[loa_in_]

Given that it's likely from an infostealer malware it might be from user internet browser profile password databases.