Malware Analysis Report

2024-09-11 02:39

Sample ID 220224-ela36sbhb7
Target d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78
SHA256 d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78
Tags
strongpity persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78

Threat Level: Known bad

The file d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78 was found to be: Known bad.

Malicious Activity Summary

strongpity persistence spyware stealer

StrongPity Spyware

StrongPity

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Registry Run Keys / Startup Folder
T1060
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2022-02-24 04:01

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-24 04:01

Reported

2022-02-24 04:03

Platform

win10v2004-en-20220112

Max time kernel

151s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe"

Signatures

StrongPity

stealer spyware strongpity

StrongPity Spyware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KeyStoreUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ndaData\\nvwmisrv.exe" C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3956 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 3956 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 3956 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 3224 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp
PID 3224 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp
PID 3224 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp
PID 3956 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
PID 3956 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
PID 3956 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe

"C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe"

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

"C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"

C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp" /SL5="$801C8,1480519,54272,C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"

C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

"C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe"

C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

"C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe"

Network

Country Destination Domain Proto
NL 104.80.224.57:443 tcp
US 8.8.8.8:53 geo.prod.do.dsp.mp.microsoft.com udp
US 52.179.219.14:443 geo.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 kv801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 kv801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 cp801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 uppertrainingtool.com udp
NL 67.26.105.254:80 tcp
NL 67.26.105.254:80 tcp
US 8.8.8.8:53 uppertrainingtool.com udp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 uppertrainingtool.com udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

MD5 65689075a82a08bb797bb9a5cc2932c9
SHA1 a13b3baeedc3456bf8a03e6f7fd43b8ccfabc7e2
SHA256 803b09f5863b583114d4db7d19ac0c5f64163c0075992bcfc289d27feea3a3ab
SHA512 20a1ac3df849e09fe361d0de8c04f9d8598457e95427a30df9ab74316c2644aa30f782b88b171ffadd7be4b6fc85970ec539d003aa1244434be6a12bbb9b6ee6

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

MD5 65689075a82a08bb797bb9a5cc2932c9
SHA1 a13b3baeedc3456bf8a03e6f7fd43b8ccfabc7e2
SHA256 803b09f5863b583114d4db7d19ac0c5f64163c0075992bcfc289d27feea3a3ab
SHA512 20a1ac3df849e09fe361d0de8c04f9d8598457e95427a30df9ab74316c2644aa30f782b88b171ffadd7be4b6fc85970ec539d003aa1244434be6a12bbb9b6ee6

memory/3224-132-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp

MD5 8f144bcbcad0417e7823dd8e60218530
SHA1 9df092a764b8ad278ed574f00d1c065683eef6ac
SHA256 39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0
SHA512 e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

C:\Users\Admin\AppData\Local\Temp\is-NH99O.tmp\fnmsetup.tmp

MD5 8f144bcbcad0417e7823dd8e60218530
SHA1 9df092a764b8ad278ed574f00d1c065683eef6ac
SHA256 39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0
SHA512 e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

memory/3224-135-0x0000000000401000-0x000000000040B000-memory.dmp

memory/2252-136-0x0000000000790000-0x0000000000791000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

MD5 81390ce601d34f384bff9198eef793a9
SHA1 6067bb07169464ca2261fb7b9f3a50868a8d412f
SHA256 1185998fd595936708c1fc5a3ddeadbdd46b88e216419597da0b461e136ddfa7
SHA512 48eab568a08b20c5046d12b2a061bef562cbd1e2e2de692d805873bc6ae7bc5c47adb5a3b3c5ccd818aff12c2be8becd70314e59e16b2d598d14711111e8a33a

C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

MD5 81390ce601d34f384bff9198eef793a9
SHA1 6067bb07169464ca2261fb7b9f3a50868a8d412f
SHA256 1185998fd595936708c1fc5a3ddeadbdd46b88e216419597da0b461e136ddfa7
SHA512 48eab568a08b20c5046d12b2a061bef562cbd1e2e2de692d805873bc6ae7bc5c47adb5a3b3c5ccd818aff12c2be8becd70314e59e16b2d598d14711111e8a33a

C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

MD5 8c24dd49d037121212985c722e1c7d03
SHA1 6080cf16925c33fb0edbeeaf2a549a3749d99c9b
SHA256 9b499b3945d8f979fdbb46342e1fd3dd5b2b5aa4322e9447df13598817c670e1
SHA512 3790a519b479a2c7718cfd51d408563043bc745918e92dc7bfbdc82e61444b719669123568e7dab8142699d350dd66287eb6512fbcaf6f0b35d1e9376d5379d8

C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

MD5 8c24dd49d037121212985c722e1c7d03
SHA1 6080cf16925c33fb0edbeeaf2a549a3749d99c9b
SHA256 9b499b3945d8f979fdbb46342e1fd3dd5b2b5aa4322e9447df13598817c670e1
SHA512 3790a519b479a2c7718cfd51d408563043bc745918e92dc7bfbdc82e61444b719669123568e7dab8142699d350dd66287eb6512fbcaf6f0b35d1e9376d5379d8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134164_0.sft

MD5 aea560c95e91a5b80ec2a4c619a45e48
SHA1 c18aeac5dd51fbcbb91c6982153af3f9b5571336
SHA256 36d0e6399435c19af77cde18b6f30ad1aa7141a8f5dba7891cd92a0e8f35caa0
SHA512 02310d177e3627369548aeda9f3c5ad4c3ca1a1d9842318977fb9f857c1574e0257a972ed2a668c814be11fbcd9d3934e05f085501ffcdba402f94a22e731f8b

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134211_0.sft

MD5 b5b20be457642d4e0db1416845848b7b
SHA1 54e86c0621ba32a18cf43044691c617c8176b536
SHA256 de120298f6e2b05099a432fdfc194556a8684697f06f68df2263849f0ccc57d9
SHA512 a1703c50f9c31ef4e6c366805a634f31256a8caa79855b6b9f80e7c7c83bcca886f02dfe765843b1c8181d232dd510d1995a4f37e779063846c4d1a6435667ef

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134211_1.sft

MD5 a3d21ac908753b4f9addaadb590f7f85
SHA1 c8d11e45ab3ba5cb95010bec8bedaa5338646dad
SHA256 45f35ea4f18a300b20689d9729c5470dd229d91546fa47c31c3da35dcfde44c4
SHA512 1660a8ec8d57647225d1c8ba59106ddf1c642171c85c02f79c1dda09a5544e4dcbf856b6da5ff6b12c54dd1267b22f89e945e653d25302c78b50204e2d91c13c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134211_2.sft

MD5 5b06514316208c4c1c13a9d601cc8325
SHA1 e3d2c56fcb4d4a8002cb6e5837bb1a1b66f55b42
SHA256 9fd5c3fd09195dc394d9249eb71f305d6ccfaba3360a62a49fd14eecde28545a
SHA512 2a23b1222281e41379f8b33406d2f2116cc76bf08a2ce2c64c4583eea7207dfd03d0faddf24f75f54f8fb4c0ae6829eaf00958cece39847f28939304e136263c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134211_3.sft

MD5 aeb6e1f0cb85d3ce4f401916593c0b2b
SHA1 d5365f13f4bba069ddbaa4788e503083b046effa
SHA256 54332657ad2873183173c82deafbf730d405972fa88c24f50b79cfbb213ee6ba
SHA512 d049b903b86312d7320778047fe55971a4746a74d468879a9166e4b9306e3f68135911ec87534d3910bd8528312187933b4d9f79f9e56f5cac37b7cb7a28cd10

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134211_4.sft

MD5 27c86a7800786079489b07a745617f33
SHA1 5333dd4ea070d92cbc1ad56fafd56bd85f2b109c
SHA256 f0de2d03b2562be950e98f779d890785b10616c3a6ad833cb19137b2dd0a0a1e
SHA512 d6c3fc4cea4570bfabd8f2ffe3b7b59fb89b7f4df442cf23285953fdd846d9d2df2266c11d8a8dc099116697a16e06dd0bccadf64301b5374b0a1d944456e93c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134211_5.sft

MD5 6a86cde3a15c8610c59d63da6c3c6893
SHA1 6ecc5377cd0ee1e622b332c958acb3699526d5ec
SHA256 27823af24ab69578d05f4452dcd637852a6d63c615266ad1a4ced5260248d8cc
SHA512 5692547aa2a26130ad881ca23e117c60bd95cfb7635ae45013fddab600ad138f06ea0e2a09361aef4314593487dabcc1b022c20c72a212032ff5f9cdd2b9fb5a

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134274_0.sft

MD5 908d43ec7228272c81c9de12ca459c4f
SHA1 eec9ce701f58ae35ca2ab7ee7c4adb6a9032779d
SHA256 6b9abeb7f028a6fe5187b83403bde180f8c648f900f8903425a39e6165115f59
SHA512 7e02cf2274e8d2ae9a999bd00c0b47be5faa66e28585e43839ed03f1a595976af3803e5a153556609207bb6bc2ced889c2f3a1ef88e4dc74fcdc3c449f283212

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134274_1.sft

MD5 132726cd24f01b37e1d3f3ee50d63e51
SHA1 6bccf4d31b527e616b4b6922a220cb875ff374a7
SHA256 4dcbd870f710531debbe22c5d0219d9183983eb8c832fcb7ade9e6d8494dd7ea
SHA512 b57ab250ed4cd715258bfe92b9a210d0ec3db3954e85ecd8784a8ebb2364ac77c0efbc7ec3ea749acb2146f000cb0fcf1059cdc4375214fedaa07b5a148533ab

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134274_2.sft

MD5 b77019ce804f2bf010a8e111c9afea74
SHA1 c8a7c55a11b23d5a485661c5f15f3a14f8fa2d85
SHA256 aa73805e3e8741ae0589cab58065ccc16ee2980f06b78bcc7b193942fa1f98fd
SHA512 daa1df6280ca05dfc852ed34fbb01f6e7b70d1a5c0ba836d60289242b353727b1e2a313902cac90e720b8e092159a5dcc3523fa55b2a11b32c7d7f9ae70c1796

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134274_3.sft

MD5 787d2d96cb1f97a79a9a8fc02e435bb0
SHA1 d0f55116f40e1947781634519b17e753c7a993c5
SHA256 565dd7b1cc7638272d46936274caa1e4373ee8f0e22d7b87ac1ec18981e2d03f
SHA512 34a4c761ce99e411fffd0436a944210b3d305b5ee5b26aa23f5c14f87b23c0e093ec2ed84da8ae0b6d968380c038b7b247f03387838680490c10f2d69bde2d5d

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134289_0.sft

MD5 c8be7240a176cad9b5d717bf100afa2d
SHA1 b1f93725fe74aed3ff15da104cf02e153d92015f
SHA256 bc00f1b50509359ac20763407e2ade0d923f5d92bd733a45d0da29c90bccb23e
SHA512 b13e262a99f83af9ece4c6fd3e65dd57f7d80f93d9e0fc944794d566a3b20ff37fd7c35de30ed2e4f25e23e3007b5277747192677778b9f5056d92df1e220421

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134321_0.sft

MD5 9358eef070411c77f578c02c7c60c510
SHA1 1bc1b6373b4a3ff6bac64557e6aecf1d813d44f7
SHA256 c6417b7745c45c85642a3d53e65abe21710b831d9a9caacc9bc977751a1c54cf
SHA512 5cd9dc49fb67f76b8a26fd4941cf620a5407c0e79878aa81657e8c3f2bb653d301c229e52cbbc1759b0b5eb1b2ae34ff97b8c4796919b930d5bf14bc44ca4e9c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134321_1.sft

MD5 ae372d46c79fc67bd9af71a310d9f229
SHA1 2418b981f9f57e52d48695f1583d15472b0d9f11
SHA256 244a74a8fb83bd82ffe07d98acdbb374abe5cb52f417e5c71fe51dc8fc1683f8
SHA512 eee918a97b15a1e28b07543d1458e8ac704de2096256ec0699b7522fa7c8ca78e704fd8b65957f634460b13e292395ac89c10aef08cae30617afd601a49b2fe0

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134321_2.sft

MD5 45a85426140da2fc12029a8578b390fa
SHA1 5842921cf23a1cc0ec24426dcdf4e33063dee281
SHA256 50e7e02deff8c6ca4ad7621c791fc66dae9e607f6d98e18be800cf7ef3cf4040
SHA512 ec2342bfe94597580f30b8169507642c73258e4734f0f3796c95461ac41db92d0f07afa8549c1118a726b8c69398269e310168c0a34b4d700614213fcf7854b6

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134321_3.sft

MD5 d608a757cd04d1b5f1d6febabb13bb4f
SHA1 2ad56ef23a3244e6645931a397d8a19a6740fe81
SHA256 3bdcb1f87e1238b6ab5b0f77b286aed700060201c578e5db5bb0f38eca043d02
SHA512 9563970e28ad65ed0e5f8d7c72d7c508c50fff0aba21929999e468a3ef7fd57f3a60cae752336ec7d0dd4a90fc81e9c6dfd0907de8a457322b7b3724028c190c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134321_4.sft

MD5 87cd5eb771f750c9a2129556ff78c9ff
SHA1 6e479340662a3eaba4b1e130a298fd45abd20495
SHA256 d02f7b64a80cde88840c8a26811ecd6712afaa7518c9fdbd66307e38f8d8133b
SHA512 8041c77269bb528a1da77ef625019f482d41bc593a5c788ce54662d391e4c0c5d7d82dad4968ff65b7bd9b524d1b4a4b13bef557925dc721282579addc888338

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134383_0.sft

MD5 b7dec362db26d7e90540f634ad8bb85e
SHA1 dfa5b0ad09084ae70ddf5b42a21a2f14e3dbb184
SHA256 d226f75365116d03caa7125b770efeea0f2f4ae67702e6b34552cedd44f0db89
SHA512 dac2bd6569dcf670bd7415e6e2c7bb638047a946d309a32f12f7f2ca7ba14aa580a625132159efad5f3283ab35e93942d0490875645715f6f6ff2f869d143fab

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134414_0.sft

MD5 8576c53a91b6fe07c8bc53bf18cb2592
SHA1 a5eb813bd86de11e1f52b15380bd8d9a4b22372e
SHA256 1988fbfc2f3bd8af53ee779611876d0ccbab9c8705a68335483b79ee0982e542
SHA512 0be676560a1fa79df92644d9187c87495128a77b924cfb6b773b521931866d6b52de9aed35ea625c7759f1372e953c85153488f3e487160c106340608f5d840f

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134414_2.sft

MD5 0a7d64ae7d95c35561db252a3ddb2afc
SHA1 a292066c5f2b6b8d5200cf7f567654dbf57d2538
SHA256 fa058dc9dc838e9ae669f02d646d17c01751096675214dddf066de1323656bcc
SHA512 0afba2364542121adeebb3ce355c5b43a5bc9bf6163349361895ccabef5ceaff5156f030f359342169cdeebd9d7fc7a9756311bd4fbf6564dbaa34176a531105

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134414_3.sft

MD5 8fe8e051b6549960cbc09c14cf84c724
SHA1 4ef9f4d687c1d3b2b0e245824f6b9b1cccd05c98
SHA256 e0f029175ce7a799c59bebb7d4fb1a9b7c18a2713fd7435c0a1f2da42f6873cb
SHA512 9c18ae76a2072d8abf51dd1734aacc9353d60b8e25e38bff0ca4c72b9a619a3882a85d0a39025dbd9804caf9344bda53664af742c539e385e8a13dc31a37be3c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134414_1.sft

MD5 e7c1d51f95783a82867c2c3b1732d5d6
SHA1 153cc86dcf38a67a88a0e51490f64cce22472f49
SHA256 70c2d8843f0d5ed7c7625cf0cfeafa3fb4e5da2d5d4452dcb8d7af205f0d0138
SHA512 e64fc1fc3106352816ce28bd13c612c10e5eee8fab184ee52d9eadcba9dc8d8c68f5ee0a2123d48100a0b0dc86a3dd3390be44f57c29841be0fb3d673a0ed901

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134414_4.sft

MD5 34d612e4454415c4dd9b1e86c40df81b
SHA1 c36d28736520c7ff83e417e46571034708d27a05
SHA256 941e3a4ea78808503a62abea72ad9e9f2ee0b895f716d191f662ddf322c21dc6
SHA512 a4d4938cedf97ae4a9341bb047e618744804f19d4c553682b25930acc2e65a9695a93f0eb8e3a56dd79f5d0e9730260f2e6123ab902706a51ba31f40de582e12

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134414_5.sft

MD5 163414102b36568a06127a48627cb7e9
SHA1 c9db286cd907d0e3dac2cc699c7b83112c1d8e91
SHA256 de6e45940f32261bef1122663dae3c42df19012801994221b098079bfb7172cf
SHA512 79fa022e1bd031d3ae41a0fce73df2d307acfc94c5a0ba8504cfde06986d0209355b778dd45c69756c6e5f6fc2382d6edaaf9e009f5b10df8861756ad53330b8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134446_0.sft

MD5 cc5ae89a823bad5f3ad054f31d3ac7c9
SHA1 dbad82abc0a8a0bb584366a285d3dd9fbd5cc847
SHA256 dfc66d2d1388e894e7db8ea7921bf98c43085bcd861211ef71cf73df17d9aebd
SHA512 c4a3489efc164b824b81caa382a5176a03579fccfc59fcc6a5d3ffc8d6f6ccebfb07f6ec5445fed95744ccb7da47db00065f0be6896d4fe070f473a1dade3a5c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134477_0.sft

MD5 7a187d63e1fc3d7bc2d586baa1ab5f28
SHA1 a0b9e4369f50bf65e912d32efa259725721e069b
SHA256 572c895bbfe905e8ec07156d9d2a47842c389484804f3290dc898b9d0fe53736
SHA512 7b9769efec8e2800bd8dc64599946c9da7b3d19227e3df11e1c62ba640158f92dc81275eca90b079a52bc50c93eaec41760f8dec582004b0bd22d69d7e479ea6

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134477_1.sft

MD5 de03dcaeee5ad7f17aa4b61710a71e50
SHA1 b71bf03c222c51e8f0c336d236cc6b355c10e3a5
SHA256 954633979e9ec59af4c15da28b0510584677a3330b772557e390f72273dcb3d1
SHA512 3f35ded073faf5cad036008cbb5148ab66fa6209a423a6ecda859cdcf1386a919b730119bfa5ae8e2ef03730568231906c85aa6d6e67b7e4129e0a36b894b3d7

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134477_2.sft

MD5 d8548aa1301d6388cd6ede2dd61ca1f3
SHA1 92f3bc1d76e60a129e90118e74193d76751696d4
SHA256 945e0ab2d718f35145cc6b705bfb1af41c1dca27f244cfa2feb12175222de60d
SHA512 b3c3d8541cda15f13cd0055e75c056c1a3ac756cb2937245f0db15e0e225cf5e4685cbdb404cbeab0a726feb4a65e5d71b71b041a4d682860cd3f26d5edc895f

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134477_3.sft

MD5 db6a10fd1ba1e33aba0a26ae4d66f89e
SHA1 4072659881ea34672125a08cab6514135952f536
SHA256 89860d2dcd1b6957b8d1571d6ef661beefe8f98834654f228990e889a99b3034
SHA512 31dcb4aa723a33984d20b5afa6d6a3210f3a4be1bd71fcd1386d86111b31e365d41264ad0b51a47420b599f249d1696f71aa4cc4484f340541ea4a89c7a86ea1

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134477_4.sft

MD5 3d5176fd8b086874756faf01f4352f41
SHA1 123a0a2df28b1f751e6d754682a8ac13ceaebef0
SHA256 a92a2893054f3fe1c46be7b30af566130f4a3cee70d2dafd6cddbafefe2cde7d
SHA512 bf1519c87885baf42da0ed5cb651ea844a0852e25631dfe01df946524c2a47f9d284ef4ccc16e3d695fe187e342f59a4f4a4c513f2d65394bfd8e2be1cbf811e

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134477_5.sft

MD5 50121fa9c34872d35b27695368b3f9cb
SHA1 235e7b752323208a1982ee24aff0de4444e511a3
SHA256 d841deddae21426eb237c1f3b6d9aa06fe03016ae04987bd40839595e5959f3e
SHA512 e1cc85d0a853e19df63831a933f302e0bd82e4b4e3b09ca9c0a1f3035467df5a4c6467d23c41d1289cd13262e7ab9d7c1569a4753af8063efb3037a083d0915b

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134555_0.sft

MD5 61f7b5643710648d85a1142e77269063
SHA1 56efe932f2d3e2c8bbdcd9dd0d0365564f19eaee
SHA256 6b2c643b02bc7505b3e6ac07f923c99ba9abc6fe92e876e1be0d5eada3b32364
SHA512 7e6d10edc2898a236b7851dc2d30f79fb014c4baec7ab90b16a9219f53a90c8013bd14e8f661c00df35ea6e32686e23cf51b9f2aeccab443121bd3920ddcd2f0

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134555_1.sft

MD5 3bc2be2a8892a5f41376d3830cc647e4
SHA1 07b9b4e6446ece8c67ac755c5ea688861b8e5708
SHA256 f059eef8f5b877a53e86f07a4d1ae46c612f18e90aa8f99300fb643852242c5f
SHA512 4e83d3b1b173ea02091e76ba1544f4b9f5085658a40c6a9c0ad38f708cdf221dfe50fa9714af46bda6fc661627ba1d1e8a5121dfba11f2a348ed547fad89c6c8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134555_2.sft

MD5 4ef5c7de26b06577b406380f446d5400
SHA1 47fc646140b8e9021af75902c1a3006e6528ed61
SHA256 5a03b43a626b5527a5e8b2b88dda724579c3bbe571888bdcd364fb8c630d44c2
SHA512 c99ce1d0d04c81458a9ba8ea5a0c36362c08e5a828bca5676a94d5cf757451b4cfd3079a7bafbc1d5ab99c539cc6e97265036605e869e1ed8a8121e91adcbe54

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134555_3.sft

MD5 db0799adbcecb119aac4649e25a62251
SHA1 a35c3e972bb2532424862366fcc87659398461f3
SHA256 17dbbdd99c8906e74b2ac422a7f290800cb573f91660e9280861793a3e2cb7ba
SHA512 8a01d0bb214467de54ae0782d773927648f563af6badf2314d3387e5f2052070dc95e116f551032d81b4213ecd39e6dda05c47718ad42c69ab240cd656ae01a8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134555_4.sft

MD5 23ba5214ccaa9231b349003bcd9e27f2
SHA1 6b1dc6dc393c4b6e6884e76dc6b04c70a99259ed
SHA256 88731a5f7d75f713c6f7c7333d454c0f52bd36bfb6930b8a63d3425c47609585
SHA512 e4f893305b64a85db23facd5691cc2b020826101db024ffd3ab1d6767682bedc53f273e300e6bad81145574f0f89db0778d11e954603836106d84c4c380e1cf2

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134618_0.sft

MD5 81c7941c8d0b2a4937fcd8cf503b2e23
SHA1 1bd5d44c33833806aa972a3ae780ce4ad10f3141
SHA256 7b55b0552f422273470696c3b4eee3a43b9b8706aa7f128826913d6e128c9652
SHA512 357dc2b30cc88bf8192706609f8473602805f850544238ecbcd05dea09ab5a78b875d39f965903ee47f7b4000abedac258a2e2c5fa4e3102ce98b2c277cef801

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134618_1.sft

MD5 41acd611418809ab5d3a873355b043fc
SHA1 b1ccb80662df0e2a3cb1573ef91bf7e27c21db14
SHA256 3112ec601905c5e76dccdc6fdfcdf308ecc2a67c2502518bbc1f48f0a26e17db
SHA512 2965117fe86952e08a2a2def15b689347906d623d7c4408cda5f013f161ddc8f9d54c8731d74dfb68e622e1ce42c3da8faaa2415d4dcfb1613a104ef17a33a73

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134618_2.sft

MD5 032c3c71304cd4d0b3f60bbcfd618e80
SHA1 d19af524f805f49465a018c78af36e3048a895ea
SHA256 d746a46f0dc4f5b92f422eec4b08cf5aa1fd04d6303f2f40e8b4eb4425faacdd
SHA512 b861512e97688ec52186c911428441f1291fc39463b2a941d7f938d1eb63612aed1844088123d78a6f2f517b232a5c6cfe968a7549b2b92e375f74fd219149f8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134618_3.sft

MD5 eeead17f4903865000b27e264f97ec95
SHA1 a91daa6febffdb453381d6ca4430652a2360d516
SHA256 d4c54eb0833d118001a5c6d9d1063ebecca0acd9e415155387b5b968940070ec
SHA512 b4473eb79a519b18be7664dea426bfa7ded6fd8648356f87bf1f684e41af92a9c2ba2f57f84568fcbdb60030ecbd3062b1f0432d5dd8ed8fcd744cd8b1900ce3

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134665_0.sft

MD5 fc304f0c3a7589e9c7a7cce2367635b3
SHA1 74a9afba0f6dd465b7b2e5e0cb710d724461c4c3
SHA256 4061266853be3a615c66370e71374a7bc6fcd90341a97f6b22f80d3a7a47c900
SHA512 c95e00f76d2ec5d32f482e1cd326421f666da0cc472b9d521aef7b2e3940cee8c52252df407e25d6036f2ec6087aa4f8bb6332a379e1f5bd183903e1260f64e4

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134711_0.sft

MD5 68716fd398d7dd4786aca1c2873f5314
SHA1 95c34eadf93b8dc625d3c113000fd8a7e49388ad
SHA256 5d04b9328a6d58f702dfec0f2e83dced812be7cf67627a0485ef55f9d0532746
SHA512 0d407f23ab50b33a46175ce0667a2e86fe1fb9656563a3fa379a35881431800915eebb60f7fd92a416df874fb27eee44bdac41a3dcd1dd00f5cf79e60c45a7e4

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134711_1.sft

MD5 685415f3748d4cb39cb3935e758ddf62
SHA1 04f4bfe0f03716807d088807b672cfd11334b9cd
SHA256 c12956a740503b32fd5963776ecba5df92c19fefb59c38beee8b4b6ce0ca19ce
SHA512 e77511062cc316bf1456ffaffcd1c3923e5bd023acb7df56c940a22a7a09056ce029dad98e1b0447386e9539024201646eefd733f01dc7a4957c4a9e8b3d7770

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134711_2.sft

MD5 d5a78a3770f63e4d159572f45eb06252
SHA1 0596a321e5ae1cded13d53482b7eec8fb5f73a29
SHA256 5d16e1a88b716a9cf48b753815a550bb79589eb24db305ce922dc2b1fa59a12d
SHA512 a072984ef0741c458970fb15e87e7659d739df01384cbb139efb0eb5c0ba7994fe4780041188e5132d8c431a3890b24e80fd52dc101ab62f99479feed257033f

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134711_3.sft

MD5 4eb62dac26c17561b555e156344ab78c
SHA1 67935db3d45f6a0ed923fcf6cceb9aae6a3ee4c8
SHA256 af13b76c16faec1fbf38c66f6edd73e5b68c2e3f3b80a329fedd568fb9c3c3c4
SHA512 38b60e9e599c467cb5c6eb79c848878b88b57fab399c6703721e2c3c1d01163c9a414f2fe2b1f2eb1a54701f784d21320195ff0587c6f54aaa7b5c7ebf90d2e7

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134711_4.sft

MD5 9829dbb202a77563d0caaf438e3f58d1
SHA1 c98d913ae8eec47a4a03bb21a589fd2dac6fdccf
SHA256 7261c17f8b9189c63d3fa8bf756effbd668cdd1d88ed5895061d0547740ef679
SHA512 f56a43574090b1aa55150158716ef775c247d7a62cf9e50c0fd2270680be8b2144b95c00d9049104f14be48351846e3510b43e20f58da8d7c6713664871436bd

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134711_5.sft

MD5 d6106bf83d2f61ecf840201508f69fb9
SHA1 7812182e4fe7b85ac47cc33ba3b9e44864b3f13b
SHA256 78b05ebfc67ec30401f84a26b46f86fd65eb25d7eff713e8a66ec0e754ab2f27
SHA512 04c039f1604e33ee781ca8465dd5960a339dfa06527a7061a5981ab1abaf386c61ca8cb4db910472a88414d4c7b2b1aa023aa7fdb171d1410478653b0d91861d

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134711_6.sft

MD5 62ac7abcee6ab833e77525b6d85c99a5
SHA1 5affb7179c6a2e803ff2939a8ab293b23023658d
SHA256 12b9a0cc10d2ef8aaa68ed919c1a28d0061192b12ef9dc282f08ce1d3c2de1fa
SHA512 83752ae98d21abf2cde8af2da9a4122f4b6f677faf8f568428a11f82d8dcb88e6974bca70ddedaed6b6eadda76685c21e966ae469e09a4d313b4bd69d2267f3a

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134758_0.sft

MD5 f2541571ef9543c595792da27f202de4
SHA1 d0d571a6026525b880f43a7ce103aab690ccbc9b
SHA256 a08a19488f70ba9e501341e9e921273b4017d26fcf0c74b2f5ead0203b638f6d
SHA512 5f6d5131bfab416d439685fb9092dcd6dd39a7c2f1caea31a75e56ce92fd53d02f91d5d6361251307fd7b334f6c4cbad179c3fb6bbe4f71ef0b847f4c63c76cc

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134758_1.sft

MD5 b891f178a883d0418d6b6172b0da3943
SHA1 e3bcec380ce46157ca52da1b03918446cccb19dc
SHA256 ca679eb3c76396fee11ed683f49c264f630515a8dd1dbbab445248461129a14e
SHA512 74e447febe4db9f2491bdc8fb419e0303bbf0b52d4dd48ed477ad4c906126935da8049cd6b67038121e761806c17c6d3b6debbd6467a1fe26f814b8e81befd42

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134758_2.sft

MD5 5bcf459493e4a3d50a2e3a90aa685c38
SHA1 a3457ae9b723c78142b23d65acfe2ef6bd72630a
SHA256 62188ce7701850c559728ce545acae9a7991e41276c8e47f8afa4228642de614
SHA512 dc86a4aae14eb664cd3d08df4788c099f6c56cc14a4ad3567cbf39b883b74382d9c976fb0cd5b65675c9d052a15df558110400095ff578320939bb6a3dae8e79

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134758_3.sft

MD5 324711971858ef46fa7528625d0e4863
SHA1 5c2a12e274f4bad3b749c70e3bc339d57243d1a1
SHA256 123c2dee368549cb3a38b7226848e0395425ed238e22e5ffb3b95a423c6f5b94
SHA512 cf274b62bac60251db5a9a7cac4fac1deb90e887c9e537eefd4f2a9703cccef23aa9f771f0a2fa6a349178bff60fb63384798e5b31d4a42021fca3ebcc39faf6

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134758_4.sft

MD5 b6ea29057f71929d14f7d71a1f07ae07
SHA1 156e1b08279c464932d5f917b4c3312da42daddf
SHA256 f4deb1b6e527a4abdc0d697a93ba960ab570b5e9b5da65ef460bb30f245ab799
SHA512 3ce0dec9186ee3271097eda8dc94e16d6fc8459dde7878bc3c99b8a8a87a10a6726d162b263c17f36a415ca98f282c1dde038a231902439d86e9819d27200e1d

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134852_0.sft

MD5 1d437532c95f2675bdc7d33b50a061f8
SHA1 b1def162303210ff04f3f950ec0b908484b94878
SHA256 ff3a582eb9b592138c8ad902ed0dcdea8201fd6bc337217306970407feb3c8cb
SHA512 5ee9ec2a0a2347c8cec4995e516fd12a378898f2d0b41a0fb2e52221bfdf08f2ac36e8a80fac80f681ff4c427d4ab2658926d146addd7d4090e3850f91aa73e9

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134852_1.sft

MD5 da1924ed36b014cb4c3f94210e97b37b
SHA1 936bbb0109bebc0b18847fd2d69716ac61ed8619
SHA256 dcdf434f94cfa56a665d9ab634a5efb78fb685d7569a086a35982de165bbdcbc
SHA512 bbe56f1f98d82552a6768cf6bfcaa98791171e8526113d559031feb164efb31b076fb52dc935e8f341ad2a0d74102a268b61e7a95a98b3339fdb8c8b1fb6f774

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_2590360312_0224050134852_2.sft

MD5 96701d4b2984eac2804a74a110e88e35
SHA1 6ec050b7483cbff1b0e0cd0c09df746184ddd52c
SHA256 ba6db5a1937b9de774b435f6422951911e7959babf56f626796abf3dc47094d7
SHA512 d8ae5cae6a7f8229864bc0eb3d6ad170582e9418dc1ca5fcd16028bf610c7f7f2f521f4b5471dcc51eb6b6c44e4fdd47cb518b907964e3528b65bbe48dfdfafd

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-24 04:01

Reported

2022-02-24 04:03

Platform

win7-20220223-en

Max time kernel

4294208s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe"

Signatures

StrongPity

stealer spyware strongpity

StrongPity Spyware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\KeyStoreUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ndaData\\nvwmisrv.exe" C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe
PID 1448 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp
PID 1448 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp
PID 1448 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp
PID 1448 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp
PID 1448 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp
PID 1448 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp
PID 1448 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp
PID 1788 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
PID 1788 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
PID 1788 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
PID 1788 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe
PID 1600 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe
PID 1600 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe
PID 1600 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe
PID 1600 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe

"C:\Users\Admin\AppData\Local\Temp\d9120629675b34e1a33b9bd34fadd0249ce1a903d510045565c31769e4881e78.exe"

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

"C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"

C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp" /SL5="$D0150,1480519,54272,C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"

C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

"C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe"

C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

"C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 uppertrainingtool.com udp

Files

\Users\Admin\AppData\Local\Temp\fnmsetup.exe

MD5 65689075a82a08bb797bb9a5cc2932c9
SHA1 a13b3baeedc3456bf8a03e6f7fd43b8ccfabc7e2
SHA256 803b09f5863b583114d4db7d19ac0c5f64163c0075992bcfc289d27feea3a3ab
SHA512 20a1ac3df849e09fe361d0de8c04f9d8598457e95427a30df9ab74316c2644aa30f782b88b171ffadd7be4b6fc85970ec539d003aa1244434be6a12bbb9b6ee6

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

MD5 65689075a82a08bb797bb9a5cc2932c9
SHA1 a13b3baeedc3456bf8a03e6f7fd43b8ccfabc7e2
SHA256 803b09f5863b583114d4db7d19ac0c5f64163c0075992bcfc289d27feea3a3ab
SHA512 20a1ac3df849e09fe361d0de8c04f9d8598457e95427a30df9ab74316c2644aa30f782b88b171ffadd7be4b6fc85970ec539d003aa1244434be6a12bbb9b6ee6

memory/1448-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

memory/1448-57-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe

MD5 65689075a82a08bb797bb9a5cc2932c9
SHA1 a13b3baeedc3456bf8a03e6f7fd43b8ccfabc7e2
SHA256 803b09f5863b583114d4db7d19ac0c5f64163c0075992bcfc289d27feea3a3ab
SHA512 20a1ac3df849e09fe361d0de8c04f9d8598457e95427a30df9ab74316c2644aa30f782b88b171ffadd7be4b6fc85970ec539d003aa1244434be6a12bbb9b6ee6

memory/1448-59-0x0000000000401000-0x000000000040B000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp

MD5 8f144bcbcad0417e7823dd8e60218530
SHA1 9df092a764b8ad278ed574f00d1c065683eef6ac
SHA256 39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0
SHA512 e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

C:\Users\Admin\AppData\Local\Temp\is-F4A2T.tmp\fnmsetup.tmp

MD5 8f144bcbcad0417e7823dd8e60218530
SHA1 9df092a764b8ad278ed574f00d1c065683eef6ac
SHA256 39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0
SHA512 e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

\Users\Admin\AppData\Local\Temp\is-6M2GS.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

\Users\Admin\AppData\Local\Temp\is-6M2GS.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/764-65-0x0000000000250000-0x0000000000251000-memory.dmp

\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

MD5 81390ce601d34f384bff9198eef793a9
SHA1 6067bb07169464ca2261fb7b9f3a50868a8d412f
SHA256 1185998fd595936708c1fc5a3ddeadbdd46b88e216419597da0b461e136ddfa7
SHA512 48eab568a08b20c5046d12b2a061bef562cbd1e2e2de692d805873bc6ae7bc5c47adb5a3b3c5ccd818aff12c2be8becd70314e59e16b2d598d14711111e8a33a

C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

MD5 81390ce601d34f384bff9198eef793a9
SHA1 6067bb07169464ca2261fb7b9f3a50868a8d412f
SHA256 1185998fd595936708c1fc5a3ddeadbdd46b88e216419597da0b461e136ddfa7
SHA512 48eab568a08b20c5046d12b2a061bef562cbd1e2e2de692d805873bc6ae7bc5c47adb5a3b3c5ccd818aff12c2be8becd70314e59e16b2d598d14711111e8a33a

\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe

MD5 81390ce601d34f384bff9198eef793a9
SHA1 6067bb07169464ca2261fb7b9f3a50868a8d412f
SHA256 1185998fd595936708c1fc5a3ddeadbdd46b88e216419597da0b461e136ddfa7
SHA512 48eab568a08b20c5046d12b2a061bef562cbd1e2e2de692d805873bc6ae7bc5c47adb5a3b3c5ccd818aff12c2be8becd70314e59e16b2d598d14711111e8a33a

\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

MD5 8c24dd49d037121212985c722e1c7d03
SHA1 6080cf16925c33fb0edbeeaf2a549a3749d99c9b
SHA256 9b499b3945d8f979fdbb46342e1fd3dd5b2b5aa4322e9447df13598817c670e1
SHA512 3790a519b479a2c7718cfd51d408563043bc745918e92dc7bfbdc82e61444b719669123568e7dab8142699d350dd66287eb6512fbcaf6f0b35d1e9376d5379d8

C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

MD5 8c24dd49d037121212985c722e1c7d03
SHA1 6080cf16925c33fb0edbeeaf2a549a3749d99c9b
SHA256 9b499b3945d8f979fdbb46342e1fd3dd5b2b5aa4322e9447df13598817c670e1
SHA512 3790a519b479a2c7718cfd51d408563043bc745918e92dc7bfbdc82e61444b719669123568e7dab8142699d350dd66287eb6512fbcaf6f0b35d1e9376d5379d8

C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe

MD5 8c24dd49d037121212985c722e1c7d03
SHA1 6080cf16925c33fb0edbeeaf2a549a3749d99c9b
SHA256 9b499b3945d8f979fdbb46342e1fd3dd5b2b5aa4322e9447df13598817c670e1
SHA512 3790a519b479a2c7718cfd51d408563043bc745918e92dc7bfbdc82e61444b719669123568e7dab8142699d350dd66287eb6512fbcaf6f0b35d1e9376d5379d8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_0.sft

MD5 fb15b0bfa7e60fbe0f8c7ce7b5b95998
SHA1 60f01d22cf18a07c5a201eb0a187d5f2787b4da7
SHA256 d4ccbaca0cc5341cfe01a5c68ba0e75a20ddaac271fe734862120d6d468a1a8f
SHA512 c7ff682a0aa4f59a4b2f84edb1429b1651912226449200d8a5c4b0f05aa414f8d5c8ad37bebd3219aac1bc6982f66da7c0f4be6e65a19b1018b0710cb878570c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_1.sft

MD5 a8537a8fe3387edcdbfcd7cba88d5710
SHA1 37553d1096adb509dca52df756748ca52a15b93b
SHA256 d743f67d1b0cd801a4e09431b2bee1447081088adb3b0059120cc8cfaed9c6b8
SHA512 0dfc6c2c3620c758bdb5ee830a497041cb5df7d3581bf95944247399b4cdabf5a1622a725636531a0c386afd175d6a9d20e71115f77da38e3be7c798da048e8d

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_2.sft

MD5 3e3e9287af8326957c351d4c4387f009
SHA1 627725bd5f7390fdbd76e66c9b0e26a3dde40829
SHA256 3763e35f9b60ae8587160c0c0f92cd6726d45225ff5510fc9093536a6dc8e3cf
SHA512 fcdb1839fa2c7444754f70c23879031b8673665d5af7b12ccfefd1fef91f36089d0f2e851167a52c91f2d92abca7de53c16a3fc984c5a062539b09c98cf199d8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_3.sft

MD5 d1becc90d590464251d0edb0b0a49533
SHA1 fc9de3ee8e4e76d1169f5738952b317055ceb626
SHA256 7bddd3748761adeacbfeaf60156d4636133f3159f17fa5d38aaced16aabfa88c
SHA512 95f6b0de1455a198399be276c34106c05f6c37c472120d7f9ec4922cb85688e0322b96377dedd07c06d8aabfad0eb8b82e62db1d328c0dd91574c48e9066a862

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_4.sft

MD5 c264f49b524f8d365d217e4ae598939e
SHA1 d9518251415f0b7b0074e6498bf5dafbf6f816c1
SHA256 20fa889dbe578e928b33a24ed062512b2a2027e4e9e05695d7c30ba08980ead5
SHA512 c0af3a94215774c877fd47446a2082258737ac96a2cb22719ad12cdd60c62686459ff2c44b299abdbf43e587b854f45319101903ce962ce4cf767954d3cf237e

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_5.sft

MD5 293a497ffcc90a2735093c21d6e51bc3
SHA1 e98e63718fb49e520c114cc010a3a7c31b36fcd5
SHA256 6bef9f3cddcf8db115bbb71ebac36156d2c04b292face02f856f5f11c8ad6ece
SHA512 2ace2bfdd7f193857a6c83ea4df01b134e610421587324d3114c1d4f589d6fdfdffc29c8be25241835cfebd8ec88f27bdad0b2fc98d61d43a58950c718e43b0b

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_6.sft

MD5 0015a0eb7b988ec616b763d6d05e1457
SHA1 a7db7af51c8f5a0f538a2e32ff80635127462019
SHA256 be7e5385bee9237469924afe49fa094253508923058d707bbf478494a99b1909
SHA512 1535997b07d516bcf60548054f0df88a1608ea1964be797c6f0c2e638b95713fb883382d63148540a488c8d8a8e5b98b4ecb45eb60d5601aa98740a6510526e1

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132358_7.sft

MD5 e9f8c50509fa6fbdd33fd760035412a7
SHA1 f5e27a98cd73ca87894b8f2e8ae3ecc346e7d16f
SHA256 7ba1edd83c29a4c4ff98e3982ea975e04a9a3c7d3c8e3da0e81844aa58777b8a
SHA512 5310bb7eb8e9516b5e807ab1bc4d45139a5d5db8bddfc8641ddbd4b8bd31158c3c07986f09256fd6d314a1c99952722bdcdc7c21465a77c0ea1ac621205eaec0

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_0.sft

MD5 ca1ad733fcb758298e9fe89e0860664f
SHA1 7146f2bc56d1a04f3dea4366684926c2f46d8811
SHA256 248e59a1a23f8766e2560d1e2ea00699172948a3b59e111dab5f63a353a5c604
SHA512 708fcd088a61efd9db59955be95f6860e0c38bf4802d6eb5d570143146229ec09e98d6680b00a394f7d0db8d391486303db1a5473c7d3e684770414a78d18e41

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_1.sft

MD5 27e9c4a1e05f1663d69d39c4ce9721d7
SHA1 c4e2cb960574632aac626e40b572d7457622428e
SHA256 7c77e4b929f928b6f489b546d25c8d5094c5bae4dc487350ffc049e8f0b659c6
SHA512 4e4aec1614bf3cf2746d548a6cfb5800587c6ec3f7be55df00169eebc0b84a3156f43ebcfa45cfe750cdf24b4813f528378469a22583a96f476c47ebb2bbd9fd

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_10.sft

MD5 5c01817d4304fbac151fae4c10ac0e66
SHA1 a030c200ec54c29b73f48787622b35a2621e4ed8
SHA256 ad4062ec7762eca5430a9dfe00fa935348111c9e64adad677bb251e95010cc5d
SHA512 04ba7601700e5116591a8cbd37f647a555d82fb609603a3b75ac4a895cc8958a09064aa5882005c3dcd30579c4d728f1374516fcc27bd7a08b247e4e0c731568

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_11.sft

MD5 9a220795eaaa14a6f730eefa9be1c9d0
SHA1 0eeaadcb3dfdef7287f45cb890d19ef1661c0d70
SHA256 0c4853d3c4c552b3c85aac13d04b691b9b2ea19d92402bf8ed15e5d28fd2af55
SHA512 55896b52788952ca55864ffcc1616f1104cf2b8998d1f3c1772494202c69e605f1ee28c9614cd20d427ddbb3bda19f4c646c30f0e262ed6d35f85b5828636937

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_12.sft

MD5 c4294d4214dd104d5b2b4dc4c4b8ac85
SHA1 65d0a6f9b4a169ed854f430c1b0022feb9c4f5ba
SHA256 0f1ff28a0dc4f0256c80c6b21f64c2e5fa732e07c8fe3a8db9218a931db97c27
SHA512 a763fe45af57bc999ab942e5bb40043034627ec0f52e835280dad1deb12ac5a246f7a5e8fa3f45791fa226d247bad75e91675d04aff8691ad5d369fc098d74f7

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_13.sft

MD5 1ec88f2e0a3880291633f822f799e321
SHA1 18b01fdbd331ce659cdff869c8bc63aca2373ed8
SHA256 3c5199bb562f9c3408bc85a589e858ef5caed11c64b2b553299e132d78b404a3
SHA512 ecb439139caed352bf48588702182582417b38add13180818a7e575c7a640188789a8a3708877007f107dc59823b27c4ef07634b0f2dbaeb3a7ccdea32abae21

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_14.sft

MD5 92a52eba772429d90c45a62bc3b21477
SHA1 72b0d58f34e409ff0e53c3c284fd47020b9d3156
SHA256 a09e18726d431f78005a71421a650c3f7b41bc5f85bcb7ac4870bf4da59cc82a
SHA512 c8038dbdbfa4430d56c124179664ddbef140fb483eec663520c242caac3297358c0d1d0e1d8a2902b5ecda16860a2f868e5d344541a4e6507b4f45a7901e3029

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_2.sft

MD5 6c4ad37ef6d75ebd8dce6cf7a253b657
SHA1 79c2576ba2d114362fd569a646b324eead4e6588
SHA256 bfa434b763b7e64f7c1cf0475524313ddf4c916be92f32d666f678eab5746d05
SHA512 dbdf15bee28a55a39c448a177b96165e009f9cdd2febc8c77c7c48a695c10f67b0e47ad0688d6cd24fab44d8210c04a73b360c082f1bf30bcab78f37e23fdfa3

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_3.sft

MD5 baddb502cc1bfbe6dc3ea39fa7189b8f
SHA1 8c522ed13ac5c861a41f0ff6d8f94768c1cb30d6
SHA256 76c3c663ccac5b4a98273d1e2a7d2983ffe85fc67aaa770d6230c27064f22b4b
SHA512 b61c0c91ced3cc71d1ae634177c212db4b47f72ea7558002f21e73cb402e168ec3cb258007b76c624aab9772b88a6cf2f276af0e8695e77a0b7fd95bfcb8e337

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_4.sft

MD5 149b028954cd0dd7fc21f1ee18deaa35
SHA1 0dafe6581b0b5e757795ac4fad9829c25675705e
SHA256 091287a21e56c04e2dd8c38d25b75902e786a0623544854aa936aa3051c63401
SHA512 8f3060f6e31291d6e60dde68c35505eb899538265409a5aaab39a3b805551812dc219e06d8607c6eb1de1bf8592f011428dae0571e12c01f74f3c3573922f129

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_5.sft

MD5 7c3aa50aceb1cd68ab1484b7608ae476
SHA1 0c8311b503c2f3d3152ada4a3fa30c9020b571b9
SHA256 a082a003ddb20094fceeae3a7be1928e59be8a0c1beb3914baf11f6408a81cd7
SHA512 60a913c868630cbf663b7f58e23e1863b914860aa710ff9f7ff8728c24bf29c6c4f7f99868b36a7564527797f7ba135412891b05d22222499603f3c967742dd6

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_6.sft

MD5 2dc210e6af4d83a07f73c9d5412e3c93
SHA1 a2b512ed95baf47e7b204188c24285801cab79ef
SHA256 180ba180ff3730d75375c4215ba5f0072e88b8481dfece685f5615b72f05177f
SHA512 14dfcb2abec4b98342a66a57171366595d48e69ed10ac9fb32884c6f852e947f4673c9fc9aebbf626e774d177414067140db0568554d1a382ef65d650adb4c18

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_7.sft

MD5 55dcc3b0f37afd98c384a48105842e47
SHA1 7962bce620f614f29b8cc912eea1f83b61450741
SHA256 482d5156d5eabd4ab8a88040e71dcb27ca97ae72c5c51e5f2c0868780e4bcbe5
SHA512 819a6a13ff9ae163f532eb0bf670194b713e0d1b42dd0fa362d3aa3f9cb5149040d760ae184dca51863d073c41bf6ea69705ee62dc35fee80e74f134ea768936

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_8.sft

MD5 e14b20aedf0fc7bc4d524f21f458c511
SHA1 b2faf19c5f8a7af72f57a621bd99efdc6e469a7c
SHA256 402d38b0a332f5092b8ec679905155b479db1d696c11ffe71ca90e3fd3fd1fbd
SHA512 c51f61f8654cbeaa5b0d5b2c69b8ac8e3ec07e8bcffebd80fb3529fa339607c78d31ac9dbe846068433bf8b2dabaf0b1601a510a57950e404207905678727766

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132467_9.sft

MD5 40f57e55a5d0af4c48b7e5d7b456fe72
SHA1 c36e4b2fcd990ab4f668cf7e987adc832cf62f8d
SHA256 f0cbde76f79249ade73e14badf41aaddf5c99916a7c9505f65486ea87f77c836
SHA512 44c09acaff258bcf93243c267472b2b1cd07ac75c41d1a6933dbee2bc1bbf96cc262cff2be8a01707a7218c3e1b5733aa18f8efb9755fe0337d28cd43389f631

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132529_0.sft

MD5 37f0fb87f79733beebacb8d5964d95ba
SHA1 fb304ba16b55437205f2dc3cd4a77b052923c513
SHA256 294ee6dc47cb85ccdf6efee650a04a90202408c7a717b2f968aeec1e24f78aeb
SHA512 a1f6c22a02fb5a29ee84eb5e46d66864b0c90e302e0ba7dfca8fa8b19007e5cf06dcae619d233fea5dd03f70b338a8d9bbedb70fbe592f9197541d27b862b7c4

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_0.sft

MD5 502fec1d832545b398b4f5c6c3eb8091
SHA1 6db653c9c506d079ddae251e2090abb60c20d288
SHA256 5c80ddf7c4c2873d162f771b2806e0f82a0fee2b588314e8f6cc6d18f535aa69
SHA512 cdbe322ae2e3f4bb2cf4f9e7b75b18fd61a9092cddc38a75b10d392c08dcc737dd836c6384bbeb53e73622d75a5ff15e9e37845188974f7000adfc084bab5f84

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_1.sft

MD5 6fce57aa08746dc919e39c73d964521c
SHA1 7b85bcc2367c5ad0a8afb462e1436588395a9d7b
SHA256 7195b7710aab673287290d76492db2559c10b1e8265de3fd6a27056b009e620c
SHA512 b492a1d14876d4275321a693814b0f2c05177481a7015847801251c7ef25ffc2ca26fc67c56c7860af5b169fac891effc4b30f4eb1af98dec4502c71a04fcc2a

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_2.sft

MD5 a6763469f730649c8c923003be84b8d9
SHA1 7aaa0a97c2b27a9e979e36b33911f43aec11f991
SHA256 dd11e46ac94e029ae8a19eba88a201d4e76e8a95aca78e2f4e626d3a3888e403
SHA512 c6f23e53298a41ddb51dffe600f5f7ce1a598cf55492006fc2a2287176ddb1fe2a075387779657282f535ed397ed2f443818dc947a21dfe675be03b416241dd9

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_3.sft

MD5 2125b1c533f8b77081db122dfdc97b95
SHA1 bbce80a3bb92f7086f1127486dec8290fa8338e8
SHA256 9c4b61188f32e5891b0a7bd2d6cbc84d2b3a17c81bf05593bc35ed603cd9f839
SHA512 a397a3ea240aa2dc0713f1f6cf28a78bf05091010c837c2ec7839fdf360a4da80562fdfd447f20d619a3a9c5bd14f211a890151400a92a2065b8c0df99561306

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_4.sft

MD5 0b019adabc8e2679d564cd08bcab7f02
SHA1 c35358346283f243171f5bdb1ddc3321c6ff1610
SHA256 1f7c482d30b927786cd9ab3c0debc29615ebb1eea0035461182528f925b017a3
SHA512 f5a69c2a20e9dd7f9bd230fe8c625d63482c34ac06d4319bcc63ffe368aa7b72c33add91720b435c6995cd343c39f6c584d228c2e400a7227fd1bee5c8cca938

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_5.sft

MD5 16a26672db2d8afa3b13d684fbbb7de8
SHA1 0d1bb6c67adc5c1b57d5dbba36f095138e90e740
SHA256 1e3cabc10fcff0578e568c7218f6118c9e2d6cf016455ff0ea36d565fefd86e0
SHA512 b294ed8d29e7ed851d07871d48bd03e95d1227282e0ccc082203ee43a541b8caaf8094ed67b2bb0245e745ff07b8907e2877335b9bbc76e5ddbf8f87851f0f0c

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_6.sft

MD5 691db7cade4d06320af5bacd6960453e
SHA1 4bb5359848dc66936dfa38ada730a1ed30c7c310
SHA256 24444e999d9863e637b3fc969d3de7558dd818c4be0ce72b527b47bcc56f20af
SHA512 d1cb3d5145a298a8d5d66b60711436c68bb6dff2d5fe2ed31117a1f629a14710a8e5bae7ae8ce6cd6005fbb8f24c4bcae52b3952bde423c9b4d842c34fcc31c5

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_7.sft

MD5 e6cbe3c9ec1e05a42dc5baf3f5ffce78
SHA1 ee5ed3273dd09c6974b4b58db7aafd355f37087a
SHA256 ceb7a84a1445f60be2dd1fe96b3b93befd43dc3797f9671ab8f74670dbe611da
SHA512 9a5acf1f67a3290ca58eeae3fb22f5e0ae55e8f660750e34000cbca95eeca17ad68d875facd52b7b27362c721673f3f80ffcc092d649b181aea5128fbf27c720

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132607_8.sft

MD5 0dd46ef95af276e143b4ab1791801189
SHA1 d1ee24ed09301d3920d9e7e60959aa553e2fd3bf
SHA256 7deac1daa051cdb11f0b4efba5d9da2d6dc5b9f042da18d04394657f5aeb516f
SHA512 9b49c71679b53e3d0a554d521e300eebf85d1b5e245e0de922505bd1c9e673efc28e7575144fbb7493b5153614c71cdb6dfe6671f2f01039fba81543d30052b4

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_0.sft

MD5 eb0256387d020bdfc6bc52555e5ab3c4
SHA1 b9caf2c88041ffee2fd3cfa0bee02e15976f1092
SHA256 e25331b0c98177813d348ed9df7c9ea81ad51ed6f0fcf423420b743705ae6ec5
SHA512 856b0f9cbf40add0089a63b9da2d9523e6976cc99f2a46a9e746d2a42356b4cd142a6064ded8cec31e0298cfcb56a9e99fbdac0441c9a9b9ad9a47c1ad5739b5

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_1.sft

MD5 3593b09729c50a8d3d56021d10a890da
SHA1 ea50b298e8efd3f86d5d53b6e3251ade91b7a764
SHA256 d5786deb941c49097e330d20a4ffeb7fe717376d6c405bf891ed4404e61cb2ed
SHA512 7ad6005a423189a08a5dd164e6ed326a2ec4b7623be534ffd9da6e7b2e1edc8045917cf56de5af642063e3494dd0cbfa9f2ace880bbc708e36eb4e6290d3cc18

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_10.sft

MD5 e9657c5aadb9f34287b86b74ac941471
SHA1 9c680d68a156eb8bb6b762d373254211a376b480
SHA256 d584254e1b97eeda359814a14f896368999de3453f3e7d31f9ed6999591a5609
SHA512 9e0d15ea58f9d94fae48a2d38996dc9a4e13847d0ba7dd5acd3402ffa98b5c229e5f8a56228adf510c2db65473c725f76eb256fb5e0a898034e67201d1331dc7

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_11.sft

MD5 dac891b7b4f924e20a27670e7131a494
SHA1 a990c3941b222906c4baae7bf3cd351d7dcfc15c
SHA256 11f82ea868dca28c707db1d697b6775162cfe2cc4e9937f8d7592fd12a792292
SHA512 fdad84a929042fb2bc7e9ad69cbfa83d09a46a558a41d6af69cc422356ab7ddb25929145df847423d5d55a8f03089748d3faa28749df9fb0a3f9ab5aa1fb917d

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_2.sft

MD5 6bf4676503e913b9b854867fb3ac18dd
SHA1 093b8da8dd2b9bce1ed8b07283165ab1b8dfe735
SHA256 c1ac0aefb5148877408608c3db588fb94119d1940b502e995f1acfa7f71e9cc6
SHA512 05bc3c01f59f86972e4bb3b141ec58b1999322833658d99ef717cfc92f67a8df8e544d5776d64d24ca463bf6e7b1a0eea7abe77c3c8d25a32664b1267f599d90

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_3.sft

MD5 f66ad5447534678eda095439f81fbcc1
SHA1 d6627cd4706921b7b72f878d93bc5eb2de727148
SHA256 a3e50d5ee255ee1b82136daa9a4e7030a4bc21b10606d23195fceb35f63382a3
SHA512 387a3e22093f163e2d37a32ab1cf4e4b115f1f583beaefc16884236837f5b6d51ee4e80dbef4cda97890ecda5af846ad6b789374d55a8ff5eb86d4c1f4f6ea21

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_4.sft

MD5 bedb4f420209525368b7d27261d33b58
SHA1 633517597b06cff8bae48dd9709dd0a03ee52f2e
SHA256 3b3a7b0282aedd1cb68d217067d7a29ad1c2a36902348d43f4668bff8f8b1340
SHA512 37c5b5f5a2d370a2cf071d54ad75362dc19facfe74550843d12d53fcd6699d400481d24703fa01ad99734e2d4b56a19007633f624105336c1f17524e6df030d0

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_5.sft

MD5 9b432b6165bc8c0141b2cf55ddd9905c
SHA1 05cf15110714180fe076cbc91ab2dba0da0e7f0b
SHA256 0373545bbfdf30ecbbfaecc2ba5b37f3165296d37b7889c04d12803edcdef2c8
SHA512 5409c9c0a46b695ffc40efd480fa4d70abd9d32c9f172b2c5464febea88d62d833438acae0e99521e5f7fff1ca1947bc82110bc5f796027b56d90b997135bb94

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_7.sft

MD5 5df0cb3fa94f63fa978b6e3e271e93b5
SHA1 039ecb81875dd7787408ed6537279821f3b77bdf
SHA256 7ad9e6b50185e6bf10bcb386655b52fd66dbcae57b8db1b41434c6725fa065c1
SHA512 b7f25ff96478320e59c54ac05a4ba85e0f281152bb9efbfdc8213ecbff1731b2d1830fa0077d82d8f6fe3f13cec45711b464a1493bb98329c177bda30cd4be48

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_8.sft

MD5 68f544e9a2eb6565a9c69a67c1767ea4
SHA1 0e1bfb6ce7e4fc872bbef15035cd6b102fd8212d
SHA256 3619a70a78c53f1f6bb74ab04bc88d8b48df7730bbbd1535a641c8ab3d48f17d
SHA512 fd0f8d7ed3bc66ca4095bcb098089d37f2bfb05fc6e20e1fcc3a688b0e306f9b4d2d04225f2c6cc24178f38e6977c29797c84e2667ecdec6d1dab6fbd5b21049

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_9.sft

MD5 3e33d6839d36bf21ac5dc3de532896f1
SHA1 cd557ab2511fb8697c2a1bb181d2d8624d667c34
SHA256 7d92e9bca5e047f846389956581e5baf6d7a034d591c1e0b1e2ddd79859d441a
SHA512 769614a4c2185541bd19b46a619fbb5ed79902647d880276fc45c84f96d89f1659e3359d1d7d663a0820babea52327d599ce4d0bc559753f2d5c4fda70c787f8

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132810_0.sft

MD5 23e8d8ab8f82c79b2042971dc4b8e7a4
SHA1 e10d3d13de4ec579f9884a0e04b19cd74f7758d5
SHA256 80d98f57e57bdb8df3e9ee82b5ece96e77630276881101ba1ac2016b04ceb41f
SHA512 f2dcea574787901b00ccb228afe3ac5fd72a280c8ccecfae44277c0ae29eb2ffb8193565abab80458a393a361f55a817f176337604f2c5bf1a77925e457d0975

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132810_1.sft

MD5 9ba13501eb3d67b5c2a21aa884d663b5
SHA1 1b5f624f01cdecee72e9db26c0fd29ab57f8a6d8
SHA256 96db555d7547600659bd41a1614f46d2dfb5a072974c5a08a9fce0c0bb035f87
SHA512 01850f7e287547f6e33978e33a36dfd6d81cf0bb570f9fcc75d1ec09f6decc6b130bfad0adba11b684438057d93794fd025cca6c9956baa92fba1e9db642f270

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132810_3.sft

MD5 0c7bbd8fd3e77ff2eeb1eeee0c5f4d16
SHA1 c9c4f54c0696b3506780406d4504a05e5dc4adb1
SHA256 cd8745bbbc1ff42b75414a2241dc80d89b8b059922175e5b3bef149bbe6081f9
SHA512 4eff477ee9d666d0fb34ae36c15af0b2b40c223f67da22b98e5f3378eae429a453597a74ec9a4f132e4d2026bb42f4f87e459b46e2950a317601d864e8b3c51e

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132810_2.sft

MD5 ee3f78133d38a6f314f6240da3f850d0
SHA1 7a121a535779e78a7989290387bdfdf94e988da8
SHA256 129a2dcf41b82ed3fb09ba943bcf151e8f3d0ba5885f15d9709ac64d529d3096
SHA512 0aa9cf8508af02d35d7bfb0c79e876c5d9c21202abc687a2a61f25a9eb0f5bec396859463ddf9cc1132385df78d559bc41580037c207014368a42628c217098a

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132810_10.sft

MD5 1b992d885084d6c85d4521d6f1ac2b80
SHA1 2b7b55295835985ba98bbf1a6cf70910f2508e4c
SHA256 bf9d1d6747ae82f9b4bd8ea0da3f2223ab87a9736df38afcddaba019d3c4aa7d
SHA512 a8e4d48196dd51e3360f7fc53b2d30460a43fb70b52dc50b5ce756f20315b7b5ee5dd185e58afed88b1f96e08f9a4262d40823beefd7d1678ff0f4a4cc63d68f

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132748_0.sft

MD5 6990382119b394368b8de15c7856e492
SHA1 23c0777efc696e0d7cdc5c1a9fe73ba6d15e5335
SHA256 b552b4372767da415acdc041c20e4eed0f86f098afc7d3d50dca29f6e2dc2a91
SHA512 836d872e634032886f1b0058e2d1d691a5ab330eac1ade1b164d42da0d5a9e861fb9487c6e912665979c2c5e5a6b91b4dfc8ddd45e4531f1a2f8e78e794755e0

C:\Users\Admin\AppData\Local\Temp\ndaData\guid_app0_3287044223_0224040132701_6.sft

MD5 e2315676e86f968ebb2cddd56ab80c82
SHA1 1cac2a3a758af95e7966a6d3f7107dc8b9a0b6f9
SHA256 39a6ed232d2981d79d7193368ab17c5b60a69a6c900ef80acdcee35ee6714a2d
SHA512 83ac595b0eb3a4d7c35bc77a04cf82b4e1a8ee432c3707b9d1b31b3d101bc685bcbddf17187cde8d29db43c0d2a9d8c62e06f4b281f56766f8fec7c89abbad38