Malware Analysis Report

2024-11-13 13:55

Sample ID 240128-e95yfsbea8
Target https://cdn.lords-bot.com/LordsBot-Release.zip
Tags
asyncrat ducktail rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://cdn.lords-bot.com/LordsBot-Release.zip was found to be: Known bad.

Malicious Activity Summary

asyncrat ducktail rat stealer

Ducktail

Detect Ducktail Third Stage Payload

AsyncRat

Async RAT payload

Executes dropped EXE

Loads dropped DLL

Enumerates system info in registry

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-28 04:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-28 04:39

Reported

2024-01-28 04:43

Platform

win10v2004-20231215-es

Max time kernel

229s

Max time network

222s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.lords-bot.com/LordsBot-Release.zip

Signatures

AsyncRat

rat asyncrat

Detect Ducktail Third Stage Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Ducktail

stealer ducktail

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\LordsBot-Release\Updater.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2000 wrote to memory of 2820 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2820 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 4696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 3648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 3648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2000 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.lords-bot.com/LordsBot-Release.zip

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeec0846f8,0x7ffeec084708,0x7ffeec084718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.0.1851651624\1830430971" -parentBuildID 20221007134813 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe837e99-d9cd-4332-a5a2-66fc7747df56} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1964 1dba89c2e58 gpu

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.1.18859077\307746547" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c25faf0-56d0-4672-be97-1549e7fb70f9} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 2360 1dba8333b58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.2.550943129\1513846453" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3024 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77b8bbf2-5d7e-4273-8c14-0bc35ce1b68c} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 3136 1dba895c958 tab

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.3.1950908356\1783109201" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3504 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e380437f-6902-4754-b59a-5b11747d015b} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 3528 1dbab2d0858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.4.1176389120\1104406271" -childID 3 -isForBrowser -prefsHandle 3764 -prefMapHandle 3756 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c4ceb44-c309-4f59-9d64-ce4f9abb13d0} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 3792 1db9bf5eb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.5.943313973\20503307" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4820 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f70d580-b460-4d01-9974-1b72d666ca9d} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 4848 1dbaadc3758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.6.1810274530\1596668338" -childID 5 -isForBrowser -prefsHandle 4872 -prefMapHandle 3976 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eef7edfb-90d6-4282-b2bc-cadd1fc179a0} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 4880 1dbaadc3458 tab

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=6116 /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.7.1877718249\1820701120" -childID 6 -isForBrowser -prefsHandle 5436 -prefMapHandle 5420 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32439eb3-424d-47c7-87d4-e84a396346ee} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 4760 1dbaef70b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.8.620211539\1213849167" -childID 7 -isForBrowser -prefsHandle 5620 -prefMapHandle 1704 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c1e9f66-36cf-4e6b-9bc1-02d070701d40} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 5672 1dbac458a58 tab

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=1876 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2964 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2964 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\LordsBot-Release\" -spe -an -ai#7zMap28065:94:7zEvent17312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9748385052149628419,17511977405913914810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3892 /prefetch:2

C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe

"C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe"

C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe

"C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe"

C:\Users\Admin\Downloads\LordsBot-Release\Updater.exe

"C:\Users\Admin\Downloads\LordsBot-Release\Updater.exe" --no-diag

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 cdn.lords-bot.com udp
US 172.67.68.100:443 cdn.lords-bot.com tcp
US 8.8.8.8:53 100.68.67.172.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
N/A 127.0.0.1:49503 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 50.112.167.115:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 115.167.112.50.in-addr.arpa udp
N/A 127.0.0.1:49514 tcp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 www.google.com udp
FR 142.250.74.228:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 228.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FR 142.250.74.228:443 www.google.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 35.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 99.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 cdn.lords-bot.com udp
US 104.26.7.22:443 cdn.lords-bot.com tcp
US 104.26.7.22:443 cdn.lords-bot.com tcp
US 8.8.8.8:53 22.7.26.104.in-addr.arpa udp
US 104.26.7.22:443 cdn.lords-bot.com tcp
US 18.190.147.163:7000 tcp
US 8.8.8.8:53 163.147.190.18.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

\??\pipe\LOCAL\crashpad_2000_HAFERJFWBZXADBGR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 25cf5e2674da6b09a5732dd081bdf192
SHA1 5e9b80e226ec8a0c4f29214786f4055f1d990f2b
SHA256 73f603653d7309ba3be3e2a8615f79188d6586b21d2a05b6b11e0508e298619d
SHA512 2d954c0245a60bbcf2b5d8adf7e89b18ace2abd8ab5728a4d535d1e1244b0fe5b77711877f791536236143f6c31098d9c014c8627645f25ae60bae78fc0e52f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9add72d919aa633894a712e89695331d
SHA1 98f2e50502ed63f2e9519e3163d451bd023dbfa0
SHA256 6043a6f53541d716faa667aa14c05d274ae518afa60e8c9c3d5e575a298bfe59
SHA512 2b2aa457d76a483ccac24068dae9892735cc546697637f3b7c2edcbfc25c2c8eecd0cdc5e7732ad46c5020b0840fdce871fbc67aad50be71566f11cc5fa2142d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin

MD5 e4cfa23c03ecb2b7b0886e84b2288947
SHA1 d7e727ae25e8563f9ba829181f87d3aeeef9eb99
SHA256 4895f588931dafb987866a465f9705245f72489e9e657cef096bc3c3f765f6ba
SHA512 69fe308694596bb02b16489eab613315483457f9c9a622e6bade27d1133bbd645ee12694ed31782b8994eb1088b0d8c346d7b8a266a3ef746e0c66a4b4252888

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\70a9b9b8-e57e-458b-a39a-49b629a5c284

MD5 13f7ed739a0aeeabb2c8a44aefd245c7
SHA1 57f21f977de1032d697f510dd4e31c150d4345b8
SHA256 a1c49a6d554587ac4797e45f676c038bf263c52ec272f671c2989c9dcfb5ecef
SHA512 7a15aafd58bbe3ac2c451d836ba953166e2205c00b0752818e6364a1c78cf61b6833122d98b88a605c20d49abe7d3a6b5fa8b6bfa840839e9c133d415a9d1a58

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin

MD5 fcc28d2d1f92f9a8bd6784245fc45012
SHA1 40368893777586683c4bf06e3cfc1628320f37f3
SHA256 7897307fd4d8af0bbea553d65ec019a6ae58130f7ba9848a044222a3bd52d2cf
SHA512 382766ba6a47fec5ba5480a7e86f522374b025d80de1e55e49b76fa09d8a44e8bb32f196616b0fc6bf9f223b54ae02f1160e9bf32b0fbba715d70111e18c8501

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin

MD5 d68826661b4a7470e257a93c37eecc4d
SHA1 b840c98cbe422f9f6442ecf2146006b5517b7319
SHA256 c00c5e355dec9588066202f15b883bfe82c29f0da092a2b6cdac4edbc5ca7344
SHA512 a97bdf2ade08d51402279ec0b4739a0bbfc59a6c9ff972902d8c3a939bb8db87e4da6a798571224ee77e0f036a72d3f2f964bd806e43232757f3ddc14b29ba75

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\81c93306-47bd-4a68-b1d3-7da7fc7390df

MD5 f2bcd8074e8016199c5adbc1d9664b04
SHA1 7b4f6f68c7bbcb14eb3cf672153ee9be4f4d12e0
SHA256 70315e92eab4cc55a64b55e4c4cf907a4d2ca949dce9810336714ea47ec2b67a
SHA512 b54b5886bc2be0f68c9b915a695baf8c31cfe36a48a53ebeabff7d8ef81c9be17979f6631a88e100223ee8551e8eaec189817cdd2d866dee1556a568b18a7630

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2c7c14d895417db8f5ecac3ca3657b4c
SHA1 679c95602bea89c7f91fa556e4bd4dfa893bab75
SHA256 eda9f29ac7c8acb3d6518a9a0f611898901652bf7d76f67067f42f17e45cb1db
SHA512 1c318d8bfb009d27f1ef5fb314be70146b923ec7ea579784b1c38df43b500b2860d109ba7d8d344cbc30760738d6a27420a147ff81892b8f45d7ef164a801f09

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 c5af55dbad3364ad6ea9035098d71db2
SHA1 0896c8d895f85ee15b24dc90ff2f6e45223814a8
SHA256 3ae4677faf8207ed4eb582fbec4f8729b4ec216a5decc9a01f7bd1aae5bdb5b0
SHA512 9f1d6e109c5e6dee45b7b448aaf1a140b0855f9e64b058603e839a2479177d18e1e97cc7ccc5bf1698752312cf0275e98797594efdae023980e866db7fe80245

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js

MD5 89f716317e48439602b52ae16d4302a4
SHA1 4d3287a5830a9248860460852b3811f4cbd0e688
SHA256 914f964844949147789090c60a924be056d9ecba6a6592547d1e8eb46692f1e8
SHA512 17e2246462c6d9bb5210748708bf49bc2ab0ccbe59ac1f79b50859300ce2197266f63d6d07452f2f58c951aed77f444c043967c33c9b86668d1691439e793119

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5a82a6db62e2007f7cac4ec7beff6809
SHA1 f9e58b0a5e836182c2d6529ce61e93996e4b5849
SHA256 ccb4f4d944d06061e8d6b72e68006dd1df60d50774c7d6203437b3d48053118e
SHA512 cc65a775b430e1fa4db24cc0ec0b74488bb5428db13a5a7eda03fff1e482f53cde666828257ad4ee7bead0177f3de6d20eeece7d593d59c68e94a6480bef8520

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7a701b0a9f3c52262fc7626e0bba454d
SHA1 36557e853c8b9e7c81e3ecd67703fe76063a2f38
SHA256 324569ba55fb294a024a5ca6e6a22e8265c70045fad6f5a34ee07beeb3d46ce3
SHA512 a310f67f817be94b8409acf8185ed958a3c623a2fa2286c8f6b13dd8dad6c77e0087af807a6c70c68e1c1e52dd85923aed7a4aa3d120e12af386055ca20629f7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js

MD5 c39a16d958cc1f26050ed55b1ba17412
SHA1 2648446a07780043e2c34b58aca0cf600e30dfc7
SHA256 9adb5db2daf04660db43393445050084265ab57e42c66c8499199be41616063e
SHA512 1ff95d55a9d0d6b8ec9048862453f692c990aff47039f7959d886526b4d8cc85b52ce5561c398147176c00ba9d8ff861cb8a7957801afb27fa5fca43dc85a2e3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7b9a77aec110b1db0ddd712d7f079fc9
SHA1 7af5f9e5ef60bb59c76ce7543af49338fd9d2b75
SHA256 c8696a5dbe6a972cdf773073d7e6ffe789f3c5541c97e53ef5eda04ab6d447d0
SHA512 b40f666e021677b1d1868ec82986e26c510ed1009be486b7de080111515adfaf078fc4a293c4771d3fef16a33a6164aeda7766ce9d5fac80b24f0e3c51021a81

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 571c8b0bfaaaacef4a638f9cf2e761fd
SHA1 a59a86e0b6544e5b0eccea5375c1de82fd120a8b
SHA256 d8c3bbccc2a1361593923107819348f53ded5b0ff6d4715d22422d8b2c687223
SHA512 ef5f9a2c4c22f62d5e2595c8f1ad52499c1a4d925ed7ec87fbae4c99517b6fd4d9bc94ac9420302a4bbdb07083e4db77e4a098479b86a356d46a1d17e863e53d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 1521cfaa776f1b04e9a7ca156813959d
SHA1 f9a071c3a03e130a6b3d29657ddbf08d159de10a
SHA256 4ef96f2facc93c6f8335afcd09c7f58d7a141bb580245f7acfc9930174c91d3e
SHA512 d62de2b005d5e96743313491fb2edeb386cd91eaf56a2fe58e23a56d2789a61ad2a26a5391cbfa9be7da19af47ce0fc8f873eabc29aad42123ff4bf41f6f6711

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e6faf547f2a3e516f94c0bf767f5b928
SHA1 f72a86d512624225d462b8e3da38a16eb77a35d0
SHA256 4a53aa5a879bf54ca8d7d1f04dfde7cd551a1f0e9c3a9d7c873f64f4cc269440
SHA512 0efc1ebfc078f61571800b1628e8ac6ab23057eb843743c6b6fc5ddf31b148ba52c9dcca2ee1f2e1d9ef6a8b94a2729c15883c5c29ba6f9a6a4c9e68bff651b6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x3x6afp6.default-release\cache2\doomed\20130

MD5 b475b1dc182efa9e1d9b140dbc09d686
SHA1 39f8da365f2c88c3405fbacf6bed9398e470dabf
SHA256 ea623a6af6372f89ffa528408b80598f4e17bd7ec31cd8a40ab214b3a3187ebf
SHA512 50b0e6959b61b8ce735d06906060298af5ed9e99ef3efafe7d415475fdd2b55c70a48b8d5a44ff1b2cc70c40e39c1ee7af9d13c0a901373162ae37e838790f13

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a1ef98496a55e19d461ef01274668cb0
SHA1 a7916cb9825328670263179effd71da11c386ee8
SHA256 9820f8e14cd8981e456f70ce0e0ccb20ac46f526c71013b97787ed1beed43d82
SHA512 758a25ff8ddba51198a308b56d6d323d051aaad081d1342483c802e6fb123f16b768cb9675a534874ba7bdae3179a9b4c1782b8244babb0334582ab8d415135d

C:\Users\Admin\Downloads\LordsBot-Release.zip

MD5 d00fa58cd1bdad730755b79a0e9714f5
SHA1 82f21cbc211971e50510b514f503fab6dbb26cfc
SHA256 de0c535c1ba2a071c9404f937b7c192c392e679e46d88ba65adb3bc6e267fe73
SHA512 f8242058cecbfb7ddbd6b86d2d6eff61aee2fc798e5d0d6d171d2c31dcb10c85a947bcba2ec8704197934a4bd92eed1e73d053af0d3d1b70f18c197971d5a031

C:\Users\Admin\Downloads\LordsBot-Release\Language\GL_Kor.ini

MD5 9d08d91b8a055a73524ef349d58e302c
SHA1 abe0969a06fe62395dd095088114b97caf76c651
SHA256 ce74a447d9a224606cc0ca12eecc7c6a174254a47f22f237e36765338ba553c3
SHA512 456e8569e5d92498fc777b9317c8040fa048750dd9b5c00d09d3a0823fbb8c52464e374097c96cffed87850269956dd0e8fd6f83cdde02a5d9634c6a3a0ae977

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore.jsonlz4

MD5 b719f0748ded25d5a4d0a81b660b426e
SHA1 b364300357e381f61b51fff556a33077bd46cea4
SHA256 fd61b63d21ba963a31bdd1107437e20be14b891afa9a0118de9b8b9458882601
SHA512 4d3b111066c99e7521f5ae22e2465da0c717b9bd9c8e5687b6f9c601a45233a2cfe8cfa46842984bf008f826b034ceafa9af299867320d4eb5954678e2c5559b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 25d2756055dbb26f7939ebac00f8a012
SHA1 e2d3f49caefb27583f20e5a1730333bf36361adf
SHA256 962c58ad32823fda24869809221836430e72ca1c627d19b33afdf6dcf371fee5
SHA512 c19be17c70d0912210da8d3c70c7bf409ac5573100f45b63a50d599a33ac48cf39d4dfd0464b0abded1fb735de395c244eff2e08bfe261df32de8b57be20fc62

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e2e565c910a516b57031971a90037400
SHA1 17bef0011db254bba3c7a5c33bcdcfd133582b78
SHA256 fd00d70259493a8302efb7abdd35ef64a354a0cee1492bf53f84a927f7cbf277
SHA512 599e8c04fdb28ce42df8878d2a649716fe3b45eebc815c6144a817dae09544f45cc68511aa505a86f228a0289f5a59128d69c9078c66c2b6d3a19761e06e9cb4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 3fc5d2b80ae2def5050a3967b1c4940b
SHA1 70ed40e2bea8d66a701df3132dba892cfb39d731
SHA256 0acd8e730cf1b8ffab8670824cba10c7cae46155f774e82c0c688fead3531ca4
SHA512 7d37456c66fbfe6bd2fbbc7f24a56909b4a318518ec1206dc58618f9ff27ca0dbc3bcc6e8c1a01c255390ec189fce0fc5912d2763b0630277bdd16fa01cd8ca9

C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe

MD5 d038625de23ebd20d2fa3bb348efa933
SHA1 411f72be80489be3009c7feed8ac2b7739dd065e
SHA256 80b151d5190839a375ac7e490914390edd655b7ed14da4119ea2db90213ce40b
SHA512 fa9cc49843a70af19d446a05dd6e9ef52fc6f3ecfb4c2fe3ee3df27ba0bfb35f647543e88ca804f8ddac6aa750a1c44dcb416c546621245454015998ed0d8e70

C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.exe

MD5 800f8861421f562b2ec25ef99ea53d7c
SHA1 c920b98212f27c4735dbeb1279791b490775a5d9
SHA256 b380bc2b932a5ed4f1899cbdfae2e04e33ad401df9109ae45bbb95192316d35d
SHA512 a93f6d78bb5afd127de46217cfc9a92dd2c6c0997ca4baf97cba7d4c4071c8a9069969c2b9c4ad69fa042864bf6343db6eb2a1096205abe3b05c2a3070a6467f

memory/184-3333-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DN40B6560D6598ABA0\HVMRun64.dll

MD5 21184c4444b13c67546c7acf7f6ad8e3
SHA1 806fb111900a0ec8bee1f658c6828b9e005f1111
SHA256 14f61c269509eb27083883d5e8edcf9ed14f3b62cfbfb69f4f7434d64a7fa924
SHA512 9c55f71051f7c83d8644c7eaf500a5ea887aa75886480fcb607e3540f482afde0cc11396e3c2be936bd6418ce76a752132391c97b2620927a9a694eee99380eb

memory/184-3339-0x00007FFEE0180000-0x00007FFEE02E2000-memory.dmp

C:\Users\Admin\Downloads\LordsBot-Release\LordsMobileBot.dll.config

MD5 a718311ed71ac3ff0a176092cadf1805
SHA1 46fb4f68bf06abcef5c765561297bd85e21f821e
SHA256 76b2d3852874363a03a9a06510581661bb8b45762ec81a6296643b91980f4acd
SHA512 2e3bda5fd7c83a41359ac20892981b8bf1db7565a4b215e533cb08e27e9a83a485b0f980ae357e356186d8ece33dd9e946d1ddf42d2f98f47c9c8d073d3d32b5

memory/5204-3342-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

memory/5204-3345-0x00007FFEE0180000-0x00007FFEE02E2000-memory.dmp

C:\Users\Admin\Downloads\LordsBot-Release\appSettings.json

MD5 77a059894f5b443e282cf65b0b881ead
SHA1 a31d9501ac2afb90fbb1fea2a469a5b75fcaba74
SHA256 31ba4b8f8dd7022d03fbd02fc17dd23294276302ca93dc7983f09ac0294fb97a
SHA512 e79b80722e15101d1b1372f296a27177ca9b1f86bded897fa395e99acfa13c72ad977c7b0be9cc0148f8a06e1859e40de2ea0b75b088f9bd8e57a25b02d4986a

C:\Users\Admin\Downloads\LordsBot-Release\Language\GL_Eng.ini

MD5 f0bba0bd999fc13f22b40e2e3e0f372d
SHA1 ca08e480238f8d623a73e2c48a52e9a4adbe489e
SHA256 098cd9ae983c3f7747c0248475e6aa56d56753038eecae7216c2c3aee0cdf546
SHA512 0d79b6dbd1029698f285d57d3f4aaf5a08e41937c141f0ffbf1e494b3e79aef346265402c93887dfda1847cf8a0cbf300be80dceb1aee3b779dc797ae45dbf11

C:\Users\Admin\Downloads\LordsBot-Release\Updater.exe

MD5 96bc22e267319e0714e8bb245d57bff6
SHA1 642adbbbfec80f981a989f56187242b6729b2b1b
SHA256 5bd819f39156fcd389d187f627b745d12eefc1fc8029c09f663d5ac77d0a1737
SHA512 7afcae303c2079d809d7a374aed17dcc1717c1d4fffa50627d1d599481ec6f1442fc3f6aa988be96f972ccf47f3ebb39de3ec38629d26eda3062f56f28af0709

memory/5804-3358-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/5804-3359-0x0000000000CA0000-0x0000000000CEA000-memory.dmp

memory/5204-3360-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

memory/5804-3361-0x0000000005BD0000-0x0000000006174000-memory.dmp

memory/5804-3362-0x00000000056D0000-0x0000000005762000-memory.dmp

memory/184-3363-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp

memory/5804-3364-0x00000000056B0000-0x00000000056C0000-memory.dmp

memory/5804-3365-0x00000000058A0000-0x00000000058AA000-memory.dmp

memory/5804-3367-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/184-3368-0x00007FFEE02F0000-0x00007FFEE07EE000-memory.dmp