b573ca8d8021261ac6878c5fe5ba18ee5

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          9577f0e448a06982ffb3837ab65b794c

                                                                                                          SHA1

                                                                                                          e473eb88ad57113b46df5f72179efefaab6bb3a5

                                                                                                          SHA256

                                                                                                          528e0c3d513f943b5c4938f3c2df4f0435e59293b880d3f446bfda8e65a678e9

                                                                                                          SHA512

                                                                                                          620ef3900b7ab232a42e552133c3e3c93178961706bc05019c86a8482ad9a224250c34cb7c4b5d02ffc2315f86e912a8560f5567e0a5031fdf4a7821332fdfa0

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          785882d4e89e1f8d09d957ac623371f9

                                                                                                          SHA1

                                                                                                          9bd799038ac8f102512304ecddad23c080f731bf

                                                                                                          SHA256

                                                                                                          640b2080dece3e9219542416a9205d827d48819a55db127bfc78b5bb8b263837

                                                                                                          SHA512

                                                                                                          93db62ae4fc5f06df5bfcec47d95beab7bccddc0170ecc432047fa5b3a4ef42600709cea6851dee32874aa7ff1c75bf833d40da5beb00199ed3d9c846cdcd65d

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          3d5e16878ad90cd2f0b77a23001b7167

                                                                                                          SHA1

                                                                                                          b88735693b375f31ae6cfbb2b757f05232e3a652

                                                                                                          SHA256

                                                                                                          806ed425c9ba536126c65f611d475c991d6ecbee054c43150c6a9866026afccd

                                                                                                          SHA512

                                                                                                          d596341dd6611a887a2fd0d495588219cc8f73f6c8020b8580823ecd598de5aa957b7078c9961b2e0dd8fdbf8b008294f287ccb9217a797220c4545c66879db4

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          970cf1fe86b1a9908b9daa2273fc2407

                                                                                                          SHA1

                                                                                                          ee1ea7bf52d6fc8ac43e5af629b89efef08d340c

                                                                                                          SHA256

                                                                                                          7fbdbb873e104252d71314c440d8bbd5aadad6d49c2b0d181de0a5f8fbf982c6

                                                                                                          SHA512

                                                                                                          29fed5aad058d2852c5e87da9b248a3da996b4cec9e788408e4e979676da0e4ffcff28f1fcc3414586b47ad5eedd64d90459640d2d746c0907d3b7cc443fd5a8

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          914341598511a9e0e3eb2d07d8adf47c

                                                                                                          SHA1

                                                                                                          8523a2af3d5de21eb86c0545adc64f6c49f48601

                                                                                                          SHA256

                                                                                                          962edf0346df091c982310dcb94424e64e17c7ef5edeaeedcffa80b454a2d4b8

                                                                                                          SHA512

                                                                                                          3e5c8565201a398c184b369f61e0941104c1c969a5324efd22fcf540cc8d0db212351fee11f3c96caf7c1929b4d496fe440e96f6100d69ca8d87350f84eaa878

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          ed97db3d561ca44e6dc539bab898a4a7

                                                                                                          SHA1

                                                                                                          3d9ca4b796a43bbf2ff68e7fc78239c6ab64e54b

                                                                                                          SHA256

                                                                                                          97c332dadc634d360244d7b07b1a53c300236e3ff1eb6419eaa42a02816daeb4

                                                                                                          SHA512

                                                                                                          6b2e48ee74f21a9de99500b545882ef3f73fa77aa78527b000fa4906f941990bb6a24af35e3c791638f0435f86a90b678049f3de91691e60fec1e14a3868eac3

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          9f958962751aed84a81d8d6538e1bb2e

                                                                                                          SHA1

                                                                                                          e0d6a3eb272565dfab9dc60012fb0a380416499a

                                                                                                          SHA256

                                                                                                          f5cac22656b3723591374e64329e1fdcfcb5a658810933403a1e0dc1a91f3106

                                                                                                          SHA512

                                                                                                          19d0e80e35f1979e33ed886a1fd3ad9a300a33d1b0a093e7a81479bed025c74a8e1f51f16a3b30130a3f8c4fef72a8ed568a90801645ff7512f7bb242fa0a5f7

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          6921a95abb98673b83c0b7b36fcea586

                                                                                                          SHA1

                                                                                                          996e6323a304af745826e6a63804c5452b4efdad

                                                                                                          SHA256

                                                                                                          530ac4c315f7501b9bfc22e141e40491df9c669f986cb2fbf485747c26f98a04

                                                                                                          SHA512

                                                                                                          fcad30d7b7b8f12bdd78a8729aaa068cd8954e4d60e50984cf709415f9fd8d59f243233122d4c700430526c87c82151f5e4e277694bb8cf4e59b0360cd4ecea3

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          4ebb8bc9b9ab5cbe9019d8f45db976d0

                                                                                                          SHA1

                                                                                                          ed489121cbc64b44ec99ddde43c80b70574e5e93

                                                                                                          SHA256

                                                                                                          ddb6b151141437c3473578d4c697a5bf334598609855bae1bce8bdb0ac82a2e2

                                                                                                          SHA512

                                                                                                          08168381d1af7b9d3c855350e4c11099abc7ea075325446d021034fa142c905c1437d09f6b56155025e65d3ad2dfefdffd34fa1545484ce1c13a70236ba78fb4

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          ef2638e424c6bb04b35b7693a6e23704

                                                                                                          SHA1

                                                                                                          28fee8c45e8f9c81d3f0b8a32e487d5088dcc168

                                                                                                          SHA256

                                                                                                          7aafb4078791cdafeb86fb91196a46a37ceeb76712d6f9f78831a46be944bcea

                                                                                                          SHA512

                                                                                                          76117afce94fb95b77fe307c5e20ddaac68abe724533ddff4345480713b6c18a8af8d8dd97a6f2c136d2945c9d326206137c7df36cdde40e4407098a64ab9063

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                          MD5

                                                                                                          94d37e856ce30d9b325d7f6b20d9fecd

                                                                                                          SHA1

                                                                                                          3220e344a454c91d8c36ee1f04e699afec02f558

                                                                                                          SHA256

                                                                                                          c00cb8331438a178a44e9669bb5423960ae05579a4b936fd532647651529630b

                                                                                                          SHA512

                                                                                                          df71a2529912ef0ecd9d0b4161c94dae9869f3b429bd05c47633966229c68d5996cf3dae2b3ed2eb05006fd90a25bcbc29f8a957643457c7403c6638402ef9a7

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          eddd6027b68b45e81ca63affec09438d

                                                                                                          SHA1

                                                                                                          f88e367310db5ba531774df559f260a8d1eb7c02

                                                                                                          SHA256

                                                                                                          050deb241d7c420756908ad1aaefd43421067b21f2738cadd5da9af8da252895

                                                                                                          SHA512

                                                                                                          027b8a90e2a1b254c5bfcc912570631cb531a82a947084a8db83fc41e308350dc57b17654ee9ee7bffc0c816581d9aff92d9e8427a48418fd714f0248f977ee7

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          6df4e744e18276bf83eefa07b7030964

                                                                                                          SHA1

                                                                                                          47f571078e039c9d3ad05888f4d53c1bc7b20443

                                                                                                          SHA256

                                                                                                          1dca00b2725cc26bd8651d8684cdd16f681c936c709ce0b3f2328c652f5f798d

                                                                                                          SHA512

                                                                                                          6f4abaaa6a7904d5f4600e9f49bd6d51b21c161f387274f4a943b0b47a23db598d827c32d9164e5d6ab104f71f2fde074c2f67ec8caef0b8897ff8417f2310b3

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          92e89a6a578c963489791d22f2c51153

                                                                                                          SHA1

                                                                                                          e1a02ebf803361a69cdc43fdac3e3afc388bd846

                                                                                                          SHA256

                                                                                                          535d486698be1ec9f1cc9348dba228f94208537f23ba3100592a0ae6bc586713

                                                                                                          SHA512

                                                                                                          be1592633949c7d137253ff263a410975e776119e9445837c2a85d6f2eab547fb62ca251413a1e9061dc1be6353bb29335958a37e421de61bfc3d36589028380

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          3f38961493cd1555dff7eb691f8bed68

                                                                                                          SHA1

                                                                                                          dd22cb5cd97125f8feba12595a1e021fb499a3ec

                                                                                                          SHA256

                                                                                                          4d2493320d5d911c1ee662e55802a6549dbaf0f1287b8a91bb9288eb28c25a17

                                                                                                          SHA512

                                                                                                          5c4cb0b028ca881d0f828e984175c2d18407dc581640b7e29155ce198b62287b2676db0a9dcd82f4b9a5d49c37ea13b9cfd1a44ed747dfb8a348bbfe4881d6bc

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          53c78aa2c4ec6c151d5e47a89846dab3

                                                                                                          SHA1

                                                                                                          19ff6b9418646f0f306e1b4c55d3276fd090221d

                                                                                                          SHA256

                                                                                                          7a9967fcfb07d18a370ceca7e66d8621dc086f0df7b1b2f7af6c8341a64d10cc

                                                                                                          SHA512

                                                                                                          eab917945778109472d6ec4d5770b161f7ceaeb5dd96becac879085b36026d5962629e14bc96381fedbe305434630e5730679fecb16f516b6ba1a169f89d7a42

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          fffb97240811fc05d1a54617522fc135

                                                                                                          SHA1

                                                                                                          d8ac335f67ad57f93cf6aac84289367aed2c764e

                                                                                                          SHA256

                                                                                                          3ba2d9d7804eca0ad97940ed25977c28b1129b63dfe5c084535bd9f00ff9b807

                                                                                                          SHA512

                                                                                                          2c26c96b8c02d8bf49f2031a04b8ceb53aaaf6cc490de248bdcc9e900b5f0456acb780c1238cee4889dc7bdf5b776ee72876d7b1f26e4811607edeb3091592d3

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          91b0b21542adb4f1232d369bbf139c4d

                                                                                                          SHA1

                                                                                                          45b3ae78cb6c3b16ba364a63f636521e00e727d3

                                                                                                          SHA256

                                                                                                          8887422f442242b1871df8f94e3ee16ea02864f7beecfadc9728276980aafc99

                                                                                                          SHA512

                                                                                                          4ce0ffb7f54dd6c8631f610038077a59cc4b5e5ee13bf53b4ad930fb81c914fdedf050300b2c3eff1ecd284e4a0e648c7338f70044c1bcba2bf869df17c9dc7a

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          6bf5acb36d49db246d523b7d633e0069

                                                                                                          SHA1

                                                                                                          f43ebd4c69c9a27c82b7a5610d30b6d2b4168561

                                                                                                          SHA256

                                                                                                          c4e0300f76bf0e16eb2aa2cf2c77c57f6593413301215f61242a561aa3a9fa8c

                                                                                                          SHA512

                                                                                                          9a1ef945d7f54e12854ff280fa46ad847bfc31258c8d6078a2b46e950b9371d0441ffd206dcd44ce5b808c0540b830072087f68d7146f1ec25779f8a4eed1fc5

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          099ea7bd8c07a1d5dd8f72d5e9ae7774

                                                                                                          SHA1

                                                                                                          0782f2471a03e63f6479942e884e1deb7d898abf

                                                                                                          SHA256

                                                                                                          9881ffa9289ccdf51cafab94a94818702d2dadad42a227303191ae96497d94df

                                                                                                          SHA512

                                                                                                          4b9b5377862f6d5001dc31c063fc62b0c248cd90ff514f80e4a050eed13cc4ad026594a1d02e8d62e83eeaedfcb1b76fffa9ef1dc18c9cde536b6239951d5eaa

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          13c57554a5ec0ea6df0bbd9ffae80597

                                                                                                          SHA1

                                                                                                          81337860be1a507ee0efb68073c77b827ef62b9f

                                                                                                          SHA256

                                                                                                          4b6ad0b7a25a0794950e2110bc3855f87e3c89d7c8d9145a8445cda6c2e03aa9

                                                                                                          SHA512

                                                                                                          608da4b5a32331530b52f4d4fa506aed7d17b680a3c0ff4eb9b005b3309908283a02f15a7928d5b2cd942d605eb3735f45419a7d0aa2f022edef98b910fa29d4

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          21b69b551c3f8dfbc7c5f220fdfc2eba

                                                                                                          SHA1

                                                                                                          f4fdfa54ae1dae00fc02df51c4c662c511308fc8

                                                                                                          SHA256

                                                                                                          5660aed1b977cf8082f271f2d2e7adbdcfa7d8594b591cd5ae84ffa71a6f3e0c

                                                                                                          SHA512

                                                                                                          5aa0078f7095143e5df56a6ffee890c5b3cf23be693bd1c3477577623cea6cbb9b226831834f34302f36c46eb5eda5ea0fef9bfda254f70a664c175a18410534

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          d1fd30ec7333dd62437a6aeeccec69a8

                                                                                                          SHA1

                                                                                                          66a79731fc5b2340bc02d7ae70494febd1903fc9

                                                                                                          SHA256

                                                                                                          452b3e183459d222ffe7c338f6c454ac9133d208273ea508307e2ab9324112fd

                                                                                                          SHA512

                                                                                                          c88721f8c778040134e2bda6d4eb85a74ed4b684b183f55b69ba8f22ecb2dd0ae7600136308515b68c9912b2453ef2b9fb53633bf2b3fd50c5a5f7625a93d1fb

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          3c9004166169ec6c1b566be491818da0

                                                                                                          SHA1

                                                                                                          624a6991d2008d658267d23ec4e406fd11e96e53

                                                                                                          SHA256

                                                                                                          521410b417f7cc25fbb83120457719ac545e70926e893e0475201f4c6d116ef9

                                                                                                          SHA512

                                                                                                          3bc0fcc172c991a945faa86766d9b67d2243385215193c745b6636baf504282a98088120178bb03a670b36a79c5d716ddedf86b0d4d893542bc667072232642c

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          41d5d50ea3a9dd1104a51e57efb23d20

                                                                                                          SHA1

                                                                                                          545008a07fac18ab0c870ea7d5132e1091a04c62

                                                                                                          SHA256

                                                                                                          0b970f3398a76ffeffc7fd20b512707200abcefc6a9a0471c7a37e9d0d83add5

                                                                                                          SHA512

                                                                                                          6dfe7a3d70cd87d9d538f8f1601d687d30bcdd8296e53da1d67e6c9869338ff200b77ecfe5b378d986744244ad0429a74a895910f4485f6b59cf176748e5fdde

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          60ec2da90eaee59826fcd4e15aca8909

                                                                                                          SHA1

                                                                                                          c7e5e83f5bad8ee64650a57f0fa11c298e32de80

                                                                                                          SHA256

                                                                                                          c9ab1bef900bb60c416526cbc5f38f1575f1f6636ebf5223c02e154246383bba

                                                                                                          SHA512

                                                                                                          fcc99d5b6d995ab08e4d091ab57079d845786744707eefd13d5b2186e4a6e5cd8cf6078de4a7b18ede4d001b24fe0e8500d8198ab8209ed1d6e025414c45eaee

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          0e240dad7dbaa45ff435d87ca0149656

                                                                                                          SHA1

                                                                                                          feff5dc19b242f485ea838b41e2804fd5ae0d138

                                                                                                          SHA256

                                                                                                          4366ab3af50aca4798fe5d16b1d20ee46f97bac142aa4ed74569b16083c66337

                                                                                                          SHA512

                                                                                                          e01995f3e08bae79c800164d392ebd4d41b73df3dd0aa6669819ab7efe68c9bc3555bb785a62cff69a193ca1af6d67d46727270472b456e447f7074ede0acedf

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          629082133fe4ea0fdac33fc00ed2e865

                                                                                                          SHA1

                                                                                                          2781726f1894f91032e6736e1be6d74f490f11e2

                                                                                                          SHA256

                                                                                                          5a61c9daad2a03deb455eef747a189e9dbbcbf555dd28c85e4374b7611c8eea5

                                                                                                          SHA512

                                                                                                          0f68934fb5c76f752d252b04299c309b480c921635d2be33a2faec09cefc4be35cddd802ee3a13a19a5c87263db0b18e230b427617a7dcf6d198fc38de420960

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          1c2f85a6165278934ddd53b2701d68be

                                                                                                          SHA1

                                                                                                          4dd0c3bdd2b8dd1cf4583654e27b5d140c084726

                                                                                                          SHA256

                                                                                                          c290ba147bffb45cbcb0a547f9f11f57364a9bf7c0f1bf2ed16f4419549e6793

                                                                                                          SHA512

                                                                                                          7be97d2f6e11c0fe12b048c574be43462123b56ed0f690c4f91c0c01542f5a39b6dbc9bfc066336aaeafec814d7c6f1abb7a493492d5d7c2868e4f28acff9490

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          9KB

                                                                                                          MD5

                                                                                                          3fff4325735de74cd6b09395fc823513

                                                                                                          SHA1

                                                                                                          31542532f8ae95c9cfbff778493dc97eb1f69ce6

                                                                                                          SHA256

                                                                                                          f4b1fdce02d892cd6c7aefa5b477016b30c0f7cd9694da74d61bcab5c40b1279

                                                                                                          SHA512

                                                                                                          7707325392c574e62e77817407c38edf8d359fcdbcde349e3fa47a79ae6c683c692e4264030e8270bcbe0f10e18e82e32025242aee8cbdfcbe5bc1078b2628b1

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          3b43741f28db6ea90dd3e98a578d1642

                                                                                                          SHA1

                                                                                                          1d003ef9a7a346a6e50d4ca23a703f52c698064e

                                                                                                          SHA256

                                                                                                          e72b713fd0aa35043ff4f3c857f3690f6f0cfd366cbbf62910e2ab16c72d7398

                                                                                                          SHA512

                                                                                                          108e865bdeda3eb3ffb6b9c01f41133bc6c3ce39547d8de45313df561b936a35e12b49f966f12f9707cc9180d5a959edc81bdbb94f3a4324fd9f1c8d79fb8456

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          43a79bf48666714df1ecd2bbc315fbd3

                                                                                                          SHA1

                                                                                                          e9316dec2faa6676951ea3d109357c43e079b7d5

                                                                                                          SHA256

                                                                                                          95a5816d85fd8a26c4042b100e146321ae1079b5e2754f109360a95759e0837d

                                                                                                          SHA512

                                                                                                          dabebfe4679ab48936978f291c852fb72d791ab772033132e17cac1a027a7e0f411956381541612d8b1e97fb8eac37febc048bef71f5c8b133cb33655648a10c

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          c50715a2bb3af5a20a3d2d3f1053fb90

                                                                                                          SHA1

                                                                                                          777c437f50eac852dee66fbdf7d47280110869dd

                                                                                                          SHA256

                                                                                                          3fcc6fb5535a1e975862b71e728a919fbb805f1b723633be8c10cfa603f5613d

                                                                                                          SHA512

                                                                                                          59f56a79095a6b5d166d4051c8dadcbb20620fd6b447def63b2fc4e3bd46cd7c170f8a2cbbc035c93a4b491b74901f403b0d447b00584c638beb11b00c6508f5

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          f57f3ab15d4a78c660a507f10e596435

                                                                                                          SHA1

                                                                                                          803aa0eea028b226a81de8c837a7002922d501b8

                                                                                                          SHA256

                                                                                                          39aaae1ecc12bb8be7006910dcf7afa8c8069edfe8b40e6e7eafff5365765253

                                                                                                          SHA512

                                                                                                          82ab88968df9d67b46ec987078f4057221cf9916541290a5d02af370590ce6cd21a0e93cd05697fa866609fa55c343cd33714fbcb604df8b01ba68e203e4f100

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          4404e42384dfa3095e8f9276a3d45d23

                                                                                                          SHA1

                                                                                                          1f26a679d0c551cb6ef6bd0c31264831aa8c9896

                                                                                                          SHA256

                                                                                                          6a80a2fc60b9c484cd81ccc3d7dfb8afeeabace37db0ae52efccf10341c5787a

                                                                                                          SHA512

                                                                                                          4a56024a49caec0df3fc7c87d3a0d77e88c943f92f83901d334b4d02003758e37f9c1f56f8b4c64fa3087b7a5ccdbed5f298d7a2a8694787e36c49629eef262f

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          f56bef4feea4d5aed84ad1d73bccc520

                                                                                                          SHA1

                                                                                                          25eada9571b7e9526b6dce0ed2e9a55f70e3b566

                                                                                                          SHA256

                                                                                                          3ae1676ccaaa2e5cee13d70d4e8ca43fa3c12ec7ea93910d315dc0a1bcd669b4

                                                                                                          SHA512

                                                                                                          ca8986b1e4d7f73bc9024b52bdde2130b835db8e7fe6c0c4a07603f77c6cd45cb7081fe1419541e9a56a1cbb36fbf60ad18194f56c7af781579c0f3b90587312

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          a4628c0ae3893574c21649f31edb6495

                                                                                                          SHA1

                                                                                                          e1d39d0913ce38e1a851add94bab4b37311dbb8d

                                                                                                          SHA256

                                                                                                          e01eb86d362a73b581fdc48b4f04d70b691a4d8bde85c26a0cdf17c00969504e

                                                                                                          SHA512

                                                                                                          1733a73154204e0020a761cb66279da17138cddd060c3419f36c555cf3623469eb1d7c162ee8f980dc4d4b60325e693b6c70bcba8dcb4e50453e693397ca50a7

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                          Filesize

                                                                                                          124KB

                                                                                                          MD5

                                                                                                          7c79bfd17f78d6edfebec7922ce0cd03

                                                                                                          SHA1

                                                                                                          6a57e286058e90e3975dd29effbd6ea456a580f7

                                                                                                          SHA256

                                                                                                          bf6bb3976a3d479329d7e57fc186d94fd4da545c347b101dd3d5f749a61de722

                                                                                                          SHA512

                                                                                                          5f84711a6493db4ed60c2bb3c69d36d37e526c3f83b0fb7bc8bd01ac3ce1b26ac7c725ed47f2f98677c0d0016804f027b91110a3922c14db3e960799fc047949

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                          Filesize

                                                                                                          124KB

                                                                                                          MD5

                                                                                                          b7bd254966707bbb413fdfcbf42736b8

                                                                                                          SHA1

                                                                                                          8ddb9c168e546feebfaf15bc31115abd1af90bfb

                                                                                                          SHA256

                                                                                                          375ae119685e0b0238b8c51ae2025d39eef90b56f3b750be4285ada8db56d775

                                                                                                          SHA512

                                                                                                          32baba92af73df3a37e418762804b7f6b8ec2ab1ed63015793fdc935daac4dc6e42d565c3b820f1a2f63b0b3d38287fbc1cd0cb8d432f154420525568971ffd7

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                          Filesize

                                                                                                          124KB

                                                                                                          MD5

                                                                                                          0ee5847716e1b73b69437ffae2735df1

                                                                                                          SHA1

                                                                                                          3dc054d97d417035bfcf4978b18e94c740dc03eb

                                                                                                          SHA256

                                                                                                          569c66fe41078a1a077c69f69f5625519d2d797fc723a34990cee46e77849b39

                                                                                                          SHA512

                                                                                                          5399d0776708f7ab8abe85f7cf5fb7af297cd2b30ee76c75fc59cfbb2dc445269d232308156e0d2e1cb39d6b8231bf198fcaa44c51a1294043b6bd1c3f41d068

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Lokibot.exe.log

                                                                                                          Filesize

                                                                                                          425B

                                                                                                          MD5

                                                                                                          bb27934be8860266d478c13f2d65f45e

                                                                                                          SHA1

                                                                                                          a69a0e171864dcac9ade1b04fc0313e6b4024ccb

                                                                                                          SHA256

                                                                                                          85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

                                                                                                          SHA512

                                                                                                          87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                          Filesize

                                                                                                          152B

                                                                                                          MD5

                                                                                                          4ad7e2823ed71b5f41dbe2e9db624220

                                                                                                          SHA1

                                                                                                          e3b873970c0af4dfda35b103b11966c64f71afb8

                                                                                                          SHA256

                                                                                                          9a6b7133374433f1ac7479b4d275efd79962d44e8c3f02d00e91712c7cf33a84

                                                                                                          SHA512

                                                                                                          aee44a4b77189040c7a62ec6135dd761b983a266414c19f681ecba19812f5a863310d1bfee4041b1537b0098ec455931569e80bc5e2e8b1f075e294d3e445c62

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                          Filesize

                                                                                                          152B

                                                                                                          MD5

                                                                                                          066befaf57a1c901c7c885b1996d027f

                                                                                                          SHA1

                                                                                                          25913cbfb3aadb0c7e28307f4d622296241fb1d4

                                                                                                          SHA256

                                                                                                          c3d2a6b2ef9f2bf15c227ea6008aba027c9b042ad63b2f243972df4cc86f3e6f

                                                                                                          SHA512

                                                                                                          6ebc8096cad307863ca43dff3cb3ddd3dc2acd701bceefc7eca6411efa1b7a1fbafbe856ed9aede6dbb8a145887ded344b013d3e20d6950749f5f1d3ac126c6e

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          111B

                                                                                                          MD5

                                                                                                          807419ca9a4734feaf8d8563a003b048

                                                                                                          SHA1

                                                                                                          a723c7d60a65886ffa068711f1e900ccc85922a6

                                                                                                          SHA256

                                                                                                          aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                                                                                          SHA512

                                                                                                          f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          329B

                                                                                                          MD5

                                                                                                          2ef79696d3e6984c08b81bd15f169b4e

                                                                                                          SHA1

                                                                                                          84560e4640e1ae8a556d89863c37e9979c5af57c

                                                                                                          SHA256

                                                                                                          539e9a2b56aba0ef638b64b73b81cb071243e628c6769cac13cf812937eaa68b

                                                                                                          SHA512

                                                                                                          e5fb5ea928769079ad6210f61be8fe6ba57ef5e2f304dee7fcefa44dbd988ecb644ef2c9c4f2118b2994d8299e4492200b29922b00f92628e22a9902f89384e3

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          111B

                                                                                                          MD5

                                                                                                          285252a2f6327d41eab203dc2f402c67

                                                                                                          SHA1

                                                                                                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                          SHA256

                                                                                                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                          SHA512

                                                                                                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          c5398676e338cef14fa3ef6d0b7be823

                                                                                                          SHA1

                                                                                                          45f444cde45d847c2582d862e8423c8f74de9a37

                                                                                                          SHA256

                                                                                                          a20b92de92fdcc1c3ed56ca87793ca8af963a9f55960321ddc0a43713a508a0c

                                                                                                          SHA512

                                                                                                          c20ced691f9bb305dea720d5d5186f755d76bbf9ba953efa5850a9b4c30c82534a88c8d8abcc5b11d40eaf4939b0ae5e96388f71dfa08a9539d4a16ec3bd9a3a

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          40b5b0cb675c4c03dcc98e7bdc37fe7d

                                                                                                          SHA1

                                                                                                          195e7b972237c1e72e5aa040f0d42901ebbc2bce

                                                                                                          SHA256

                                                                                                          8fea2cd88fe9a1bb2953ae064dad7b00550d394f35c22b34cb138c9a059e5e67

                                                                                                          SHA512

                                                                                                          42fa5e6271fddf5115cc7a4b4bfa6352cb9b039272a78e5750012c4e309434856ddf607a6b9527d300c4e91e73eb41d2fecb4af2c2863162d7d8d578c4b06805

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          fab3f76434770b526fe353c2b2dea124

                                                                                                          SHA1

                                                                                                          267b3aacce7ed869c29a8b53b9103b22f95741eb

                                                                                                          SHA256

                                                                                                          945f8d41d46a29b6fb469d13a8b173514f073a53a2b09173ed2bc377ac396f1a

                                                                                                          SHA512

                                                                                                          7eaf080e549d160f5115f73ac59f30fd28a386c64ce59a085ce977a02eb7e942f4101acbed46638b1b384077af4b3b1d8015223199be93aa32038cce3e3577ff

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          aeed8f5deced8cea361458ab6be25ccd

                                                                                                          SHA1

                                                                                                          f90933f77f4f6c276dbaa466799d485dcda42809

                                                                                                          SHA256

                                                                                                          ed27ddd5e95b25cc80b63760447b8038ccb71a0ad8f4d16c9992de6b9f2767e1

                                                                                                          SHA512

                                                                                                          59420001e25e489bf18baae2b58ae15a45fda5e9286a7d68d5ed44726feb2e46b3ea231b38d2193eb7818caabadb7bdaa638be3470abbacfd140aee1c7f83d40

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                          Filesize

                                                                                                          16B

                                                                                                          MD5

                                                                                                          206702161f94c5cd39fadd03f4014d98

                                                                                                          SHA1

                                                                                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                          SHA256

                                                                                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                          SHA512

                                                                                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                          Filesize

                                                                                                          16B

                                                                                                          MD5

                                                                                                          46295cac801e5d4857d09837238a6394

                                                                                                          SHA1

                                                                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                          SHA256

                                                                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                          SHA512

                                                                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          137111c2b56949c1bc8f381993af28db

                                                                                                          SHA1

                                                                                                          6ab552f7f0e4f46850e0aeb5f2f8e522f3d5ce0f

                                                                                                          SHA256

                                                                                                          bf2aaeba2c5ebc7a6840127fc114552ee6f649624fc76a3fee956506e3ae3c8b

                                                                                                          SHA512

                                                                                                          34519605db3ebbadf40813bcb1970f49dfc985e00dce8f36369b3ecb7f4d5da3c769adf1750078a7951d8f5f061315c79f20b0cc0cf1942524564183a7a12749

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          a3233e81db0fcac9f5912328b2ab5244

                                                                                                          SHA1

                                                                                                          0648ad27a3a1ebd212a638dd86d899682c1205a8

                                                                                                          SHA256

                                                                                                          fa64c47d806747245c771f7726518cf24eab52d23670b9d0b7397bbd2608b554

                                                                                                          SHA512

                                                                                                          6b67dbfdac14e155898f898604c4275e7fee84a8473baf135b041d52803edf96df57a6a37f1384f5f55665d9d9dc25ca85c1fb6e86f49c387faa2ca3cc7461c8

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          9fdd5af5adf22888b93a54dacb8fd5a3

                                                                                                          SHA1

                                                                                                          48d7f3e82f37137e76c1edbc4c94afc2fba350f2

                                                                                                          SHA256

                                                                                                          f6e98f07e443b6e2263bceaa60084cdea3db1a3bbc328f1169e5c1817559314d

                                                                                                          SHA512

                                                                                                          bf0f723eae00ce0d733075653a1b858ba07625d94685609359c7625d3fb4e7b56fa50a131016c608b09ffa474ffd9f2520b03bd634ac7bbef7c8667cac0c1094

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3183222884-3758288823-2808636388-1000\0f5007522459c86e95ffcc62f32308f1_dcf7c912-820e-40e0-afcd-e4d1f62edbba

                                                                                                          Filesize

                                                                                                          46B

                                                                                                          MD5

                                                                                                          d898504a722bff1524134c6ab6a5eaa5

                                                                                                          SHA1

                                                                                                          e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

                                                                                                          SHA256

                                                                                                          878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

                                                                                                          SHA512

                                                                                                          26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3183222884-3758288823-2808636388-1000\0f5007522459c86e95ffcc62f32308f1_dcf7c912-820e-40e0-afcd-e4d1f62edbba

                                                                                                          Filesize

                                                                                                          46B

                                                                                                          MD5

                                                                                                          c07225d4e7d01d31042965f048728a0a

                                                                                                          SHA1

                                                                                                          69d70b340fd9f44c89adb9a2278df84faa9906b7

                                                                                                          SHA256

                                                                                                          8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

                                                                                                          SHA512

                                                                                                          23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

                                                                                                        • C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier

                                                                                                          Filesize

                                                                                                          26B

                                                                                                          MD5

                                                                                                          fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                          SHA1

                                                                                                          d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                          SHA256

                                                                                                          eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                          SHA512

                                                                                                          aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                        • C:\Users\Admin\Downloads\Aurora Worm v1-Cracked by RoN1N.exe

                                                                                                          Filesize

                                                                                                          953KB

                                                                                                          MD5

                                                                                                          1d451506237077f8b09f5e977ffec232

                                                                                                          SHA1

                                                                                                          f8bb2b74d165a1f9e76dd64779f5853277e185b8

                                                                                                          SHA256

                                                                                                          3dbcf4f75dbe901b2b555f8c929ced4ec56645e4a628a28d621221c6e8f00c60

                                                                                                          SHA512

                                                                                                          aa075a87d9bc69b4835d081a2cb03cd27b76742d02112ccfa3f6fad85fea7f79996b94c770f89edd33bdb0789ecf53ead43417de700ba89611ccb37aa4d19d21

                                                                                                        • C:\Users\Admin\Downloads\HawkEye.exe

                                                                                                          Filesize

                                                                                                          232KB

                                                                                                          MD5

                                                                                                          60fabd1a2509b59831876d5e2aa71a6b

                                                                                                          SHA1

                                                                                                          8b91f3c4f721cb04cc4974fc91056f397ae78faa

                                                                                                          SHA256

                                                                                                          1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

                                                                                                          SHA512

                                                                                                          3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

                                                                                                        • C:\Users\Admin\Downloads\Lokibot.exe

                                                                                                          Filesize

                                                                                                          300KB

                                                                                                          MD5

                                                                                                          f52fbb02ac0666cae74fc389b1844e98

                                                                                                          SHA1

                                                                                                          f7721d590770e2076e64f148a4ba1241404996b8

                                                                                                          SHA256

                                                                                                          a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

                                                                                                          SHA512

                                                                                                          78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

                                                                                                        • C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier

                                                                                                          Filesize

                                                                                                          55B

                                                                                                          MD5

                                                                                                          0f98a5550abe0fb880568b1480c96a1c

                                                                                                          SHA1

                                                                                                          d2ce9f7057b201d31f79f3aee2225d89f36be07d

                                                                                                          SHA256

                                                                                                          2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

                                                                                                          SHA512

                                                                                                          dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

                                                                                                        • C:\Users\Admin\Downloads\Unconfirmed 538340.crdownload

                                                                                                          Filesize

                                                                                                          1.6MB

                                                                                                          MD5

                                                                                                          6c73cc4c494be8f4e680de1a20262c8a

                                                                                                          SHA1

                                                                                                          28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

                                                                                                          SHA256

                                                                                                          bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

                                                                                                          SHA512

                                                                                                          2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

                                                                                                        • C:\Users\Admin\Downloads\a35eed2b-d109-4f83-aef5-6962011b7f4b.tmp

                                                                                                          Filesize

                                                                                                          2.8MB

                                                                                                          MD5

                                                                                                          cce284cab135d9c0a2a64a7caec09107

                                                                                                          SHA1

                                                                                                          e4b8f4b6cab18b9748f83e9fffd275ef5276199e

                                                                                                          SHA256

                                                                                                          18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

                                                                                                          SHA512

                                                                                                          c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

                                                                                                        • C:\Users\Admin\Downloads\smb-qua22o4u.7z

                                                                                                          Filesize

                                                                                                          37KB

                                                                                                          MD5

                                                                                                          c7878a0692f2cb14aac7c2e9baad82f1

                                                                                                          SHA1

                                                                                                          36a332427990198e9775c92b3cdd0d429f304a51

                                                                                                          SHA256

                                                                                                          9849e33e978278070075328520663c618f05d02aad5f1fc802c68af354d44ab1

                                                                                                          SHA512

                                                                                                          da5cbc5cb1865337f4bfdf989a38122c083f5a2e7a6f69dd66be9669656b913f44e8bbe9207ebb1e0036bb40a334a816ed6a9aafccb3e8d27e7d6a5ec38ae610

                                                                                                        • memory/1960-324-0x0000000001600000-0x0000000001614000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/2076-501-0x0000000004A80000-0x0000000004A9A000-memory.dmp

                                                                                                          Filesize

                                                                                                          104KB

                                                                                                        • memory/2076-487-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/2284-319-0x00000000061F0000-0x0000000006234000-memory.dmp

                                                                                                          Filesize

                                                                                                          272KB

                                                                                                        • memory/2284-318-0x0000000006060000-0x0000000006068000-memory.dmp

                                                                                                          Filesize

                                                                                                          32KB

                                                                                                        • memory/2284-303-0x0000000001130000-0x0000000001144000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/2284-304-0x00000000057F0000-0x0000000005D96000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.6MB

                                                                                                        • memory/2284-316-0x0000000005EA0000-0x0000000005EA8000-memory.dmp

                                                                                                          Filesize

                                                                                                          32KB

                                                                                                        • memory/2284-317-0x0000000005F50000-0x0000000005FE2000-memory.dmp

                                                                                                          Filesize

                                                                                                          584KB

                                                                                                        • memory/2284-302-0x00000000006F0000-0x0000000000742000-memory.dmp

                                                                                                          Filesize

                                                                                                          328KB

                                                                                                        • memory/2284-330-0x00000000060A0000-0x00000000060C2000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/2952-370-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                                                                          Filesize

                                                                                                          648KB

                                                                                                        • memory/2952-368-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                                                                          Filesize

                                                                                                          648KB

                                                                                                        • memory/2952-400-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                                                                          Filesize

                                                                                                          648KB

                                                                                                        • memory/2952-8592-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                                                                          Filesize

                                                                                                          648KB

                                                                                                        • memory/4704-9083-0x00000000009E0000-0x0000000000DD4000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.0MB

                                                                                                        • memory/4704-9088-0x0000000006540000-0x0000000006596000-memory.dmp

                                                                                                          Filesize

                                                                                                          344KB

                                                                                                        • memory/4704-9087-0x0000000006420000-0x000000000642A000-memory.dmp

                                                                                                          Filesize

                                                                                                          40KB

                                                                                                        • memory/4704-9085-0x00000000009E0000-0x0000000000DD4000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.0MB

                                                                                                        • memory/4704-9086-0x0000000006260000-0x00000000062FC000-memory.dmp

                                                                                                          Filesize

                                                                                                          624KB

                                                                                                        • memory/4704-9084-0x00000000009E0000-0x0000000000DD4000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.0MB

                                                                                                        • memory/4704-9045-0x00000000009E0000-0x0000000000DD4000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.0MB