Analysis Overview
Threat Level: Shows suspicious behavior
The file https://github.com/enforcer-pro/ddostor was found to be: Shows suspicious behavior.
Malicious Activity Summary
Legitimate hosting services abused for malware hosting/C2
Suspicious use of FindShellTrayWindow
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Enumerates system info in registry
Suspicious use of SetWindowsHookEx
NTFS ADS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-18 20:12
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-18 20:12
Reported
2024-04-18 20:15
Platform
win11-20240412-en
Max time kernel
142s
Max time network
150s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | camo.githubusercontent.com | N/A | N/A |
| N/A | camo.githubusercontent.com | N/A | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.py | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell\Read | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\"" | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.py\ = "py_auto_file" | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.md\ = "md_auto_file" | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\기ޡĀ谀疙 | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\기ޡĀ谀疙\ = "py_auto_file" | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❟璀㈀谀耙 | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1" | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❘璃耀⩠ | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\md_auto_file\shell\edit\command | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❟璀㈀谀耙\ = "md_auto_file" | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\.md | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\❘璃耀⩠\ = "md_auto_file" | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\py_auto_file\shell\Read\command | C:\Windows\system32\OpenWith.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\ddostor-master.zip:Zone.Identifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\root\Office16\Winword.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/enforcer-pro/ddostor
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffeac73cb8,0x7fffeac73cc8,0x7fffeac73cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1748 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6496 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14979642254339177210,6294826243580481224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\ddostor-master\torshammer\terminal.py"
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=83EBB38C69148DB5D5047100E6BEDBA2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9CBAB56BACC1C4DA57F1683223D17A43 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9CBAB56BACC1C4DA57F1683223D17A43 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=95D1CC760846587514B51FED70EE9A37 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F3B39BED4602CA313A1F543D6FA41D7 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=653BB4673E7C398687D70DFB2E5A03A0 --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files\Microsoft Office\root\Office16\Winword.exe
"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\ddostor-master\LICENSE"
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files\Microsoft Office\root\Office16\Winword.exe
"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\ddostor-master\README.md"
C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.133:443 | avatars.githubusercontent.com | tcp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 140.82.114.21:443 | collector.github.com | tcp |
| US | 140.82.114.21:443 | collector.github.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.216:443 | codeload.github.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| NL | 23.62.61.162:443 | metadata.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 2.17.251.17:443 | binaries.templates.cdn.office.net | tcp |
| US | 13.107.21.200:443 | www.bing.com | tcp |
| NL | 23.62.61.171:443 | r.bing.com | tcp |
| NL | 23.62.61.171:443 | r.bing.com | tcp |
| NL | 23.62.61.171:443 | r.bing.com | tcp |
| NL | 23.62.61.171:443 | r.bing.com | tcp |
| NL | 23.62.61.171:443 | r.bing.com | tcp |
| NL | 23.62.61.171:443 | r.bing.com | tcp |
| US | 52.168.117.168:443 | browser.pipe.aria.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f3f6e86c8b7bdc605f5559df800bfd34 |
| SHA1 | 862d05bfba760ae8adcbb509216dc18ead59a6b2 |
| SHA256 | 5dfe9be21d4916615025055f1a70151362bdb404b40f074685e39b33ad545a78 |
| SHA512 | de576ebf0cbe1c5e7639c42517253796cf4b5770298271ac2e6958404998f2d6b8e3378a535f2f316f4020fd8e60b5cc9c1b6b5171d307ca3215afe8ac47a7c3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f1a9c7fa806c60a3c2ed8a7829b1461f |
| SHA1 | 376cafc1b1b6b2a70cd56455124554c21b25c683 |
| SHA256 | 1eb39b1409ce78188c133089bf3660393ac043b5baade7ff322df5a0ca95380b |
| SHA512 | e1cb2f84b5cbd86b107c0a9ec0356ab65a54c91208f9f8e83fec64bf17ae89356a09b0cd39d2726424f4041d7b25b962c23672b8645c2e10f11ff4d2075f4afd |
\??\pipe\LOCAL\crashpad_228_IVGLDSQWQXDPXOWD
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 346b1fa9aba06b9d6d16ca01092116f1 |
| SHA1 | 14202478c55b5ef3c9d96f4809f0341fad678958 |
| SHA256 | 351d9b4fc787e122e33553cc4cc2e80946216029a74b3b32d661febbbaa7e0d8 |
| SHA512 | 7d7e56bfa398100c630e50b6a7fc54cf805e3dcb07d7c864b957525035b677fdff2b26a7e3622b167269a5095a6297623395c2b1baa64c1aa240f17bcdccdbb0 |
C:\Users\Admin\Downloads\ddostor-master.zip
| MD5 | 644f98d440c23deb8a7b4b29be4c8aa0 |
| SHA1 | be93c232c37066c42dd015fd858691a35e3d4c48 |
| SHA256 | e50931ba3cffdbd98d393b33a879fec9298708930203812dde5aaa066b5ada61 |
| SHA512 | 4a6c5b9160dad154318db7e8956313598c0dbddda4732028fc1ff080dc2e3e37d67fc299e0d90158dfd996cb362e2a0ac274314d730cc2fc80ae0dfb7362e6bc |
C:\Users\Admin\Downloads\ddostor-master.zip:Zone.Identifier
| MD5 | b244e68d4e240576fed718d67db12eb9 |
| SHA1 | 2f485863c4f4525a59bed06a0adac04b8db8845c |
| SHA256 | 504bf7a8549720a309d87b8bfda1d60931ed2df98f64e666057fea49bb1f2a0b |
| SHA512 | 780b2ca10c3ab28a54a496026cc1f6b1cb8f88af9a8055edc4ce9dc2eed7011f9507d7d403e97a40619e7526a95a1bb0c4a5c8585660d30ab9aba0362c9ec59e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 87492010053610bde87e49847fc9dfad |
| SHA1 | 8d243af2ad24575f77a6ffb15270e1570bac05bc |
| SHA256 | 50e45e190635c047df46c104cf19bbd5ea1eac675c7eaaf7d2f02980cbbe4ef0 |
| SHA512 | 8c67bcc534dc6bd59be7d4e68f034a7d7fb845ee435af6c27177c39d416ce5ae98d1b69d7a76870fb8629fb19174490da59438c34e6c8d606b6121580110c271 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b76acc5fb02d19d7cc6c32f2d284144c |
| SHA1 | 878b4120162713c95cb694156a98ecf3977378ae |
| SHA256 | a2b9d77d82e3ede4ba37c5541e9d838032c9303ae7eb8eea7270968fbd62d2d6 |
| SHA512 | f86f7d2e6cbc914106337c1b2f7fcd1663849a6a976efda4cfce2123cd5f999be0fc8d1d7d450e718507c49936a551a4c25ef65620a5202c0eb31ecacad797ad |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | cdadafb4ac602019bec7e90116c37259 |
| SHA1 | f3ae1bebb7335e43047c6b15ec888070e803a056 |
| SHA256 | fcdc486c83dbd85eeaffc8439db8c65349762d1bcce305f72b0a8158ee0c5eb1 |
| SHA512 | 92f2b4b3c51442c7e01533c424e662f2bad92f0c7ebe7754eed7a2c7e9c1198c588a072505f3c79f125f8e7d116a3090b8b769b53149286caa401fdbd387dbf6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 4afd3d70b8e9a929f9c9c30ca9a37c0f |
| SHA1 | 7fbe8032d4477f0d02379e075094235b2f0a627e |
| SHA256 | 8ca05afcd1f79c44f80238b81a7d3813d5cda757a10fb6d129ce061b22689943 |
| SHA512 | ab05c4717daa96af5ec2b655e9b3c8f169f7996cb5724370701cb65bb566d0896ee629f819a34e9e218c6459c7d9ae7b614f1a4375bff71e291c947b7dfbc4e7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 42df88d66a345ffa3292a38114d98b98 |
| SHA1 | 806ebe94094d6f2b4f4516fb6a6e38dee471ac05 |
| SHA256 | 9cc084fa5920f8f4237d93474245b7841ab74aac5c26e70a34352ad2f5f39cdf |
| SHA512 | a73b50e977ee38fe25d926e9af20163ee586edac242777c5bfbc050f5bd8317c272eca53cc224793a2446e62d7148cf533725039b3d47dea0b5b8922959e01e8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 609c08297e744cb6999eee11f3e4818b |
| SHA1 | c1b0cccdf55696490ed5433eb705af545e2cf6f5 |
| SHA256 | b2c95269d48f9b60131b7fff74972f5b9f7a2e3a5552e2ef58730b3be2f999d5 |
| SHA512 | 096bf3c9ca6232e9a57f15b1970698558ca2fa7c6facad6fe9f5a5f0d67c55cf81f833f82e90f758fa2f7a8b7c267495b0c61529e57d410805dafc56f9049ab2 |
C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1
| MD5 | 7594e518f3d17db647df675e548cf4f3 |
| SHA1 | ae1daa42d102cb8d3b22ae6757ff0d4a7bab0cb8 |
| SHA256 | 55cd71f60d95fefea3b21bfe8b8075ed0571ade03fa22da70ac7f79bf9b5f53f |
| SHA512 | b0d7c20590585278fa70c30a6bb500749b2fc781abe07542cefb9397d52fcd4e6b86cacf2fc1241ab5b6c06c114e18dcbe3e665b7ce73a40573a97739013385c |
memory/4768-337-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-338-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-339-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-340-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-343-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-344-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-345-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-342-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-341-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-346-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-347-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-348-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-349-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-351-0x00007FFFB7870000-0x00007FFFB7880000-memory.dmp
memory/4768-352-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp
memory/4768-350-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-353-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-354-0x00007FFFB7870000-0x00007FFFB7880000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
| MD5 | 3377e8831a6ea35526ab7e58c787db2f |
| SHA1 | 1e26d37949cd131b3dad68a39f9a5b36970691bc |
| SHA256 | 12f8fb8021ae86a5a7bb4b216989d2868bac5c39a7fae09db1aa358eefeb9f59 |
| SHA512 | fdcd846603b4755de78d20ecbc341539862316e1ff7dd7452f1f6213ac8a2cb5c51b91d2f967572a4e358f3509ced61b66c107470b5e05993c4cc6cb41bb4ac1 |
memory/4768-392-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-393-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-394-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-395-0x00007FFFB9A90000-0x00007FFFB9AA0000-memory.dmp
memory/4768-396-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/4768-397-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp
memory/2416-399-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-401-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-403-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-405-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-407-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-408-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-409-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-411-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-412-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6EA4D4E7-6ACB-4F40-AE92-7373AF176E38
| MD5 | 1a1040039655a2fc1c8f6ebf0ba85882 |
| SHA1 | 0c6b03c931917be1812da9a412d3ebf7b1b82e17 |
| SHA256 | d9f7f8fc450aa1597779bce4bdc57be0f2a7b1d3861775293fc1773efd1f04dc |
| SHA512 | f1e16b79dc7f5394b11269325f07c37531ad1371a487441b9208d8a305cb79c024e3e85a1eb58a47151e119adbc46743680b56974b8e1ca3ea97d07bcb833218 |
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json
| MD5 | 6ca4960355e4951c72aa5f6364e459d5 |
| SHA1 | 2fd90b4ec32804dff7a41b6e63c8b0a40b592113 |
| SHA256 | 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3 |
| SHA512 | 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d |
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json
| MD5 | f1b59332b953b3c99b3c95a44249c0d2 |
| SHA1 | 1b16a2ca32bf8481e18ff8b7365229b598908991 |
| SHA256 | 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c |
| SHA512 | 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4 |
memory/2416-421-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-423-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-424-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-427-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp
memory/2416-425-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-428-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-420-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json
| MD5 | c56ff60fbd601e84edd5a0ff1010d584 |
| SHA1 | 342abb130dabeacde1d8ced806d67a3aef00a749 |
| SHA256 | 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c |
| SHA512 | acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e |
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json
| MD5 | e4e83f8123e9740b8aa3c3dfa77c1c04 |
| SHA1 | 5281eae96efde7b0e16a1d977f005f0d3bd7aad0 |
| SHA256 | 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31 |
| SHA512 | bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9 |
memory/2416-413-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-430-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
| MD5 | eb82e2bbb301b5a7e6c8754b2750512f |
| SHA1 | e0e1a9db87748dcf962eb59cee59f3ead2527500 |
| SHA256 | 2946e2ddf19d392d4b080b5a586254f7335fb821a56063a81b70501bb544cfda |
| SHA512 | 533dfc3f4539618d58dcd671296655a8dd4d9ae776f1b998317e52777f33e64add02497567d9c461f4a0eacaefd821eb0b34123daaaff4555085149855efa0e6 |
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
| MD5 | 765160c605026839079cbb084c713b53 |
| SHA1 | 731d297de4ee0d33d30daead1eb192df21f3c43d |
| SHA256 | 4e9e34cba87dbe518dee3af005dfa36a261680de6f9de0c3b8dadd060981f49a |
| SHA512 | 61b1488698f277f68cb797194bd14207d4a8c6ccb0d53727db3a9b3717356f4c887b48e930892bec499ae5039f2b7eaca07b64029b88c8bd1462de6adb21e4e6 |
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
| MD5 | 3ebe55a40568980de53105070f10621f |
| SHA1 | 2f6bf7aef75520f36aff51d062f9b68ab6fa2196 |
| SHA256 | f7dc17788bc79f3b4fd406fa0118fc81da0177844705b2eea4b4afc1ae6351da |
| SHA512 | 0b38fb6caf12abba2da494d7797ffa22da867b49e6bf6cd40cb11ec46e3fadb214c7f7180c15f267ea2f1104ec41742a4f7218fa3d2051d814bce99db767743f |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
| MD5 | c4b3154a014a8060f1d397f69703f785 |
| SHA1 | 5d3299e53a55efa0d27abc848d788471365f696f |
| SHA256 | 5efddf8610543837129ae24d40c0b21dd10cb183765070b2ebc78baa418629c0 |
| SHA512 | 04539a2b16bd0f34a37fa4180e156f35f139e7632d758f06d44c969c578bfb8e40324d248ddc83b13b59ac8cdbb19838026654fe72f0c555a436437e1208bcc7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
| MD5 | 5c387217abfa803137a368007133dac3 |
| SHA1 | 3669607639cf311e7116e8ba6c377861a2cd370d |
| SHA256 | 6eedd715ab52227877bdb636dbf4a5423159e3399c3dce91c9e206d6b4d32fab |
| SHA512 | 998d534458726c4ca0c0e1f4cbfc07c5ee1f06ba23b4c022cefa7a3d4e38f23c1d871ca93c40e803b36140780e75ec2d8d8552755a812f8f53e0b88e357eefbf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
| MD5 | e411939eaec8248aa2b59c54e076f3c5 |
| SHA1 | dc54f17b82f5fb1acb4349b4c664364d511e0b56 |
| SHA256 | 5745325aca37279bf7e4a0e6e3abd2fbb70c729562284566e8791bd6cea3cd26 |
| SHA512 | 57cb7b3ef0b192ca89c1bf4162f221d5dddc431532a0fbf684ca248e15d75c7dd9fb0f4a3082ed18ce0ccf9b2e8c9a5fa8d1a00549d932cdfad6f47d737c9666 |
C:\Users\Admin\AppData\Local\Temp\TCD4EEA.tmp\sist02.xsl
| MD5 | f883b260a8d67082ea895c14bf56dd56 |
| SHA1 | 7954565c1f243d46ad3b1e2f1baf3281451fc14b |
| SHA256 | ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353 |
| SHA512 | d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e |
memory/2416-923-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-924-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-925-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-926-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0001.docx
| MD5 | a532689987113ed0d6a0a7a5df970b71 |
| SHA1 | 21680701c02df9572a1a888a85917d6d1b8f712b |
| SHA256 | 5a24c238899865cf7af777917e1b25306f72b61a887bc6cf2364f1d4d454532b |
| SHA512 | 1f6a17bd2ed695d501b338669f4f1226184a3b7f01d536b88eb137f2022950a079b69c7b6f765ef55ce692323f883d0b14a2283d1e19ecd154b7914dc4e65e66 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0003.docx
| MD5 | ceef1bdebb0d8f111b81b5dbd976f4b1 |
| SHA1 | b987d3f620b735c3b2ddddf13d6f2c1b035540fb |
| SHA256 | 8c7f406f3631990c4a3bbb7208aedfda5dd92114b9bf2a30f24f4e19cedd656f |
| SHA512 | 2b7e42b911d8c74faad7ae149c780e3c76a6b73c6acbfd9eac4065da27182571c8f34db1fce6094f629243ab876c2c456ac0d63fce19ff2845d23509c1d57474 |
memory/2416-968-0x00007FFFF9A00000-0x00007FFFF9C09000-memory.dmp
memory/2416-969-0x00007FFFF82B0000-0x00007FFFF836D000-memory.dmp