hxxps://github[.]com/enforcer-pro/ddostor

Resubmissions

18/04/2024, 20:25

240418-y7llksfb61 7

18/04/2024, 20:23

18/04/2024, 20:21

18/04/2024, 20:18

18/04/2024, 20:16

18/04/2024, 20:12

Analysis

max time kernel
142s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/enforcer-pro/ddostor

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	camo.githubusercontent.com
20	camo.githubusercontent.com

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.py	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell\Read	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.py\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\기ޡĀ谀疙	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\기ޡĀ谀疙\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❟璀㈀谀耙	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❘璃㄀耀⩠	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❟璀㈀谀耙\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.md	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❘璃㄀耀⩠􀗠\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell\Read\command	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ddostor-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4768	Winword.exe
4768	Winword.exe
2416	Winword.exe
2416	Winword.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
228	msedge.exe
228	msedge.exe
4112	msedge.exe
4112	msedge.exe
4188	msedge.exe
4188	msedge.exe
1932	identity_helper.exe
1932	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1232	OpenWith.exe
2772	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
4768	Winword.exe
4768	Winword.exe
4768	Winword.exe
4768	Winword.exe
4768	Winword.exe
4768	Winword.exe
4768	Winword.exe
4768	Winword.exe
2772	OpenWith.exe
2772	OpenWith.exe
2772	OpenWith.exe
2772	OpenWith.exe
2772	OpenWith.exe
2772	OpenWith.exe
2772	OpenWith.exe
2772	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 2248	228	msedge.exe	78
PID 228 wrote to memory of 2248	228	msedge.exe	78
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 3308	228	msedge.exe	79
PID 228 wrote to memory of 656	228	msedge.exe	80
PID 228 wrote to memory of 656	228	msedge.exe	80
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81
PID 228 wrote to memory of 2988	228	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/enforcer-pro/ddostor
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffeac73cb8,0x7fffeac73cc8,0x7fffeac73cd8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1232
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\ddostor-master\torshammer\terminal.py"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:1448
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=83EBB38C69148DB5D5047100E6BEDBA2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9CBAB56BACC1C4DA57F1683223D17A43 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9CBAB56BACC1C4DA57F1683223D17A43 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=95D1CC760846587514B51FED70EE9A37 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:576
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F3B39BED4602CA313A1F543D6FA41D7 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=653BB4673E7C398687D70DFB2E5A03A0 --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3528
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\ddostor-master\LICENSE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2772
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\ddostor-master\README.md"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  PID:2416
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4056

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

Filesize
264KB

MD5
7594e518f3d17db647df675e548cf4f3

SHA1
ae1daa42d102cb8d3b22ae6757ff0d4a7bab0cb8

SHA256
55cd71f60d95fefea3b21bfe8b8075ed0571ade03fa22da70ac7f79bf9b5f53f

SHA512
b0d7c20590585278fa70c30a6bb500749b2fc781abe07542cefb9397d52fcd4e6b86cacf2fc1241ab5b6c06c114e18dcbe3e665b7ce73a40573a97739013385c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
471B

MD5
e411939eaec8248aa2b59c54e076f3c5

SHA1
dc54f17b82f5fb1acb4349b4c664364d511e0b56

SHA256
5745325aca37279bf7e4a0e6e3abd2fbb70c729562284566e8791bd6cea3cd26

SHA512
57cb7b3ef0b192ca89c1bf4162f221d5dddc431532a0fbf684ca248e15d75c7dd9fb0f4a3082ed18ce0ccf9b2e8c9a5fa8d1a00549d932cdfad6f47d737c9666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
412B

MD5
5c387217abfa803137a368007133dac3

SHA1
3669607639cf311e7116e8ba6c377861a2cd370d

SHA256
6eedd715ab52227877bdb636dbf4a5423159e3399c3dce91c9e206d6b4d32fab

SHA512
998d534458726c4ca0c0e1f4cbfc07c5ee1f06ba23b4c022cefa7a3d4e38f23c1d871ca93c40e803b36140780e75ec2d8d8552755a812f8f53e0b88e357eefbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1a9c7fa806c60a3c2ed8a7829b1461f

SHA1
376cafc1b1b6b2a70cd56455124554c21b25c683

SHA256
1eb39b1409ce78188c133089bf3660393ac043b5baade7ff322df5a0ca95380b

SHA512
e1cb2f84b5cbd86b107c0a9ec0356ab65a54c91208f9f8e83fec64bf17ae89356a09b0cd39d2726424f4041d7b25b962c23672b8645c2e10f11ff4d2075f4afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f3f6e86c8b7bdc605f5559df800bfd34

SHA1
862d05bfba760ae8adcbb509216dc18ead59a6b2

SHA256
5dfe9be21d4916615025055f1a70151362bdb404b40f074685e39b33ad545a78

SHA512
de576ebf0cbe1c5e7639c42517253796cf4b5770298271ac2e6958404998f2d6b8e3378a535f2f316f4020fd8e60b5cc9c1b6b5171d307ca3215afe8ac47a7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cdadafb4ac602019bec7e90116c37259

SHA1
f3ae1bebb7335e43047c6b15ec888070e803a056

SHA256
fcdc486c83dbd85eeaffc8439db8c65349762d1bcce305f72b0a8158ee0c5eb1

SHA512
92f2b4b3c51442c7e01533c424e662f2bad92f0c7ebe7754eed7a2c7e9c1198c588a072505f3c79f125f8e7d116a3090b8b769b53149286caa401fdbd387dbf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
748B

MD5
609c08297e744cb6999eee11f3e4818b

SHA1
c1b0cccdf55696490ed5433eb705af545e2cf6f5

SHA256
b2c95269d48f9b60131b7fff74972f5b9f7a2e3a5552e2ef58730b3be2f999d5

SHA512
096bf3c9ca6232e9a57f15b1970698558ca2fa7c6facad6fe9f5a5f0d67c55cf81f833f82e90f758fa2f7a8b7c267495b0c61529e57d410805dafc56f9049ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
346b1fa9aba06b9d6d16ca01092116f1

SHA1
14202478c55b5ef3c9d96f4809f0341fad678958

SHA256
351d9b4fc787e122e33553cc4cc2e80946216029a74b3b32d661febbbaa7e0d8

SHA512
7d7e56bfa398100c630e50b6a7fc54cf805e3dcb07d7c864b957525035b677fdff2b26a7e3622b167269a5095a6297623395c2b1baa64c1aa240f17bcdccdbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42df88d66a345ffa3292a38114d98b98

SHA1
806ebe94094d6f2b4f4516fb6a6e38dee471ac05

SHA256
9cc084fa5920f8f4237d93474245b7841ab74aac5c26e70a34352ad2f5f39cdf

SHA512
a73b50e977ee38fe25d926e9af20163ee586edac242777c5bfbc050f5bd8317c272eca53cc224793a2446e62d7148cf533725039b3d47dea0b5b8922959e01e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b76acc5fb02d19d7cc6c32f2d284144c

SHA1
878b4120162713c95cb694156a98ecf3977378ae

SHA256
a2b9d77d82e3ede4ba37c5541e9d838032c9303ae7eb8eea7270968fbd62d2d6

SHA512
f86f7d2e6cbc914106337c1b2f7fcd1663849a6a976efda4cfce2123cd5f999be0fc8d1d7d450e718507c49936a551a4c25ef65620a5202c0eb31ecacad797ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87492010053610bde87e49847fc9dfad

SHA1
8d243af2ad24575f77a6ffb15270e1570bac05bc

SHA256
50e45e190635c047df46c104cf19bbd5ea1eac675c7eaaf7d2f02980cbbe4ef0

SHA512
8c67bcc534dc6bd59be7d4e68f034a7d7fb845ee435af6c27177c39d416ce5ae98d1b69d7a76870fb8629fb19174490da59438c34e6c8d606b6121580110c271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4afd3d70b8e9a929f9c9c30ca9a37c0f

SHA1
7fbe8032d4477f0d02379e075094235b2f0a627e

SHA256
8ca05afcd1f79c44f80238b81a7d3813d5cda757a10fb6d129ce061b22689943

SHA512
ab05c4717daa96af5ec2b655e9b3c8f169f7996cb5724370701cb65bb566d0896ee629f819a34e9e218c6459c7d9ae7b614f1a4375bff71e291c947b7dfbc4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6EA4D4E7-6ACB-4F40-AE92-7373AF176E38

Filesize
160KB

MD5
1a1040039655a2fc1c8f6ebf0ba85882

SHA1
0c6b03c931917be1812da9a412d3ebf7b1b82e17

SHA256
d9f7f8fc450aa1597779bce4bdc57be0f2a7b1d3861775293fc1773efd1f04dc

SHA512
f1e16b79dc7f5394b11269325f07c37531ad1371a487441b9208d8a305cb79c024e3e85a1eb58a47151e119adbc46743680b56974b8e1ca3ea97d07bcb833218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
21KB

MD5
765160c605026839079cbb084c713b53

SHA1
731d297de4ee0d33d30daead1eb192df21f3c43d

SHA256
4e9e34cba87dbe518dee3af005dfa36a261680de6f9de0c3b8dadd060981f49a

SHA512
61b1488698f277f68cb797194bd14207d4a8c6ccb0d53727db3a9b3717356f4c887b48e930892bec499ae5039f2b7eaca07b64029b88c8bd1462de6adb21e4e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
3ebe55a40568980de53105070f10621f

SHA1
2f6bf7aef75520f36aff51d062f9b68ab6fa2196

SHA256
f7dc17788bc79f3b4fd406fa0118fc81da0177844705b2eea4b4afc1ae6351da

SHA512
0b38fb6caf12abba2da494d7797ffa22da867b49e6bf6cd40cb11ec46e3fadb214c7f7180c15f267ea2f1104ec41742a4f7218fa3d2051d814bce99db767743f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0001.docx

Filesize
11KB

MD5
a532689987113ed0d6a0a7a5df970b71

SHA1
21680701c02df9572a1a888a85917d6d1b8f712b

SHA256
5a24c238899865cf7af777917e1b25306f72b61a887bc6cf2364f1d4d454532b

SHA512
1f6a17bd2ed695d501b338669f4f1226184a3b7f01d536b88eb137f2022950a079b69c7b6f765ef55ce692323f883d0b14a2283d1e19ecd154b7914dc4e65e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0003.docx

Filesize
11KB

MD5
ceef1bdebb0d8f111b81b5dbd976f4b1

SHA1
b987d3f620b735c3b2ddddf13d6f2c1b035540fb

SHA256
8c7f406f3631990c4a3bbb7208aedfda5dd92114b9bf2a30f24f4e19cedd656f

SHA512
2b7e42b911d8c74faad7ae149c780e3c76a6b73c6acbfd9eac4065da27182571c8f34db1fce6094f629243ab876c2c456ac0d63fce19ff2845d23509c1d57474

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD4EEA.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
213B

MD5
3377e8831a6ea35526ab7e58c787db2f

SHA1
1e26d37949cd131b3dad68a39f9a5b36970691bc

SHA256
12f8fb8021ae86a5a7bb4b216989d2868bac5c39a7fae09db1aa358eefeb9f59

SHA512
fdcd846603b4755de78d20ecbc341539862316e1ff7dd7452f1f6213ac8a2cb5c51b91d2f967572a4e358f3509ced61b66c107470b5e05993c4cc6cb41bb4ac1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
254B

MD5
eb82e2bbb301b5a7e6c8754b2750512f

SHA1
e0e1a9db87748dcf962eb59cee59f3ead2527500

SHA256
2946e2ddf19d392d4b080b5a586254f7335fb821a56063a81b70501bb544cfda

SHA512
533dfc3f4539618d58dcd671296655a8dd4d9ae776f1b998317e52777f33e64add02497567d9c461f4a0eacaefd821eb0b34123daaaff4555085149855efa0e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
c4b3154a014a8060f1d397f69703f785

SHA1
5d3299e53a55efa0d27abc848d788471365f696f

SHA256
5efddf8610543837129ae24d40c0b21dd10cb183765070b2ebc78baa418629c0

SHA512
04539a2b16bd0f34a37fa4180e156f35f139e7632d758f06d44c969c578bfb8e40324d248ddc83b13b59ac8cdbb19838026654fe72f0c555a436437e1208bcc7

Download Submit
C:\Users\Admin\Downloads\ddostor-master.zip

Filesize
23KB

MD5
644f98d440c23deb8a7b4b29be4c8aa0

SHA1
be93c232c37066c42dd015fd858691a35e3d4c48

SHA256
e50931ba3cffdbd98d393b33a879fec9298708930203812dde5aaa066b5ada61

SHA512
4a6c5b9160dad154318db7e8956313598c0dbddda4732028fc1ff080dc2e3e37d67fc299e0d90158dfd996cb362e2a0ac274314d730cc2fc80ae0dfb7362e6bc

Download Submit
C:\Users\Admin\Downloads\ddostor-master.zip:Zone.Identifier

Filesize
159B

MD5
b244e68d4e240576fed718d67db12eb9

SHA1
2f485863c4f4525a59bed06a0adac04b8db8845c

SHA256
504bf7a8549720a309d87b8bfda1d60931ed2df98f64e666057fea49bb1f2a0b

SHA512
780b2ca10c3ab28a54a496026cc1f6b1cb8f88af9a8055edc4ce9dc2eed7011f9507d7d403e97a40619e7526a95a1bb0c4a5c8585660d30ab9aba0362c9ec59e

Download Submit
memory/2416-425-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-401-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-413-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-926-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-925-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-968-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-420-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-428-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-924-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-427-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp

Filesize
756KB

Download
memory/2416-399-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-430-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-403-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-405-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-407-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-408-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-409-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-411-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-412-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-969-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp

Filesize
756KB

Download
memory/2416-923-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-424-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-421-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/2416-423-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-343-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-397-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp

Filesize
756KB

Download
memory/4768-396-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-395-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-394-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-393-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-392-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-354-0x00007FFFB7870000-0x00007FFFB7880000-memory.dmp

Filesize
64KB

Download
memory/4768-353-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-350-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-352-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp

Filesize
756KB

Download
memory/4768-351-0x00007FFFB7870000-0x00007FFFB7880000-memory.dmp

Filesize
64KB

Download
memory/4768-349-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-348-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-347-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-346-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-341-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-342-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-345-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-344-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-340-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-339-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp

Filesize
2.0MB

Download
memory/4768-338-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download
memory/4768-337-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp

Filesize
64KB

Download