dc39a617cbc810947288e1807ae25a5818ef5e7ef8f52db5b3f0fa6dafe11525

Resubmissions

19-10-2021 15:42

211019-s5dkasgbb9 8

19-10-2021 15:32

211019-syrtcahaej 8

Analysis

max time kernel
204s
max time network
196s
platform
windows7_x64
resource
win7-en-20210920
submitted
19-10-2021 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Station-Setup.exe
Size

132.9MB
MD5

c890a32c24beee148d2ae84caa8016ea
SHA1

44386bd7d31cd9ec08b32ec366dec5a9e30abe11
SHA256

dc39a617cbc810947288e1807ae25a5818ef5e7ef8f52db5b3f0fa6dafe11525
SHA512

a120649d06ece2b4224d2f73710e488a73441ff257b484930e8a9b704356bf3b91847fbbfe9a93a522c0bf018e459e2e4841e874f07ba304569214202086d90f

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 14 IoCs

Processes:

Station.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exe

pid	process
1616	Station.exe
1396	Station.exe
1316	Station.exe
900	Station.exe
924	Station.exe
1636	Station.exe
664	Station.exe
2168	Station.exe
2244	Station.exe
2384	Station.exe
2396	Station.exe
2544	Station.exe
2668	Station.exe
2824	Station.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Station.exeStation.exeStation.exeStation.exeStation.exeStation.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Station.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Station.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Station.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Station.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Station.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Station.exe

Loads dropped DLL 53 IoCs

Processes:

Station-Setup.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exe

pid	process
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1400
1400
1400
1400
1616	Station.exe
1396	Station.exe
1316	Station.exe
1396	Station.exe
900	Station.exe
1396	Station.exe
1396	Station.exe
924	Station.exe
924	Station.exe
924	Station.exe
924	Station.exe
900	Station.exe
900	Station.exe
900	Station.exe
900	Station.exe
1636	Station.exe
664	Station.exe
2168	Station.exe
2168	Station.exe
2168	Station.exe
2168	Station.exe
2244	Station.exe
2384	Station.exe
2396	Station.exe
2544	Station.exe
2396	Station.exe
2396	Station.exe
2396	Station.exe
2668	Station.exe
2668	Station.exe
2668	Station.exe
2668	Station.exe
2384	Station.exe
2384	Station.exe
2384	Station.exe
2384	Station.exe
2824	Station.exe
2384	Station.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Station = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\station-desktop-app\\Station.exe\""	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
9 freegeoip.app
19 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
8	freegeoip.app
9	freegeoip.app
19	freegeoip.app

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Station.exeStation.exeStation.exeStation.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Station.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Station.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Station.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

2088 reg.exe
2892 reg.exe
816 reg.exe

pid	process
2088	reg.exe
2892	reg.exe
816	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Station-Setup.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exe

pid	process
1572	Station-Setup.exe
1572	Station-Setup.exe
1572	Station-Setup.exe
1316	Station.exe
900	Station.exe
1636	Station.exe
2168	Station.exe
2384	Station.exe
2544	Station.exe
2824	Station.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Station-Setup.exe

description pid process

Token: SeSecurityPrivilege 1572 Station-Setup.exe

description	pid	process
Token: SeSecurityPrivilege	1572	Station-Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Station.exe

description	pid	process	target process
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1396	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1316	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1316	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 1316	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 900	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 900	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 900	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe
PID 1616 wrote to memory of 924	1616	Station.exe	Station.exe

C:\Users\Admin\AppData\Local\Temp\Station-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Station-Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1008,17192353731535931394,10166424787616911711,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=16570199565848217664 --mojo-platform-channel-handle=1040 --ignored=" --type=renderer " /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=utility --field-trial-handle=1008,17192353731535931394,10166424787616911711,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --service-request-channel-token=10771073656434287665 --mojo-platform-channel-handle=1300 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1316

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1008,17192353731535931394,10166424787616911711,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=13349449736312239304 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1432 /prefetch:1
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:900

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1008,17192353731535931394,10166424787616911711,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --service-request-channel-token=8183665752505676547 --mojo-platform-channel-handle=1040 --ignored=" --type=renderer " /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1008,17192353731535931394,10166424787616911711,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --webview-tag --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=15647047519911230643 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1656 /prefetch:1
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1636

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Station
2⤵
- Modifies registry key
PID:816

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Station /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe\"" /f
2⤵
- Adds Run key to start application
- Modifies registry key
PID:2088

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1008,17192353731535931394,10166424787616911711,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --service-request-channel-token=6751701532265445203 --mojo-platform-channel-handle=1436 /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2168

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1044,6942941875308573536,3914764389326544603,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=12782914522201186042 --mojo-platform-channel-handle=1052 --ignored=" --type=renderer " /prefetch:2
2⤵
PID:2072

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:2244

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1168,3793501630011902445,18213199004822540195,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=14853805729464586326 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1176 /prefetch:1
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2384

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1168,3793501630011902445,18213199004822540195,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=3232421274732415274 --mojo-platform-channel-handle=1336 --ignored=" --type=renderer " /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=utility --field-trial-handle=1168,3793501630011902445,18213199004822540195,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --service-request-channel-token=3784733933776262695 --mojo-platform-channel-handle=1444 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2544

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1168,3793501630011902445,18213199004822540195,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --service-request-channel-token=14805439446987568757 --mojo-platform-channel-handle=1336 --ignored=" --type=renderer " /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1168,3793501630011902445,18213199004822540195,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --webview-tag --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=7975397809292381674 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1620 /prefetch:1
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2824

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Station
2⤵
- Modifies registry key
PID:2892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\station-desktop-app\D3DCompiler_47.dll
MD5
fea40e5b591127ae3b065389d058a445

SHA1
621fa52fb488271c25c10c646d67e7ce5f42d4f8

SHA256
4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345

SHA512
d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\chrome_100_percent.pak
MD5
c56bc01c88f2fd186ae22f10b1bd5900

SHA1
b000e68ccd919010eff8c2e114b7d1b6e702d997

SHA256
d8cbc2234f40b49437a5876bb008b6b43afdf92391dec3f0739be98e448ab671

SHA512
46f9158e0f06a4e415b95a7dabe88cc4f3eecc235cdaf9d744caf4de5e665ae91599e3c2feea0860e9f6eeb2eea45fe4e57542fae95ed9110d44624513de3aa0

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\chrome_200_percent.pak
MD5
9662c1f572ef83f070d2354b0275ec60

SHA1
04ce905a95a1c3b8521a17ac9f57503e7aa3eac9

SHA256
55dd419a1cecca86665ba5e6184d6b58edf714d652e67c5220dd3b407d99afa8

SHA512
b1d34d58f5079b1db9764bce2787969113ac7cb1b83dbc3ebce8c9c287af372a639611ba11246a088243e2098dbd1d6ad51341eff2a57a995868bb0db94a3167

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\icudtl.dat
MD5
9e8b247aa7a609e6632518ecd6634fc0

SHA1
cc43315bec76167be7dfbb7dd0b6d61974204d6c

SHA256
18acc07d9ca59b1e599343b022a9e602a0a0c152866f7e5dce1fedd2dbcd33a0

SHA512
7a9590f410c14886317d7cdae606b50b4a0355061e251aa3bcd3e0c614438298e839ff116553089116423e9bc98c131f35796478517d88a180a5a2d08ff7fa5f

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\libegl.dll
MD5
5a4553e089662d4d9f99e4dece823ebf

SHA1
4ed8c6cf808725827c101fbfe0d08ec13d70cf65

SHA256
add0b7f987895aaabaa241ac3c0914264d6259bd493a0370d406798705c8ff12

SHA512
466da4fbdccaabdd892024f729c5b6a0c48a3c7f64ff497278669d90cc5d309ee722f02b16d0da2ecc566bfdb24d0460d607acfc78ba98d30b3bf0962a03e5f7

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\libglesv2.dll
MD5
05be3906bc049195636194ef08be0943

SHA1
4a83c1f3787ac15670c73b1ee31e07a374d550fa

SHA256
27567f6def82ce616060b99b671d443bdf95d7c45c98ec8f6234f460e8c830e2

SHA512
e621d3d45c348097c33f6786ff0f797a57703d9cfce399686a3a8cfcbe3ce099683d239ede10816e56464ff4d2531ac579366044836072ceba2d62c0a8397c52

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\locales\en-US.pak
MD5
ce30d32061b772148cbc966915291edc

SHA1
4c5edaed4f3ba6e10443f344e757c26f7ceb4ce9

SHA256
88a07be1329cfde3486dd0376de77e289468a750273970aeae6ad4468c0969f4

SHA512
720fa132a3362ea4f5ea10f30c4996378d1f196210cef13c38579dbacc1f11e55d6dfdaa3aa0a6a574670a962f6e2910a2d66a64a1e7e1d6466b20529f5652cd

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\natives_blob.bin
MD5
1582ffe1b8cb37438bc22edee6cd0a90

SHA1
01af249f33b2e5ffba18ba8f7cd76f2ee0e5f425

SHA256
02586eeaf4ce40d1b34310d885e34fb63e8e9f155fcedbd796536735907cbe80

SHA512
8c66ba4ef15fea573c29f0f6977e290b8fd72f4c8833f31a9b0ef4285f5493e9b27daf3a02c352ed12eadce36cda933d9d97576bfa4dcbbcc04294e73ad9ebfc

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources.pak
MD5
95b94a5784a8b31b3dfb56ed309510cb

SHA1
85e290c41d4be9c0d591404b281dc3931bd78c0f

SHA256
43aa558648917a11fde82e73d9f1878d500098196e675ce2915c26361a05e8d5

SHA512
86ebe9904050d8653a029b52effd977a42e727ca40e62c7d2ceed4685dfaf762678a3402c16d90bb0a05357eebb988614964fce6ae19a67636f6cc3f8578bac4

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\.env.example
MD5
f5e84418e2d1a3f2b8c0af9120743763

SHA1
9222cabdebdd15a5ac99a45645317fbb1f407d7d

SHA256
56e082fa869cc958663de48d69b04b10e31f052a5748117a3b876b42f676a58b

SHA512
c28428cacc64eb12a92b3d39067d9076747981ca1f4b33e9b8962e450136ded4e59021b8932f4b5eb67bba1f64a87a8f8f56ceb168eec44b6575fbb94bfb85b0

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\.env.production
MD5
bd3459f79f44d1a2c60806894c38ed15

SHA1
5535ad89574721ce9caf1b3f922c3e11fd1161a9

SHA256
8662a57760a262d7458bdecb6355193e3c25ada96b72fbc8389b11b7e721f995

SHA512
61898b9ea2fea638621d83bb210616e500f45951204226b8ab4d93a4d2b972e9c20f03b0bd9455a17bbcd942bda9d8f1ad1a2976a454721cc4b4714432fb7155

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar
MD5
c79ce4958528109f3b1d579fdd5bf218

SHA1
fa84b80afb469a9a8c12c65532bc8fc26881328f

SHA256
3180c6cc4a82b2eb0ef0af7b2cb35304c0593029f63dc03ec9b02f0a037f9856

SHA512
35cdbc09739987c564d2981ae95689aae50f87b0c5f2d3c87c1ba254a8a6a78115b5c493e857a1d07ffcadd40abe3dd4c7006b87c03a2d3245d6e7abc2a18eca

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libegl.dll
MD5
1a76c3311b6f88a7aeafaae4a4e2e7a8

SHA1
0f57109f7c13b1857dd693344967ab3e67f87181

SHA256
733e0f790eae21e61c38fdd4f790050d11eed5b5057ccf7bbbb572d5440607d1

SHA512
c6daaaacfadb3d662fa1d12799c4bd1f6817df48df44dc9fdcf3c2b185d3e6898f4a6fce7b59a27539d206f5316b1fa0620aec4efb1db7a07893e8a1ede5846f

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libglesv2.dll
MD5
1ce2b05e35cd252c0659d56a662db583

SHA1
1bb3e8becfa0ed3fc506f331a3bf617b2e1d7149

SHA256
e66d9edeed08bfa60e3499c32c8c7f70b3bf237849ebd1c069305f83e1427752

SHA512
096f2b3ef2f8f7a7252d8ea442092d1042cbff4112d76dcca0c8e54232f7b5119fea4a894236331b49a1f55a7da37a039120b45ff53a042f08bb9140cfc391fb

Download Submit
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\v8_context_snapshot.bin
MD5
791e836529dc39d99117742c225a537d

SHA1
8d035c2446758ec65c41e48d3671004527a55772

SHA256
6baadc6adcd5e51d549a4d2f07b619d2a5b97f99a372f33efd3c84d2a369c747

SHA512
afca91bad91c359af1febc86e5e0cf16b0b2549ccdb6ae1d733f9d66e0d1daa4a3b96273d7888835dfe820722ca8d7e38b1085011dd7d6851a3198cdc18bbac2

Download Submit
C:\Users\Admin\AppData\Roaming\Stationv2\Code Cache\js\index
MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\Stationv2\Code Cache\js\index-dir\the-real-index
MD5
b7511315fd9ee76f06e6bdba7c73071c

SHA1
7415f005a9eecd4e82adf6925ee40285b4d5df84

SHA256
c72cee37382e8d1e5a9b939927d4048c76723378caee9d0cc47fcfec88d35e6a

SHA512
3061ae7721f84768efb0a44a71d32ad073bc96fdb7367aca662a3c2230f251680402e9fb682ed75a095660349412200505feabb10a274d75612102b40fa3dfaa

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe
MD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b

SHA1
572c39f6f6d4581841def3676dd9b8e2fc51de86

SHA256
14295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f

SHA512
43260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\d3dcompiler_47.dll
MD5
fea40e5b591127ae3b065389d058a445

SHA1
621fa52fb488271c25c10c646d67e7ce5f42d4f8

SHA256
4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345

SHA512
d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\d3dcompiler_47.dll
MD5
fea40e5b591127ae3b065389d058a445

SHA1
621fa52fb488271c25c10c646d67e7ce5f42d4f8

SHA256
4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345

SHA512
d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\d3dcompiler_47.dll
MD5
fea40e5b591127ae3b065389d058a445

SHA1
621fa52fb488271c25c10c646d67e7ce5f42d4f8

SHA256
4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345

SHA512
d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dll
MD5
0173d01bdcb90a5027ca96d633686fd3

SHA1
9e008814f94c3abf5a7ba672864f50a4a2a288d9

SHA256
f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff

SHA512
47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\libEGL.dll
MD5
5a4553e089662d4d9f99e4dece823ebf

SHA1
4ed8c6cf808725827c101fbfe0d08ec13d70cf65

SHA256
add0b7f987895aaabaa241ac3c0914264d6259bd493a0370d406798705c8ff12

SHA512
466da4fbdccaabdd892024f729c5b6a0c48a3c7f64ff497278669d90cc5d309ee722f02b16d0da2ecc566bfdb24d0460d607acfc78ba98d30b3bf0962a03e5f7

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\libGLESv2.dll
MD5
05be3906bc049195636194ef08be0943

SHA1
4a83c1f3787ac15670c73b1ee31e07a374d550fa

SHA256
27567f6def82ce616060b99b671d443bdf95d7c45c98ec8f6234f460e8c830e2

SHA512
e621d3d45c348097c33f6786ff0f797a57703d9cfce399686a3a8cfcbe3ce099683d239ede10816e56464ff4d2531ac579366044836072ceba2d62c0a8397c52

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libEGL.dll
MD5
1a76c3311b6f88a7aeafaae4a4e2e7a8

SHA1
0f57109f7c13b1857dd693344967ab3e67f87181

SHA256
733e0f790eae21e61c38fdd4f790050d11eed5b5057ccf7bbbb572d5440607d1

SHA512
c6daaaacfadb3d662fa1d12799c4bd1f6817df48df44dc9fdcf3c2b185d3e6898f4a6fce7b59a27539d206f5316b1fa0620aec4efb1db7a07893e8a1ede5846f

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libEGL.dll
MD5
1a76c3311b6f88a7aeafaae4a4e2e7a8

SHA1
0f57109f7c13b1857dd693344967ab3e67f87181

SHA256
733e0f790eae21e61c38fdd4f790050d11eed5b5057ccf7bbbb572d5440607d1

SHA512
c6daaaacfadb3d662fa1d12799c4bd1f6817df48df44dc9fdcf3c2b185d3e6898f4a6fce7b59a27539d206f5316b1fa0620aec4efb1db7a07893e8a1ede5846f

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libGLESv2.dll
MD5
1ce2b05e35cd252c0659d56a662db583

SHA1
1bb3e8becfa0ed3fc506f331a3bf617b2e1d7149

SHA256
e66d9edeed08bfa60e3499c32c8c7f70b3bf237849ebd1c069305f83e1427752

SHA512
096f2b3ef2f8f7a7252d8ea442092d1042cbff4112d76dcca0c8e54232f7b5119fea4a894236331b49a1f55a7da37a039120b45ff53a042f08bb9140cfc391fb

Download Submit
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libGLESv2.dll
MD5
1ce2b05e35cd252c0659d56a662db583

SHA1
1bb3e8becfa0ed3fc506f331a3bf617b2e1d7149

SHA256
e66d9edeed08bfa60e3499c32c8c7f70b3bf237849ebd1c069305f83e1427752

SHA512
096f2b3ef2f8f7a7252d8ea442092d1042cbff4112d76dcca0c8e54232f7b5119fea4a894236331b49a1f55a7da37a039120b45ff53a042f08bb9140cfc391fb

Download Submit
\Users\Admin\AppData\Local\Temp\05dc6b0c-9b54-42c5-86f6-405d32b15094.tmp.node
MD5
a8f34346de08c2afed1f4332f961c5b4

SHA1
924db28b733f45253a367e52e046f5664c055ab6

SHA256
6a76ba909aafcac10f64fa6375cc893970c35d0b94148706f4e1206b33baf0ae

SHA512
d0ad30ba8e0c1368a01c94aeff1343c6d3828ccb729393b033d4d94e9b3917deb287ba61b570e27f7b6c3170ad40c765e3a654ccac71d4250e11d8b3613ff881

Download Submit
\Users\Admin\AppData\Local\Temp\557ebefc-019a-48d7-b32e-b4c004c1042e.tmp.node
MD5
95f9559b76e5dc773763c8faa8b3bc33

SHA1
f15fd746dfb5643b1e66e2a38543f489730f7809

SHA256
21e7c7a7e677a000984692d13784f25903bbc50b3ce07105b28014ae74b9e720

SHA512
45ea775a7730aed061e188c9f4a96f16a14124a853d461ccd12ae28348224f74ff20f2c478d324ab959c60a8c05b423e0024307bbbee5e6d22a54ce54bee9cd3

Download Submit
\Users\Admin\AppData\Local\Temp\665a58c3-d4e9-454a-8141-5f6348fe9249.tmp.node
MD5
3bca3a480cb2ec13ec22e2749e1e3c77

SHA1
9f63f9e31f98ecefa0fca07768b187f84d3f7169

SHA256
e01b14db88d119f7b034941768ba876da0fa6d867fb3281f1e7c57c5968bfa6b

SHA512
28442162914500109b54d5206d19532ecb98000bc92556dd9dc2867ce7d5842b36c6f7733d89ea0448757330aea5211f0d04a848f4d34018ed0e6536c6c1a35e

Download Submit
\Users\Admin\AppData\Local\Temp\729009ab-f282-4b78-b3ce-695d6d590f8d.tmp.node
MD5
e8ee0d19c4c20f399d60ec635610fd64

SHA1
3f8d018830fbea3ad0e59cccc2154996d84a8b2d

SHA256
03ae26ac0a2f12d11b040aa40dba9d3d8b0bef054394ee6b0c415601b664a2bc

SHA512
4b6fbdf7b6af0bc296e9bfc2d93dd6cdff11e18974db3a97a55a03bea12b3884c2dec9e95599f4ba58ee026419015adb3617386d5c6b513f16d0385da9d110df

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF603.tmp\SpiderBanner.dll
MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF603.tmp\StdUtils.dll
MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF603.tmp\System.dll
MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF603.tmp\WinShell.dll
MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF603.tmp\WinShell.dll
MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF603.tmp\nsProcess.dll
MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF603.tmp\nsis7z.dll
MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/664-165-0x0000000001D40000-0x0000000001D41000-memory.dmp

Filesize
4KB

Download
memory/816-161-0x0000000000000000-mapping.dmp

Download
memory/900-113-0x0000000000000000-mapping.dmp

Download
memory/924-128-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-137-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-130-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-127-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-126-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-133-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-134-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-135-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-136-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-129-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-138-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-139-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-131-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-140-0x0000000000000000-mapping.dmp

Download
memory/924-132-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/924-125-0x000000000017F000-0x0000000000180000-memory.dmp

Filesize
4KB

Download
memory/1316-105-0x0000000000000000-mapping.dmp

Download
memory/1396-100-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-91-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-104-0x0000000077040000-0x0000000077041000-memory.dmp

Filesize
4KB

Download
memory/1396-102-0x0000000000000000-mapping.dmp

Download
memory/1396-94-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-101-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-84-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1396-87-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-99-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-98-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-97-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-96-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-95-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-92-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-93-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-88-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-89-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1396-90-0x000000000007F000-0x0000000000080000-memory.dmp

Filesize
4KB

Download
memory/1572-53-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1616-121-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/1616-72-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1636-154-0x0000000000000000-mapping.dmp

Download
memory/2088-166-0x0000000000000000-mapping.dmp

Download
memory/2168-167-0x0000000000000000-mapping.dmp

Download
memory/2244-185-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/2384-176-0x0000000000000000-mapping.dmp

Download
memory/2396-197-0x0000000000000000-mapping.dmp

Download
memory/2544-198-0x0000000000000000-mapping.dmp

Download
memory/2668-220-0x0000000000000000-mapping.dmp

Download
memory/2824-223-0x0000000000000000-mapping.dmp

Download
memory/2892-225-0x0000000000000000-mapping.dmp

Download