asyncrat | hxxps://cdn[.]lords-bot[.]com/LordsBot-Release[.]zip

Analysis

max time kernel
229s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20231215-es
resource tags

arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/01/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.lords-bot.com/LordsBot-Release.zip
Sample240128-e95yfsbea8

Score

10^/10

asyncrat ducktail rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Ducktail Third Stage Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0006000000023672-3325.dat	ducktail_3rd_stage
behavioral1/files/0x0006000000023672-3326.dat	ducktail_3rd_stage

Ducktail
Ducktail is a single file deployment stealer written in C#.
stealer ducktail

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/files/0x0006000000023672-3325.dat	asyncrat
behavioral1/files/0x0006000000023672-3326.dat	asyncrat

Executes dropped EXE 3 IoCs

pid	Process
184	LordsMobileBot.exe
5204	LordsMobileBot.exe
5804	Updater.exe

Loads dropped DLL 2 IoCs

pid	Process
184	LordsMobileBot.exe
5204	LordsMobileBot.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
3648	msedge.exe
3648	msedge.exe
6140	msedge.exe
6140	msedge.exe
2012	identity_helper.exe
2012	identity_helper.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
184	LordsMobileBot.exe
5204	LordsMobileBot.exe
184	LordsMobileBot.exe
5204	LordsMobileBot.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
184	LordsMobileBot.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	firefox.exe
Token: SeDebugPrivilege	4920	firefox.exe
Token: SeRestorePrivilege	7044	7zG.exe
Token: 35	7044	7zG.exe
Token: SeSecurityPrivilege	7044	7zG.exe
Token: SeSecurityPrivilege	7044	7zG.exe
Token: SeDebugPrivilege	184	LordsMobileBot.exe
Token: SeDebugPrivilege	5204	LordsMobileBot.exe
Token: SeDebugPrivilege	5804	Updater.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
184	LordsMobileBot.exe
184	LordsMobileBot.exe
5204	LordsMobileBot.exe
5204	LordsMobileBot.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2820	2000	msedge.exe	82
PID 2000 wrote to memory of 2820	2000	msedge.exe	82
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 4696	2000	msedge.exe	87
PID 2000 wrote to memory of 3648	2000	msedge.exe	88
PID 2000 wrote to memory of 3648	2000	msedge.exe	88
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89
PID 2000 wrote to memory of 2424	2000	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.lords-bot.com/LordsBot-Release.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeec0846f8,0x7ffeec084708,0x7ffeec084718
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=1876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.0.1851651624\1830430971" -parentBuildID 20221007134813 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe837e99-d9cd-4332-a5a2-66fc7747df56} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1964 1dba89c2e58 gpu
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.1.18859077\307746547" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c25faf0-56d0-4672-be97-1549e7fb70f9} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 2360 1dba8333b58 socket
    3⤵
    - Checks processor information in registry
    PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.2.550943129\1513846453" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3024 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77b8bbf2-5d7e-4273-8c14-0bc35ce1b68c} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 3136 1dba895c958 tab
    3⤵
    PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.3.1950908356\1783109201" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3504 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e380437f-6902-4754-b59a-5b11747d015b} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 3528 1dbab2d0858 tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.4.1176389120\1104406271" -childID 3 -isForBrowser -prefsHandle 3764 -prefMapHandle 3756 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c4ceb44-c309-4f59-9d64-ce4f9abb13d0} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 3792 1db9bf5eb58 tab
    3⤵
    PID:948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.5.943313973\20503307" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4820 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f70d580-b460-4d01-9974-1b72d666ca9d} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 4848 1dbaadc3758 tab
    3⤵
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.6.1810274530\1596668338" -childID 5 -isForBrowser -prefsHandle 4872 -prefMapHandle 3976 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eef7edfb-90d6-4282-b2bc-cadd1fc179a0} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 4880 1dbaadc3458 tab
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.7.1877718249\1820701120" -childID 6 -isForBrowser -prefsHandle 5436 -prefMapHandle 5420 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32439eb3-424d-47c7-87d4-e84a396346ee} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 4760 1dbaef70b58 tab
    3⤵
    PID:5960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.8.620211539\1213849167" -childID 7 -isForBrowser -prefsHandle 5620 -prefMapHandle 1704 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c1e9f66-36cf-4e6b-9bc1-02d070701d40} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 5672 1dbac458a58 tab
    3⤵
    PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6164

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\LordsBot-Release\" -spe -an -ai#7zMap28065:94:7zEvent17312
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7044

C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe
"C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:184
- C:\Users\Admin\Downloads\LordsBot-Release\Updater.exe
  "C:\Users\Admin\Downloads\LordsBot-Release\Updater.exe" --no-diag
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5804

C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe
"C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 185B
SHA256 4ef96f2facc93c6f8335afcd09c7f58d7a141bb580245f7acfc9930174c91d3e
MD5 1521cfaa776f1b04e9a7ca156813959d
SHA1 f9a071c3a03e130a6b3d29657ddbf08d159de10a
SHA512 d62de2b005d5e96743313491fb2edeb386cd91eaf56a2fe58e23a56d2789a61ad2a26a5391cbfa9be7da19af47ce0fc8f873eabc29aad42123ff4bf41f6f6711
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 eda9f29ac7c8acb3d6518a9a0f611898901652bf7d76f67067f42f17e45cb1db
MD5 2c7c14d895417db8f5ecac3ca3657b4c
SHA1 679c95602bea89c7f91fa556e4bd4dfa893bab75
SHA512 1c318d8bfb009d27f1ef5fb314be70146b923ec7ea579784b1c38df43b500b2860d109ba7d8d344cbc30760738d6a27420a147ff81892b8f45d7ef164a801f09
SSDEEP 96:nI/kmEu11XLlwpvWMoiVmdeHcQ1eNdfUIQyV+VDCAgEub:nI/kE7LlGWMXXeTfbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fd00d70259493a8302efb7abdd35ef64a354a0cee1492bf53f84a927f7cbf277
MD5 e2e565c910a516b57031971a90037400
SHA1 17bef0011db254bba3c7a5c33bcdcfd133582b78
SHA512 599e8c04fdb28ce42df8878d2a649716fe3b45eebc815c6144a817dae09544f45cc68511aa505a86f228a0289f5a59128d69c9078c66c2b6d3a19761e06e9cb4
SSDEEP 96:nI/k8sQSEu11XFlwpvWMoiVmdeHc8R8eNd9yIQyV+VD7AgEub:nI/kR7FlGWMXFCeT99k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 73f603653d7309ba3be3e2a8615f79188d6586b21d2a05b6b11e0508e298619d
MD5 25cf5e2674da6b09a5732dd081bdf192
SHA1 5e9b80e226ec8a0c4f29214786f4055f1d990f2b
SHA512 2d954c0245a60bbcf2b5d8adf7e89b18ace2abd8ab5728a4d535d1e1244b0fe5b77711877f791536236143f6c31098d9c014c8627645f25ae60bae78fc0e52f8
SSDEEP 96:nINkPEu11XLlwpvWMoiVmdeHcAeNdfUIQyV+VDCzga:nINkz7LlGWMXreTfbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 324569ba55fb294a024a5ca6e6a22e8265c70045fad6f5a34ee07beeb3d46ce3
MD5 7a701b0a9f3c52262fc7626e0bba454d
SHA1 36557e853c8b9e7c81e3ecd67703fe76063a2f38
SHA512 a310f67f817be94b8409acf8185ed958a3c623a2fa2286c8f6b13dd8dad6c77e0087af807a6c70c68e1c1e52dd85923aed7a4aa3d120e12af386055ca20629f7
SSDEEP 96:nI/k8sQAEu11XLlwpvWMoiVmdeHcQ1eNdfUIQyV+VDCAgEub:nI/kv7LlGWMXXeTfbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
SSDEEP 768:nrCWQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLllmrUBd:nrCWQ0u1jaXLVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 962c58ad32823fda24869809221836430e72ca1c627d19b33afdf6dcf371fee5
MD5 25d2756055dbb26f7939ebac00f8a012
SHA1 e2d3f49caefb27583f20e5a1730333bf36361adf
SHA512 c19be17c70d0912210da8d3c70c7bf409ac5573100f45b63a50d599a33ac48cf39d4dfd0464b0abded1fb735de395c244eff2e08bfe261df32de8b57be20fc62
SSDEEP 192:PoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupF4tzvCe2RU6TiVObHVhTwj:39iIxuERzA83h09RZxYO2S0o86W2D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6043a6f53541d716faa667aa14c05d274ae518afa60e8c9c3d5e575a298bfe59
MD5 9add72d919aa633894a712e89695331d
SHA1 98f2e50502ed63f2e9519e3163d451bd023dbfa0
SHA512 2b2aa457d76a483ccac24068dae9892735cc546697637f3b7c2edcbfc25c2c8eecd0cdc5e7732ad46c5020b0840fdce871fbc67aad50be71566f11cc5fa2142d
SSDEEP 192:noCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupq4tzaCe2RUX6bHd0hTw8AF:/9iIxuERzA83h09RZxYnrNl86W2D
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 0acd8e730cf1b8ffab8670824cba10c7cae46155f774e82c0c688fead3531ca4
MD5 3fc5d2b80ae2def5050a3967b1c4940b
SHA1 70ed40e2bea8d66a701df3132dba892cfb39d731
SHA512 7d37456c66fbfe6bd2fbbc7f24a56909b4a318518ec1206dc58618f9ff27ca0dbc3bcc6e8c1a01c255390ec189fce0fc5912d2763b0630277bdd16fa01cd8ca9
SSDEEP 3:MsEllllkEthXllkl2zExllLse:/M/xT02zv
MD5 SHA1 SHA512 SSDEEP

Submit Download

20130

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x3x6afp6.default-release\cache2\doomed\20130
Size 10KB
SHA256 ea623a6af6372f89ffa528408b80598f4e17bd7ec31cd8a40ab214b3a3187ebf
MD5 b475b1dc182efa9e1d9b140dbc09d686
SHA1 39f8da365f2c88c3405fbacf6bed9398e470dabf
SHA512 50b0e6959b61b8ce735d06906060298af5ed9e99ef3efafe7d415475fdd2b55c70a48b8d5a44ff1b2cc70c40e39c1ee7af9d13c0a901373162ae37e838790f13
SSDEEP 192:wo/Tzd3o/Tz38e98hqrKcS+E+rW29t2BDTOjtTOjxP3j:h/Tzd4/Tz38eehqrufWWCt2BDUtUxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

HVMRun64.dll

Path C:\Users\Admin\AppData\Local\Temp\DN40B6560D6598ABA0\HVMRun64.dll
Size 4.3MB
SHA256 14f61c269509eb27083883d5e8edcf9ed14f3b62cfbfb69f4f7434d64a7fa924
MD5 21184c4444b13c67546c7acf7f6ad8e3
SHA1 806fb111900a0ec8bee1f658c6828b9e005f1111
SHA512 9c55f71051f7c83d8644c7eaf500a5ea887aa75886480fcb607e3540f482afde0cc11396e3c2be936bd6418ce76a752132391c97b2620927a9a694eee99380eb
SSDEEP 98304:1JArZsVn2qEP6Z5AF8qRHNKs9KtEXMURNZpe5:o0tkY5sHh9FMURN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 c00c5e355dec9588066202f15b883bfe82c29f0da092a2b6cdac4edbc5ca7344
MD5 d68826661b4a7470e257a93c37eecc4d
SHA1 b840c98cbe422f9f6442ecf2146006b5517b7319
SHA512 a97bdf2ade08d51402279ec0b4739a0bbfc59a6c9ff972902d8c3a939bb8db87e4da6a798571224ee77e0f036a72d3f2f964bd806e43232757f3ddc14b29ba75
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin
Size 3KB
SHA256 4895f588931dafb987866a465f9705245f72489e9e657cef096bc3c3f765f6ba
MD5 e4cfa23c03ecb2b7b0886e84b2288947
SHA1 d7e727ae25e8563f9ba829181f87d3aeeef9eb99
SHA512 69fe308694596bb02b16489eab613315483457f9c9a622e6bade27d1133bbd645ee12694ed31782b8994eb1088b0d8c346d7b8a266a3ef746e0c66a4b4252888
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin
Size 3KB
SHA256 7897307fd4d8af0bbea553d65ec019a6ae58130f7ba9848a044222a3bd52d2cf
MD5 fcc28d2d1f92f9a8bd6784245fc45012
SHA1 40368893777586683c4bf06e3cfc1628320f37f3
SHA512 382766ba6a47fec5ba5480a7e86f522374b025d80de1e55e49b76fa09d8a44e8bb32f196616b0fc6bf9f223b54ae02f1160e9bf32b0fbba715d70111e18c8501
MD5 SHA1 SHA512

Submit Download

70a9b9b8-e57e-458b-a39a-49b629a5c284

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\70a9b9b8-e57e-458b-a39a-49b629a5c284
Size 2KB
SHA256 a1c49a6d554587ac4797e45f676c038bf263c52ec272f671c2989c9dcfb5ecef
MD5 13f7ed739a0aeeabb2c8a44aefd245c7
SHA1 57f21f977de1032d697f510dd4e31c150d4345b8
SHA512 7a15aafd58bbe3ac2c451d836ba953166e2205c00b0752818e6364a1c78cf61b6833122d98b88a605c20d49abe7d3a6b5fa8b6bfa840839e9c133d415a9d1a58
MD5 SHA1 SHA512

Submit Download

81c93306-47bd-4a68-b1d3-7da7fc7390df

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\81c93306-47bd-4a68-b1d3-7da7fc7390df
Size 746B
SHA256 70315e92eab4cc55a64b55e4c4cf907a4d2ca949dce9810336714ea47ec2b67a
MD5 f2bcd8074e8016199c5adbc1d9664b04
SHA1 7b4f6f68c7bbcb14eb3cf672153ee9be4f4d12e0
SHA512 b54b5886bc2be0f68c9b915a695baf8c31cfe36a48a53ebeabff7d8ef81c9be17979f6631a88e100223ee8551e8eaec189817cdd2d866dee1556a568b18a7630
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js
Size 6KB
SHA256 914f964844949147789090c60a924be056d9ecba6a6592547d1e8eb46692f1e8
MD5 89f716317e48439602b52ae16d4302a4
SHA1 4d3287a5830a9248860460852b3811f4cbd0e688
SHA512 17e2246462c6d9bb5210748708bf49bc2ab0ccbe59ac1f79b50859300ce2197266f63d6d07452f2f58c951aed77f444c043967c33c9b86668d1691439e793119
SSDEEP 96:xHu5nUTeqGqKdYMIeOTzSaPXAnpjJHxva2zH4CEBw8HVmcLGS:w5nIRKdYMIe8PXyxy2zHUBw8HVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js
Size 6KB
SHA256 9adb5db2daf04660db43393445050084265ab57e42c66c8499199be41616063e
MD5 c39a16d958cc1f26050ed55b1ba17412
SHA1 2648446a07780043e2c34b58aca0cf600e30dfc7
SHA512 1ff95d55a9d0d6b8ec9048862453f692c990aff47039f7959d886526b4d8cc85b52ce5561c398147176c00ba9d8ff861cb8a7957801afb27fa5fca43dc85a2e3
SSDEEP 96:xHuanUTeqGqKdYMIeOTzSaPXAnpjJHxva2zH4CEBw8HVmcFGS:wanIRKdYMIe8PXyxy2zHUBw8HVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 4a53aa5a879bf54ca8d7d1f04dfde7cd551a1f0e9c3a9d7c873f64f4cc269440
MD5 e6faf547f2a3e516f94c0bf767f5b928
SHA1 f72a86d512624225d462b8e3da38a16eb77a35d0
SHA512 0efc1ebfc078f61571800b1628e8ac6ab23057eb843743c6b6fc5ddf31b148ba52c9dcca2ee1f2e1d9ef6a8b94a2729c15883c5c29ba6f9a6a4c9e68bff651b6
SSDEEP 96:nrqMUc6tE3i68EMJF7dsMZk0zf8W8Qge3ZwS2HGJqyZ:rqMUHE3i6RgFqMZkcuembZi
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 ccb4f4d944d06061e8d6b72e68006dd1df60d50774c7d6203437b3d48053118e
MD5 5a82a6db62e2007f7cac4ec7beff6809
SHA1 f9e58b0a5e836182c2d6529ce61e93996e4b5849
SHA512 cc65a775b430e1fa4db24cc0ec0b74488bb5428db13a5a7eda03fff1e482f53cde666828257ad4ee7bead0177f3de6d20eeece7d593d59c68e94a6480bef8520
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 d8c3bbccc2a1361593923107819348f53ded5b0ff6d4715d22422d8b2c687223
MD5 571c8b0bfaaaacef4a638f9cf2e761fd
SHA1 a59a86e0b6544e5b0eccea5375c1de82fd120a8b
SHA512 ef5f9a2c4c22f62d5e2595c8f1ad52499c1a4d925ed7ec87fbae4c99517b6fd4d9bc94ac9420302a4bbdb07083e4db77e4a098479b86a356d46a1d17e863e53d
SSDEEP 96:nrqMUc6to3i68EMJF7dsMZk0zf8W8Qge3ZwS2HGJpyn:rqMUHo3i6RgFqMZkcuembam
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 c8696a5dbe6a972cdf773073d7e6ffe789f3c5541c97e53ef5eda04ab6d447d0
MD5 7b9a77aec110b1db0ddd712d7f079fc9
SHA1 7af5f9e5ef60bb59c76ce7543af49338fd9d2b75
SHA512 b40f666e021677b1d1868ec82986e26c510ed1009be486b7de080111515adfaf078fc4a293c4771d3fef16a33a6164aeda7766ce9d5fac80b24f0e3c51021a81
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 9820f8e14cd8981e456f70ce0e0ccb20ac46f526c71013b97787ed1beed43d82
MD5 a1ef98496a55e19d461ef01274668cb0
SHA1 a7916cb9825328670263179effd71da11c386ee8
SHA512 758a25ff8ddba51198a308b56d6d323d051aaad081d1342483c802e6fb123f16b768cb9675a534874ba7bdae3179a9b4c1782b8244babb0334582ab8d415135d
SSDEEP 96:nrqMUc6tK43i68EMJF7dsMZk0zf8W8Qge3ZwS2HGJZyZ:rqMUHK43i6RgFqMZkcuembgi
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore.jsonlz4
Size 5KB
SHA256 fd61b63d21ba963a31bdd1107437e20be14b891afa9a0118de9b8b9458882601
MD5 b719f0748ded25d5a4d0a81b660b426e
SHA1 b364300357e381f61b51fff556a33077bd46cea4
SHA512 4d3b111066c99e7521f5ae22e2465da0c717b9bd9c8e5687b6f9c601a45233a2cfe8cfa46842984bf008f826b034ceafa9af299867320d4eb5954678e2c5559b
SSDEEP 96:mQrqMUc6tPAKjxe7G9I4EOWJUunfwAJF77XMZLwUf8W8Qge3ZwS2KpN:m4qMUHj1cG9I4xWUun4EFnMZLwmuemev
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 3ae4677faf8207ed4eb582fbec4f8729b4ec216a5decc9a01f7bd1aae5bdb5b0
MD5 c5af55dbad3364ad6ea9035098d71db2
SHA1 0896c8d895f85ee15b24dc90ff2f6e45223814a8
SHA512 9f1d6e109c5e6dee45b7b448aaf1a140b0855f9e64b058603e839a2479177d18e1e97cc7ccc5bf1698752312cf0275e98797594efdae023980e866db7fe80245
SSDEEP 3072:MmcHDPRuFPF3y346uaS9vAem6ua9QxeHvP9t/:MmcHDPR093y346uaim6ua9QxeH//
MD5 SHA1 SHA512 SSDEEP

Submit Download

LordsBot-Release.zip

Path C:\Users\Admin\Downloads\LordsBot-Release.zip
Size 11.3MB
SHA256 de0c535c1ba2a071c9404f937b7c192c392e679e46d88ba65adb3bc6e267fe73
MD5 d00fa58cd1bdad730755b79a0e9714f5
SHA1 82f21cbc211971e50510b514f503fab6dbb26cfc
SHA512 f8242058cecbfb7ddbd6b86d2d6eff61aee2fc798e5d0d6d171d2c31dcb10c85a947bcba2ec8704197934a4bd92eed1e73d053af0d3d1b70f18c197971d5a031
SSDEEP 196608:DbGXnq2jZjjRYaoaIn27gvSE2wr0Vbogx1IHdhpLtLWQDzAHPp85JyzDfPy8RNnV:DyPjZjdYaoa3EwRo+I9hVFdPonPTRNkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

GL_Eng.ini

Path C:\Users\Admin\Downloads\LordsBot-Release\Language\GL_Eng.ini
Size 103KB
SHA256 098cd9ae983c3f7747c0248475e6aa56d56753038eecae7216c2c3aee0cdf546
MD5 f0bba0bd999fc13f22b40e2e3e0f372d
SHA1 ca08e480238f8d623a73e2c48a52e9a4adbe489e
SHA512 0d79b6dbd1029698f285d57d3f4aaf5a08e41937c141f0ffbf1e494b3e79aef346265402c93887dfda1847cf8a0cbf300be80dceb1aee3b779dc797ae45dbf11
SSDEEP 3072:lor3xqdwo+ySOCF5qnj29TC6xfwPosDqi:loVqn+ySOCFQj2RRwPos3
MD5 SHA1 SHA512 SSDEEP

Submit Download

GL_Kor.ini

Path C:\Users\Admin\Downloads\LordsBot-Release\Language\GL_Kor.ini
Size 103KB
SHA256 ce74a447d9a224606cc0ca12eecc7c6a174254a47f22f237e36765338ba553c3
MD5 9d08d91b8a055a73524ef349d58e302c
SHA1 abe0969a06fe62395dd095088114b97caf76c651
SHA512 456e8569e5d92498fc777b9317c8040fa048750dd9b5c00d09d3a0823fbb8c52464e374097c96cffed87850269956dd0e8fd6f83cdde02a5d9634c6a3a0ae977
SSDEEP 3072:7sVBxqdwo+ySOCFvq5j29TC6xfwPoslAF:7spqn+ySOCFij2RRwPosu
MD5 SHA1 SHA512 SSDEEP

Submit Download

LordsMobileBot.dll.config

Path C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.dll.config
Size 1KB
SHA256 76b2d3852874363a03a9a06510581661bb8b45762ec81a6296643b91980f4acd
MD5 a718311ed71ac3ff0a176092cadf1805
SHA1 46fb4f68bf06abcef5c765561297bd85e21f821e
SHA512 2e3bda5fd7c83a41359ac20892981b8bf1db7565a4b215e533cb08e27e9a83a485b0f980ae357e356186d8ece33dd9e946d1ddf42d2f98f47c9c8d073d3d32b5
MD5 SHA1 SHA512

Submit Download

LordsMobileBot.exe

Path C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe
Size 72.6MB
SHA256 80b151d5190839a375ac7e490914390edd655b7ed14da4119ea2db90213ce40b
MD5 d038625de23ebd20d2fa3bb348efa933
SHA1 411f72be80489be3009c7feed8ac2b7739dd065e
SHA512 fa9cc49843a70af19d446a05dd6e9ef52fc6f3ecfb4c2fe3ee3df27ba0bfb35f647543e88ca804f8ddac6aa750a1c44dcb416c546621245454015998ed0d8e70
SSDEEP 786432:H0tkJqpwjdIrpyWAOfraPCFVp5/P44Tdi8Gurb8:HMks6pIrgWAOfraPC/pisHGuX8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LordsMobileBot.exe

Path C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe
Size 200.3MB
SHA256 b380bc2b932a5ed4f1899cbdfae2e04e33ad401df9109ae45bbb95192316d35d
MD5 800f8861421f562b2ec25ef99ea53d7c
SHA1 c920b98212f27c4735dbeb1279791b490775a5d9
SHA512 a93f6d78bb5afd127de46217cfc9a92dd2c6c0997ca4baf97cba7d4c4071c8a9069969c2b9c4ad69fa042864bf6343db6eb2a1096205abe3b05c2a3070a6467f
SSDEEP 6291456:sk1WAOfraPInVSWAOfraPkWAOfraPZYWAOfraP5WAOfraPeWAOfraPgP:VdP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updater.exe

Path C:\Users\Admin\Downloads\LordsBot-Release\Updater.exe
Size 291KB
SHA256 5bd819f39156fcd389d187f627b745d12eefc1fc8029c09f663d5ac77d0a1737
MD5 96bc22e267319e0714e8bb245d57bff6
SHA1 642adbbbfec80f981a989f56187242b6729b2b1b
SHA512 7afcae303c2079d809d7a374aed17dcc1717c1d4fffa50627d1d599481ec6f1442fc3f6aa988be96f972ccf47f3ebb39de3ec38629d26eda3062f56f28af0709
SSDEEP 3072:Suxespq9bPB/3pudG/GUnpaIvVm1fMk3pudG/GUnpMIrVm1fMByfxeT:jx89bp/51ZQik51LQi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appSettings.json

Path C:\Users\Admin\Downloads\LordsBot-Release\appSettings.json
Size 2KB
SHA256 31ba4b8f8dd7022d03fbd02fc17dd23294276302ca93dc7983f09ac0294fb97a
MD5 77a059894f5b443e282cf65b0b881ead
SHA1 a31d9501ac2afb90fbb1fea2a469a5b75fcaba74
SHA512 e79b80722e15101d1b1372f296a27177ca9b1f86bded897fa395e99acfa13c72ad977c7b0be9cc0148f8a06e1859e40de2ea0b75b088f9bd8e57a25b02d4986a
MD5 SHA1 SHA512

Submit Download

memory/184-3339-0x00007FFEE0180000-0x00007FFEE02E2000-memory.dmp

Download

memory/184-3333-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

Download

memory/184-3368-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

Download

memory/184-3363-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

Download

memory/5204-3345-0x00007FFEE0180000-0x00007FFEE02E2000-memory.dmp

Download

memory/5204-3342-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

Download

memory/5204-3360-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

Download

memory/5804-3361-0x0000000005BD0000-0x0000000006174000-memory.dmp

Download

memory/5804-3362-0x00000000056D0000-0x0000000005762000-memory.dmp

Download

memory/5804-3359-0x0000000000CA0000-0x0000000000CEA000-memory.dmp

Download

memory/5804-3364-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/5804-3365-0x00000000058A0000-0x00000000058AA000-memory.dmp

Download

memory/5804-3367-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/5804-3358-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download