strongpity | 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98

Resubmissions

21-08-2021 07:25

210821-sc6xvh6ksa 10

14-03-2021 12:03

210314-cpwwfsf7da 10

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10v20201028
submitted
14-03-2021 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe
Size

2.4MB
MD5

6d0fd5f76fbe861695b140828aac6443
SHA1

71b54d8219ab3a44ac434c41495c8d0db62a7d3f
SHA256

0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98
SHA512

e85fc4cbb64b4abdb1d76322e66ee7a007e8fc13f3dc9bd6d485aa36be345fda2494e44c665768388e3fe5c6aaeafc4d0926a62d69c13a2d06409182711527a6

Score

10^/10

strongpity persistence spyware stealer

Malware Config

Signatures

StrongPity
StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
stealer spyware strongpity

StrongPity Spyware 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe	family_strongpity
C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe	family_strongpity

Executes dropped EXE 4 IoCs

Processes:

fnmsetup.exenvwmisrv.exewinmsism.exefnmsetup.tmp

pid process

1296 fnmsetup.exe
1480 nvwmisrv.exe
2472 winmsism.exe
3768 fnmsetup.tmp

pid	process
1296	fnmsetup.exe
1480	nvwmisrv.exe
2472	winmsism.exe
3768	fnmsetup.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\CUpdateTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ndaData\\nvwmisrv.exe"	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exenvwmisrv.exefnmsetup.exe

description	pid	process	target process
PID 796 wrote to memory of 1296	796	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe	fnmsetup.exe
PID 796 wrote to memory of 1296	796	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe	fnmsetup.exe
PID 796 wrote to memory of 1296	796	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe	fnmsetup.exe
PID 796 wrote to memory of 1480	796	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe	nvwmisrv.exe
PID 796 wrote to memory of 1480	796	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe	nvwmisrv.exe
PID 796 wrote to memory of 1480	796	0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe	nvwmisrv.exe
PID 1480 wrote to memory of 2472	1480	nvwmisrv.exe	winmsism.exe
PID 1480 wrote to memory of 2472	1480	nvwmisrv.exe	winmsism.exe
PID 1480 wrote to memory of 2472	1480	nvwmisrv.exe	winmsism.exe
PID 1296 wrote to memory of 3768	1296	fnmsetup.exe	fnmsetup.tmp
PID 1296 wrote to memory of 3768	1296	fnmsetup.exe	fnmsetup.tmp
PID 1296 wrote to memory of 3768	1296	fnmsetup.exe	fnmsetup.tmp

C:\Users\Admin\AppData\Local\Temp\0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe
"C:\Users\Admin\AppData\Local\Temp\0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:796

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
"C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296

C:\Users\Admin\AppData\Local\Temp\is-66B5N.tmp\fnmsetup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-66B5N.tmp\fnmsetup.tmp" /SL5="$80068,1480519,54272,C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"
3⤵
- Executes dropped EXE
PID:3768

C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
"C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe
"C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe"
3⤵
- Executes dropped EXE
PID:2472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

MD5
65689075a82a08bb797bb9a5cc2932c9

SHA1
a13b3baeedc3456bf8a03e6f7fd43b8ccfabc7e2

SHA256
803b09f5863b583114d4db7d19ac0c5f64163c0075992bcfc289d27feea3a3ab

SHA512
20a1ac3df849e09fe361d0de8c04f9d8598457e95427a30df9ab74316c2644aa30f782b88b171ffadd7be4b6fc85970ec539d003aa1244434be6a12bbb9b6ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

MD5
65689075a82a08bb797bb9a5cc2932c9

SHA1
a13b3baeedc3456bf8a03e6f7fd43b8ccfabc7e2

SHA256
803b09f5863b583114d4db7d19ac0c5f64163c0075992bcfc289d27feea3a3ab

SHA512
20a1ac3df849e09fe361d0de8c04f9d8598457e95427a30df9ab74316c2644aa30f782b88b171ffadd7be4b6fc85970ec539d003aa1244434be6a12bbb9b6ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-66B5N.tmp\fnmsetup.tmp

MD5
8f144bcbcad0417e7823dd8e60218530

SHA1
9df092a764b8ad278ed574f00d1c065683eef6ac

SHA256
39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0

SHA512
e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-66B5N.tmp\fnmsetup.tmp

MD5
8f144bcbcad0417e7823dd8e60218530

SHA1
9df092a764b8ad278ed574f00d1c065683eef6ac

SHA256
39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0

SHA512
e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702294_0.sft

MD5
cbd36c81bf3d87893ab981fa5247cf3d

SHA1
5088e8940bbf57848d93671f0e94c0743bc0d981

SHA256
1d23c1e34aeee8e4af1a43973ee0f47a7683f7b9ce13fa985d62ecd9bbf2b4cf

SHA512
0e482952ebcc3db41b8ef93e7d28abfb1cffb3ce98be8a7a889561369c3ef31e6dc0c9bde199abb68c5d6182362a07e59b01c822d01eec48244de7959ac6bcb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702294_1.sft

MD5
3cc84961c95e80bbf618201e98643c1e

SHA1
57a332544d1c57385f2e33ef2c1c467666282dab

SHA256
4bc5f597ce996fd3be963bd032e2a8833ba65f28a6c1484dbd2143bf0cae3b0a

SHA512
a9720d9e144a744ce4ee3b7c3ad90d60aa262d65b5bd7a11c04d329a0cd291038eeccb85a36178c431d4888c8547e51ff7ca63afec6a43279a9ce620fbdc025c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702294_2.sft

MD5
2b5332c15e81fc28db541b343e0cfaa9

SHA1
2a753ce20343ed5a150ee5b0c2fa95b703dabc23

SHA256
51bb4b51870edc73317df3c3d675efda009c63304e45c2d455da18e8ec58f240

SHA512
3dc338f4e9d12ef79e79e06849c55ba6ef45ab7371f9014b3a2e6ae9ce6a005f3ea9313e8ac5b511255bffcc398618981b6e452dc62d67f334211d6ee8ef8a3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702341_0.sft

MD5
49ec56b2d7e23c295048a61b5b85c3f9

SHA1
9f609af4be8b0a20e4aafd6a5388227f906637a4

SHA256
20dd6ea30eacba3bdeba9260c197dbb6ebb1be533d5b7d44f97c8654587dda02

SHA512
af50109a6655653b34eab5de95b2c35cc71b868381307b360479f9e0a9e09936c9351589d7a7472c5caf16212052cd5ac60ef3abd0dccd4957ba9db32484a0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702341_1.sft

MD5
14df3d372fa159c3cc1e80965441d28f

SHA1
c2f9a17b33af50d23445de01f893af5a41caaee4

SHA256
3ab89b5f39f8aa6f36c4040a05be27300aee2ff2e4552babe50db936e63b3114

SHA512
929efc42be287ef53c34138ab34be73c60ca5554daf205bf273ae3b590098ec782bae2b616908251bc20857e1d008f0f218a3fcfdae1bce86c1db88b7d6eaea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702341_2.sft

MD5
97634dcb17ab5774927d3ee4a7c7a61b

SHA1
64c410466b11e68a1e646ffafe8fab41133900d4

SHA256
5e199be90ff8db6fcd17998de8eea624f06c51042beb404e32b169773bcd68d8

SHA512
f5602d8e4fdfcddaea8cd95ebd1902666e908e815cc9f8656cd9239ed801a14e7ec00533a2ace380f1d7bbe3e873e23e80c0d9f2b67f608c31948abab27e186a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702341_3.sft

MD5
508dc0cfe1788d6fa0c8840808f554e6

SHA1
4d6089197e087f0a40bd471a1de684217ae44170

SHA256
104bd12b639cf12a269e7f94e81e67fbc49db339a38d2dfcc878e13d70d373c2

SHA512
e959a129a6e2faeaef38ed0d32f90ac3a1cfb8fb0eb4594f03bd690735e9b2757f801e30967cdc3043e447bfda5a2dd84e95ef55275f3e23a2ffc415e28481f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702341_4.sft

MD5
81a866b03b6c12e14051110885662c2f

SHA1
27b627fefb20f7a49a1e2603f8dea77c347f9dc6

SHA256
a1392bd742bb1353eb726171d351706d7c8b2aae8a042040d945402930c0e05f

SHA512
3e0d711af699beba4563e7043935e4b57109da59974a81357d4b051c0d492dee9fe8d3055723cdd2853eda791462eaeb475f04219afa31ebe5ec3ea58b59be52

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702372_0.sft

MD5
94162ed93fdd5d06fd00db0986e4c6cd

SHA1
fa3a96a2121de1cb0af9c9f9a5dd090742855e0b

SHA256
f362b8e594a1f53e69811899440b971888ac7ec962a11aa1a45d95539c3029d1

SHA512
85858f433d3b3d113ef4f7c0178533aea9c1e018885e2125fa7adc3b986166322e58f31eea6025417bb2460a88e3338bd802c73631e3259671835704f6fcf82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702372_1.sft

MD5
8cd300f53afa376ed5723d41bac8bcd6

SHA1
db3b6f77da669af2dded198d60c59344a5ae524e

SHA256
a8ec0ca7b5f09b9c8f80518b11cf23219fcc1fb2443742e80b34ab02dde06ae8

SHA512
b5798223ed4ce3f135aa20ccfea8208c4edc1ac891e2e131f5d2390c51ae7d5267cb204eb29c2e81cbb408013b67e18a3a0a9d17e78e8f6fe777b290284154f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702419_0.sft

MD5
37f0fb87f79733beebacb8d5964d95ba

SHA1
fb304ba16b55437205f2dc3cd4a77b052923c513

SHA256
294ee6dc47cb85ccdf6efee650a04a90202408c7a717b2f968aeec1e24f78aeb

SHA512
a1f6c22a02fb5a29ee84eb5e46d66864b0c90e302e0ba7dfca8fa8b19007e5cf06dcae619d233fea5dd03f70b338a8d9bbedb70fbe592f9197541d27b862b7c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702435_0.sft

MD5
6990382119b394368b8de15c7856e492

SHA1
23c0777efc696e0d7cdc5c1a9fe73ba6d15e5335

SHA256
b552b4372767da415acdc041c20e4eed0f86f098afc7d3d50dca29f6e2dc2a91

SHA512
836d872e634032886f1b0058e2d1d691a5ab330eac1ade1b164d42da0d5a9e861fb9487c6e912665979c2c5e5a6b91b4dfc8ddd45e4531f1a2f8e78e794755e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702466_0.sft

MD5
49945b0cadc2a7a570f6e2269ac2e118

SHA1
126721c5707d68ce9bb28918828e663aaadf9b52

SHA256
a6c54ee5620f79155d5e34e0a2397c0aafeee2f7d2a2e75509158b20d2a83e0d

SHA512
10465c9bd7388edd0d823505151529bc248879724f1b7ba9af0c90d0b4453789c33d8bcd8095c1d9ec84321ad0dbae2e6b82d142fbc42c15f5f3e020bc6505bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_0.sft

MD5
68bae3af29469cf4a6de0865c1b3f0d1

SHA1
cb63004220df0da69671d9354751cc5350fb1066

SHA256
ea34266d34c703add93b17bb379e8593598d065ca5241201f719053c3db83cfb

SHA512
72478e2d8729a3499dac5dcfdd28b32fa0d55f57df5b021a9acb880535ca543b78cb9f50fa62aff77ba4efcb2cc917be1b63a793571eba14c75dfed45eee1fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_1.sft

MD5
0fd5c540e3cc46636263dde6b59f4a7b

SHA1
9b44125b4496d0c1af8ace04ed72c8ffd46016cc

SHA256
d35610aa106235fd80d662b51290c8ce2ba0998aec758bc3c533a85ace737933

SHA512
cfb44a7d213c2dfe528afe08711db1d246af143fb7739827fd620edaad63ef5c11c517919b3ca9662c40b755e89040fc764d159c45af105dc861d7275694cba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_10.sft

MD5
6100c15de0a3b07834cdaea5ea7f699b

SHA1
bfdeaea89e2faff7beae163fff205b92abbb66d2

SHA256
8901bf5f30d97b57da029cdb351b1c296b1e261aeaa74a9a8640475e30138ed0

SHA512
853ae22485599d389c307e6574c0e608e81129f55520dbb1fcad2b0489af269852e60071a05b179440fb7eca249aee29784aaf8eaefe6a8d163345f8afc8d0bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_11.sft

MD5
a071f3d81fed40e433a3583fb09ada34

SHA1
fcc8fc0c22796c8d3d36b96dece6e1481e55b507

SHA256
259c13843d26f65acf64561ce6be845ec33dc722819fc44981831ba3cc430ac8

SHA512
a5c6b6a3dc2469b7891db90c0aaf138833db5623223c97cd416af5075694107a9b09f5ee29a7fda73075ca34b22484129fe2a7ed5f5039196f8651182bbc56b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_12.sft

MD5
b095271253469b359bfba765f2a8e85b

SHA1
ae0f42f8ad7ba8f9d85d7dffc34edf96f0326bea

SHA256
0dd00de3e059e3937be62f5faf4ec8d1fe4a5d91c26a6505425ab0927660325e

SHA512
4affa16aefdc93ccfe385ee54d79315d6439afaa5d2b845aa528964eae145e5ef27c0ee44c9833b590bde115e77cc2457f71f40e24865a888afb482839923762

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_13.sft

MD5
3a78a9510b0b7ad297af5cf9a064535f

SHA1
df13431a808124806442f75e488310da4a472534

SHA256
1f2c990acc2173052004cb4cb638d5fef1a668b92e6d191a5fab0286f234be30

SHA512
4c8a5f81ffeea10d4a51ef67e1f8bd32eaeb884c7a090a1395b507b945919bf78bbe089fec310c5fe8021ebd7a892ff16e037831ccb02ff28c2a76bdc44438c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_14.sft

MD5
70006933c8b0e4354282f92daad41a18

SHA1
ce43ee51418e384112f2480c5dd078fde3b85128

SHA256
2e62e531e1c3bdec532d23628096aa0735868a7903131de7d12e9e08283721a0

SHA512
758227cb274911e5a03a3185a400f0de6d6ba2d6df49e4dea405b00dda9fd935269f628fd5f213a3810ed0d339f9080541fb4a2e34dcb96a789391334beac6e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_15.sft

MD5
66b6bfd2daf6890b1a603d62eb3c254f

SHA1
79b0abac8d05035e57c2326be2a3a43aa982f055

SHA256
cc7b7be2ef3304f8c7e3e030a9f1c80352af2a488e6e03360a4bc68c440cddf4

SHA512
227d9d983a36be67dd1be0d24dd7a791ff8b078709b1e8bb17e21bf0eca25564528ecab322f9585c853715213d9d376d3c570285bde7237de93d30ff31cf25aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_16.sft

MD5
1a13cc801db00df7dcbebe131abcaedb

SHA1
3bd3a2f3978ff8c1a09e567822e4f217e3eb5b4e

SHA256
72cdffde4154ed647b1510b5a2431e191f98bcae35ca4cf9dcec85068aebfd40

SHA512
ced50e5f7a3839c088f849308b6c0a07512fdb8debed3ceb82232485520128715dad07da19659595fd72e36e1b5d3c3d1870fc8b273c272e634b7c553b68bb29

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_1402521067_0314130702591_17.sft

MD5
6fc9b16ee399015acfd430d2d2b7de3f

SHA1
b1cf8f47a47dd9f87f22fde0d1a24d7a7cd79869

SHA256
7bbf72ea193f235cde256827d00f8375886e14b7e08fdc2a8b3802e412defe24

SHA512
a52b2f3fe8a228dfe85ec94172cb756faed14b8bbcb33ce45fd483dfd4d2130fe125c591e329b5f10be058d246676c00347d1c7a704fa529608d0b2812f53478

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

MD5
0f609dd490b21c85e9c8d1db8995e791

SHA1
30d448d7457818e4404b3b5e2079efa3d8d60bc3

SHA256
dfd0f4b821438d8a9277728e42ab58bdc2667aa7173892ffd6ede75a5d5645f5

SHA512
9f5951dc5c3b20c3faebb3bd0f8ad5c9ad1eba5dda2e45309d25600b5a8eaab90490fb06057e3c92b4ba89af8a61ae103840db3b23a5bc30b37c32d41487f79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

MD5
0f609dd490b21c85e9c8d1db8995e791

SHA1
30d448d7457818e4404b3b5e2079efa3d8d60bc3

SHA256
dfd0f4b821438d8a9277728e42ab58bdc2667aa7173892ffd6ede75a5d5645f5

SHA512
9f5951dc5c3b20c3faebb3bd0f8ad5c9ad1eba5dda2e45309d25600b5a8eaab90490fb06057e3c92b4ba89af8a61ae103840db3b23a5bc30b37c32d41487f79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

MD5
f050cfe9ded513f1b8e9a4846a0fa3a7

SHA1
64cb47c16c5636bdc5046107480aa3c7c97a2bf3

SHA256
d9402b75daf385ed652cc1d8c3bf7f3ea306fbc16996dead5a8741eff4f54b2f

SHA512
41d3b428696c41ac7dcefbd4fe7dbdb21977597fe906fff2e98ffa5a5bf32096bdad8b535aa0af961482d41a6ce843b4354fc7e5a0baf127f96806f2d53efb49

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

MD5
f050cfe9ded513f1b8e9a4846a0fa3a7

SHA1
64cb47c16c5636bdc5046107480aa3c7c97a2bf3

SHA256
d9402b75daf385ed652cc1d8c3bf7f3ea306fbc16996dead5a8741eff4f54b2f

SHA512
41d3b428696c41ac7dcefbd4fe7dbdb21977597fe906fff2e98ffa5a5bf32096bdad8b535aa0af961482d41a6ce843b4354fc7e5a0baf127f96806f2d53efb49

Download Submit
memory/1296-2-0x0000000000000000-mapping.dmp

Download
memory/1296-14-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1480-5-0x0000000000000000-mapping.dmp

Download
memory/2472-8-0x0000000000000000-mapping.dmp

Download
memory/3768-15-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3768-11-0x0000000000000000-mapping.dmp

Download