Overview

overview

10

Static

static

10

Netron-Set....6.exe

windows7-x64

7

Netron-Set....6.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

Netron.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

3

resources/elevate.exe

windows10-2004-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows7-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$R0/Uninst...on.exe

windows7-x64

7

$R0/Uninst...on.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Netron-Setup-7.8.6.exe
  • Size 145.3MB
  • Sample240907-da2w3s1dqr
  • SHA256 818d03cd6f348268d6609954eb3b4f9cd3ddc5e16165cacbb8fd416feb2d3d1c
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Netron-Setup-7.8.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Netron-Setup-7.8.6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Netron.exe" /FO csv | "C:\Windows\system32\find.exe" "Netron.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Netron.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3284
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "Netron.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:812
  • C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe
    "C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe
      "C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1844,i,6623207789810832192,16088231681085416171,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3696
    • C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe
      "C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --field-trial-handle=2284,i,6623207789810832192,16088231681085416171,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4408
    • C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe
      "C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --app-user-model-id=com.lutzroeder.netron --app-path="C:\Users\Admin\AppData\Local\Programs\netron\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2384,i,6623207789810832192,16088231681085416171,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2736
    • C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe
      "C:\Users\Admin\AppData\Local\Programs\netron\Netron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1280,i,6623207789810832192,16088231681085416171,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1032

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Programs\netron\chrome_100_percent.pak
        • Size 147KB
        • SHA256 14a6a393c60f62df9bc1036e98346cd557e0ae73e8c7552d163fa64da77804d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LICENSE.electron.txt
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512
        Submit Download

        LICENSES.chromium.html
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\LICENSES.chromium.html
        • Size 9.0MB
        • SHA256 40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\chrome_200_percent.pak
        • Size 222KB
        • SHA256 20c93f2cfd69f3249cdfd46f317b37a9432ecc0de73323d24ecf65ce0f3c1bb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\ffmpeg.dll
        • Size 2.8MB
        • SHA256 996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\libEGL.dll
        • Size 473KB
        • SHA256 ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\libGLESv2.dll
        • Size 8.0MB
        • SHA256 3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        af.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\af.pak
        • Size 508KB
        • SHA256 e973763dcc0ffd7a5afe0a62ec9651c4c3db7fe29a23797fafc34b83512d03aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        am.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\am.pak
        • Size 822KB
        • SHA256 fdbbf59c2f6d4e9d6bf8bc7209511850bb337b0a49a25d39779bdd0e105f1682
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ar.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ar.pak
        • Size 901KB
        • SHA256 5f1b06de1f8105ccebb79651781fc219013048951a6e1b15a2c4f567ee45e88f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bg.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\bg.pak
        • Size 938KB
        • SHA256 086e2955bc5dbba52b0ab055bf788bd7852a851a29bf1249dbd134713f04e6f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\bn.pak
        • Size 1.2MB
        • SHA256 dedf3a8c24b13eafd99d9bc44dfc4d7a74f01eda532e05c8d61b4457f348fd09
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ca.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ca.pak
        • Size 571KB
        • SHA256 50657071f311dc06c746346a25d10642f182519c1eb3ab898421722271bf2c66
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cs.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\cs.pak
        • Size 589KB
        • SHA256 814990ab6af4acb4acd44b0f07fafd4375724facf4e3080014ce7b8b9e935fb9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        da.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\da.pak
        • Size 533KB
        • SHA256 600e02877374dc083b21deb3cc3bf6a4e3e2b2c581a631955494b0591c56289c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        de.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\de.pak
        • Size 569KB
        • SHA256 41e503b5e5638cccac6b0165d6c2d2b583e3a6190f3b1dd2e8dd25494d3bdf96
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        el.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\el.pak
        • Size 1.0MB
        • SHA256 7134776724c07c2df17f6ba0c3c26a2a536d512e913d1d9c5585e600895e695a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        en-GB.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\en-GB.pak
        • Size 463KB
        • SHA256 d86bc52d844b9706cf9fc50e7c123ab9a6372dd3190a65a88bff7d57f64af362
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\en-US.pak
        • Size 467KB
        • SHA256 46958caf9847e33a11593ad024d5a95cc696edcd4620cf07e7b2b78c72b9c00c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        es-419.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\es-419.pak
        • Size 562KB
        • SHA256 89df263a85ccce719cf2b1a5bfb3b2bec5f6f48d0cf1b7ad190b34992aa8309f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        es.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\es.pak
        • Size 562KB
        • SHA256 91de93a4dc9c9276b9ee3ae498bdafaa55fd464c1f20fdaca84c4b79842327d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        et.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\et.pak
        • Size 511KB
        • SHA256 678e50d9785c14f205baff60760decf64f765a98863e000abe44dcc6f22b5d0d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fa.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\fa.pak
        • Size 836KB
        • SHA256 645a43a0101eea39dc6b29ffd71a4836a03ebd7070e61aa962025257aea59375
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\fi.pak
        • Size 521KB
        • SHA256 f040febcc899b194a6908419b4bc225ed3d53ec478988ed7a50e8438c80d9606
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fil.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\fil.pak
        • Size 590KB
        • SHA256 db27ebc5b34d14be370e7068b4bab4fe12fdf090bc1a4f0bad81740aee974695
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\fr.pak
        • Size 608KB
        • SHA256 25eb9ea0d0007b5d4c5065fb77486c723d718a1496aa52013d1ea098987f44d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\gu.pak
        • Size 1.2MB
        • SHA256 0e8762ac08963088c33b74ee790df95370bbfc298bae8abfb87eb1307ef46d37
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        he.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\he.pak
        • Size 734KB
        • SHA256 90f11a1c09fcc4a5fd5d6f753bea04af93ff8ddf4372a5f84a15fc2ccb444c95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\hi.pak
        • Size 1.2MB
        • SHA256 00670d07269facbd70e3949f3da5a73f584e08a6e901ac8a3b1767fc439c975a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\hr.pak
        • Size 567KB
        • SHA256 4171bbd2229ed5a7638b74e32d7aa0e643cbc99051d92a80e7da5a31400ae69c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\hu.pak
        • Size 611KB
        • SHA256 89c47beea85d50c88af6f94597f827bfa657ec73570cb4b3ffbc3ff91164ba89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        id.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\id.pak
        • Size 505KB
        • SHA256 6f86ea779e49c8eb24ed6ba416ad67d5e08f8a3673c68e4cfad19475e12a2911
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        it.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\it.pak
        • Size 554KB
        • SHA256 75e90045cdafecc013f62097e1aabae18362954cf993eb4f78ed1639e3468186
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ja.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ja.pak
        • Size 675KB
        • SHA256 91084c3d2709fed5c912fd55b2499c394b3a8ebba5032d03056845f88a141ffa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\kn.pak
        • Size 1.3MB
        • SHA256 a1b23f794547f06510adf767b23a47df68ae864b059f8657bb78dd8b352de232
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ko.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ko.pak
        • Size 572KB
        • SHA256 11f4f99e5f7d04b263f615d9d0716c0852b8c63a07212d14604373853aa78588
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lt.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\lt.pak
        • Size 615KB
        • SHA256 0b0e3fcb82ddca52f9eb1ff9e1ee224639ff81f1c0af6ded4e21944811babc0b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\lv.pak
        • Size 614KB
        • SHA256 7e17246e23ca2d0241d56d91b5d5e6bfb3ff4e08f1a3734f9d032b4191282fa2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ml.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ml.pak
        • Size 1.4MB
        • SHA256 682463d4a0221711e565ecf409893536d727650efd2ed0563c722cceab66b1ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\mr.pak
        • Size 1.1MB
        • SHA256 e5702b9578435abbbcc922f1d4ff8c5a345856926c2174c329e228987c3ac7d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ms.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ms.pak
        • Size 528KB
        • SHA256 1af4b9a66ca413dc3a0785f2b1527c237bdd05ba5768fe077aaf8af0f1c50dff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nb.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\nb.pak
        • Size 512KB
        • SHA256 1df78fd35431f167def5c496e441775a265d3eb1e64a4cc0fb7fe0201c1ce8b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\nl.pak
        • Size 530KB
        • SHA256 a400121adbb26c97a95e3f573f370ec2c37fd435132828c04b467dac47352904
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\pl.pak
        • Size 591KB
        • SHA256 6257145654f4e47c21ef2b91fe69fc386c1e228a89a658418532a2934433cd7b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pt-BR.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\pt-BR.pak
        • Size 555KB
        • SHA256 77d29b746b4028ae7072d5f74ffe1cbdc66b180a36eeed71e52ef1f7b824cddf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pt-PT.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\pt-PT.pak
        • Size 558KB
        • SHA256 953f8245585ebb637b2d2134b24118f2baa9c28211ea007a8605fa57c7df21f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ro.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ro.pak
        • Size 579KB
        • SHA256 9ff47f6890b3f543bc51015f263e791d8a3bc332098f8cd8199852fa131fa579
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ru.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ru.pak
        • Size 951KB
        • SHA256 f6538645321dfa0f2ee3f17284ff72800f6a678df3f5b7d729d02a4496adcce1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\sk.pak
        • Size 598KB
        • SHA256 4fabe714236712d691908751b42e947fb03a4b1a439e7a84335e7f18f87625e3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\sl.pak
        • Size 574KB
        • SHA256 10676c91bac7b80d314a1d7a934bebc5104ed730bd4eb78d84c497f7e07b5510
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\sr.pak
        • Size 883KB
        • SHA256 068c3f92a20c5202b592e26078d6aca908d39e2fc325a605166e7235a73366b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\sv.pak
        • Size 516KB
        • SHA256 a851c7537b895145f45f395c92ca273610f19f109c959b368672a5a92175aa83
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sw.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\sw.pak
        • Size 543KB
        • SHA256 d85642b0783e1999fadf82aedfcaaf03a35572ca15a9e4f9eb8e1fcaca2ce29c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ta.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ta.pak
        • Size 1.4MB
        • SHA256 9e3e0c909becc8bdf9c7cc1f9e401c464e7756e30369d40c709ea2dd942660c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        te.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\te.pak
        • Size 1.3MB
        • SHA256 4f565637cf197a38c3f2a650cdfac05995fee8da2b9216998ab3ef7937ce7e74
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        th.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\th.pak
        • Size 1.1MB
        • SHA256 6cf15aee57658d55ea0ff07dae2fbad7981093e7acf54014347307e3bd1aad08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\tr.pak
        • Size 554KB
        • SHA256 5fba0fce51cc3f9767d2cfdaef1192507f18b83235879aacc8f63b30880c8f00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        uk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\uk.pak
        • Size 952KB
        • SHA256 e8ffe116ebbdaace51d9e62fe3c119eb354b244a8395f82d61b67dc8e3b3abb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ur.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\ur.pak
        • Size 830KB
        • SHA256 8ab35f7d357a38922acc42c663089ef4e0ef42ce56e212c26507bd110c8e8967
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\vi.pak
        • Size 657KB
        • SHA256 ad778e5e76648700192dfb6a27c6be743935de00e3a75f208f3c1d3f6d3fd1c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zh-CN.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\zh-CN.pak
        • Size 473KB
        • SHA256 9cda0f5736ab40650d10dd93f35316c45d5db9c596b270a9476cdd19d624c7d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zh-TW.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\locales\zh-TW.pak
        • Size 468KB
        • SHA256 f1bd51245e56bcf324a8a94c4a572be031f2fd0db4d828471e563f64d8ecc79d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\resources.pak
        • Size 5.4MB
        • SHA256 c2dad6a9f8bf1b552fa94a51cadb6ed6a4e5a6455bcebf3c2888f0a6a3d6c8c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        app-update.yml
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\resources\app-update.yml
        • Size 105B
        • SHA256 02a60a3cff290c02086a998f87d7e2831f8a41835c565c6e03d930b979d8db9b
        • MD5 SHA1 SHA512
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\resources\app.asar
        • Size 16.0MB
        • SHA256 aa9b0cff75ea6808a5fad2712e501e48d6864d59d85135cf8aca65eb3b2ce8f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        elevate.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\resources\elevate.exe
        • Size 114KB
        • SHA256 c0647826e2acd22951ce7ce1d7df9ac460948909520771140f629639df378421
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\snapshot_blob.bin
        • Size 306KB
        • SHA256 31969e154d3cd857d14e9d8edb98118ad2d5e9e9f1b77f9085626bd500e34ce1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\v8_context_snapshot.bin
        • Size 650KB
        • SHA256 98c18470926e12def4c39163c5389f29c5df7d2a41bf7353a75a7cdc41f1a90c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\vk_swiftshader.dll
        • Size 5.2MB
        • SHA256 1a24356be288e742549a20c62de9259b2e1cf8bd560151ff7a24d4ae1a4652a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vk_swiftshader_icd.json
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\7z-out\vulkan-1.dll
        • Size 874KB
        • SHA256 7d411fa0a615d0f67099fc3978b3f07e28565b9877cce02ec239eb228fa4d485
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SpiderBanner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WinShell.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstD0AF.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default.dic
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        Preferences
        • Path C:\Users\Admin\AppData\Roaming\Netron\Preferences
        • Size 57B
        • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
        • MD5 SHA1 SHA512
        Submit Download

        Preferences~RFe5824e8.TMP
        • Path C:\Users\Admin\AppData\Roaming\Netron\Preferences~RFe5824e8.TMP
        • Size 86B
        • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
        • MD5 SHA1 SHA512
        Submit Download

        memory/1032-831-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-832-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-833-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-843-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-842-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-841-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-840-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-839-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-838-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download

        memory/1032-837-0x0000018659C80000-0x0000018659C81000-memory.dmp
        Download